# Hire without bias
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.
## 10 Steps To Reduce Unconscious Bias In Hiring Processes
Unconscious bias isn’t something a business can address overnight by passing a mandate. Even after rectifying the issues that need to be taken to improve the hiring process and income more diverse talent, recruiter bias may detail efforts and prevent the company from finding the best and brightest talent.

Below,  we explore 10 methods a company can implement to identify and reduce the impact of the biases that people within your organisation may hold. Improving your hiring practices and the many documented benefits of a more diverse workforce.

**1. Define Diversity And Set Goals**

Set business goals so that everyone knows that removing unconscious bias and building diversity is a priority. With that, define what diversity means to the company. What ethnicities, ages, genders and sexual preference groups are underrepresented and need to be addressed. Next, set metrics to achieve at each step in your candidate pipeline: applicant funnels, interview conversion rates and acceptances. Finally, communicate successes.

**2. Admit That Implicit Bias Exists**

Admit that there is bias. You have to name it to tame it. We need to not only look at qualifications, but also at what diversity is and how an outsider’s perspective can be an advantage. Instead of pretending to not notice differences, ask, “What will someone who is diverse, and in what way, add to our organization?”

**3. Create A Foundation Of Trust**

Creating a foundation of trust, commitment, accountability and collaboration is critical in supporting a company’s diversity, equity and inclusion strategy. Offering productive conflict development programs for learning how to better communicate creates unity that is essential.

**4. Make Hiring A Collective Effort**

Bias could exist in the design of the hiring process itself. Most processes are designed from one perspective (e.g., level, function, identity). In designing the process, make sure that it is a collective effort, with input from differing perspectives and identities. Or investigate a [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform).

**5. Have A Cross-Functional Interview Team**

Having a cross-functional interview team is a great way to reduce bias in the hiring process. Another good practice is to have a session with the interview team to brainstorm what to look for and what to watch out for.

**6. Appreciate Diversity In Management**

Hire more diverse managers and show appreciation for them. By definition, those with unconscious biases don’t realize they have them. So the best approach is to focus on creating an environment with true diversity.

**7. Use A Structured Interview**

Develop the interview while developing the job description, creating questions to discern candidates’ knowledge, skills and abilities relative to the job. Be disciplined about asking all applicants the same questions, which allows hiring decision makers to base decisions on informed comparisons about applicants’ capabilities rather than their first impressions.

**8. Check Yourself With Project Implicit**

[Project Implicit](https://implicit.harvard.edu/implicit/) is an excellent resource from Harvard. Noticing the impact biases have on decisions is illuminating. We recommend semi-regular checks with Project Implicit several times a year to stay consciously aware.

**9. Analyze Each Step Of The Hiring Process**

Unconscious biases don’t just happen at the interview stage. Your hiring process is a series of steps, not a single act. Analyze each step and gather data. That will allow you to determine where the problem lies (e.g., advertising for candidates, a small talent pool, the application process, interviews).

**10. Focus On The Job’s Behavioral Needs**

Focus on the behavioral needs of the job role instead of skills and experience. Skills and experience are poor predictors of candidate success; in fact, skills are the easiest to train for. Instead, organizations should focus on assessing people against a behavioral target, followed by a structured behavioral interview designed to uncover alignment with culture and values.

If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.


Hire without bias

If you’re looking for a role in information technology or information security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/).
#### Our [TL:DR](https://www.how-to-x.space/how-to-write-a-resume/) tips for those who don’t want to read the full article

1. Not more than 1 page for your resume unless absolutely necessary. Then never more than 2 pages.

1. Use a reverse chronological resume template (check out our free [templates here](https://drive.google.com/drive/folders/1X0x-XJ1wk7cZNiYV87oAWQt860srbZ7o?usp=sharing)).

1. Your resume summary/objective goes first and needs to grab the HR manager’s attention.

1. Tailor your resume to the job. Match your skills with the keywords listed in the job ad. This way you won’t be filtered out by an applicant tracking system.

1. Only list relevant skills and certifications. If you’re applying for an information security position, I’m not interested in your [White Card](https://www.safework.nsw.gov.au/licences-and-registrations/white-cards).

### Writing your resume
For most job-seekers, a **good resume** is what stands between them and their dream job. If you can get your resume right you’ll be getting replies for every role you qualify for.

If your resume game is weak, though, you’ll end up sitting around for weeks, maybe even months, before getting a response.

Writing a resume that leads to HR managers inviting you to interviews can be done by following the steps below:

- Pick the right resume template & layout
- Use a resume summary or objective
- Tailor your resume to include information relevant to the advertised role
- List your work experience & achievements
- Mention your top skills, certifications and projects

### How to pick the right resume template?
There are three types of resume template and your choice should depend on the type of job you are applying for and your level of experience.

The 3 resume templates are:

1. **Reverse chronological resume template** - This is the most common resume and is ideal if you have work experience relevant to the position you’re applying for.

1. **Skills-based resume template** – If you are short on relevant work experience because you’re a recent graduate, or are looking to make a career change then this is the template type for you.

1. **Combination resume format** – The combination resume is a great choice for job-seekers with a very diverse skill-set who are applying for roles that require a broad range of expertise. Inadvertently, many job seekers add to their resume over time and end up with a combination template but this is likely something to try to avoid. Unless deliberate.

So, which one do you go for?

In almost all cases, unless you’re short on relevant experience, you’d want to stick to the **reverse-chronological resume template**.

### What do you include?
Most commonly, resumes include:
- Contact information
- Professional resume summary or objective
- Work experience (and achievements)
- Education
- Skills, certifications and projects

### What goes into my resume summary/objective?
Your resume summary or objective is your first impression.

A HR manager spends very little time scanning each resume they receive for a job opening. Yep, your carefully-worded, hand-crafted resume will be among 20 to 50 others that only get a cursory glance. Unless, of course, you manage to ‘wow’ them early.

Your resume summary/objective is how you accomplish this. Both are placed at the top of your resume. They are the first thing a HR manager sees after your name.

#### Resume summary

This is a 2 to 3 sentence summary of your career. The resume summary is used in literally every situation except where you’re a recent graduate or switching careers.

In your resume summary you should include:

1. **Your relevant role(s) and years of experience**: *Senior security analyst with demonstrated success maintaining information security systems for over 5 years*.

1. **1 or 2 achievements (or outcomes)**: *Over three years I contributed to a team that reduced the mean time to recovery by 80% for incidents*.

1. **What you’re looking to achieve**: *Seeking further opportunities to drive operational excellence and overcome unique and evolving challenges*.

![](arn:aws:s3:::upwardspiral-blog-image-storage-d1wlpel6ks5k8p141722-production/Education.png)

#### Resume objective

As I mentioned before, a resume objective is the go-to for anyone that either has no work experience or is going through a career change. Much like a resume summary, a resume objective should be around 2 to 3 sentences and includes information on:

- **Your field of study**: *Recent graduate with a Bachelor of Computer Science from the Australian National University*.
 
- **Skills and experience relevant to the job**: *Two years of experience maintaining my own virtual network of 15+ machines, practising both my red and blue team techniques*.

- **Why you’re applying for the role**: *I am seeking opportunities to grow as an information security professional and apply these skills with real-world infrastructure*.

Or if you’re going through a career change:

- **Relevant work experience**: *System administrator with 5+ years managing enterprise networks*.

- **Skills and experience relevant to the job**: *Developing an intimate knowledge of network configuration and hardening techniques*.

- **Why you’re applying for the role**: *I am seeking opportunities to apply my understanding of enterprise networks as a penetration tester to ensure network security through consulting roles*.

![](https://drive.google.com/file/d/1fxyVPe0ceP6IZ72EOOpfTYgrrNkX8ZlC/view?usp=sharing)

### Work experience
The standard format for your work experience is as follows:

- **Job Title/Position** - Your job title goes first. This ensures a hiring manager can see, at a glance, you have relevant work experience.

- **Company Name / Location / Description** - Then, the name of the employer, as well as the location of the office.

- **Responsibilities & Achievements** - This is the core of each work experience entry. Rather than a list of responsibilities, summarise your day-to-day life as if you were explaining it to a friend in 30 words or less. List key achievements below and tie them to metrics.

- **Dates Employed** - The timeframe of your employment in each company. The standard format expected by recruiters and employers is month/year.

One of the most common resume mistakes is listing responsibilities. For example:

----------
“Security Analysis - Internship

- Vulnerability scanning & assessment of web application.
- Technical reconnaissance.
- Amazon Web Service (AWS) security audits using prowler.
- Vulnerability report writing for clients outlining the potential issues to their infrastructure. 
- Forensic report on threat actor gain access to system or database.
- etc...”
----------

It’s more than likely everyone applying for the role has a similar background. And 90% of those resumes will likely have the same list. It does nothing to distinguish you but consumes valuable real estate.

So, to stand out, you want to focus on mentioning achievements in your resume instead. Or in simple terms, how exactly you helped the company grow, reach quarterly goals, etc.

Here’s an example:

![](https://drive.google.com/file/d/18eEGcI42lmNlq1V_nkN29ERJA298XE2c/view?usp=sharing)

Keep in mind, though, that in some fields, there aren’t that many achievements you can mention. In such fields, it’s pretty hard to distinguish yourself, so it’s totally OK to stick to responsibilities instead.

### Tailor your resume
Applicant Tracking Systems (ATS) are the thing you’ve never heard of that filter ~70% of resumes before they’re ever read.

An ATS is software that helps a company filter through the hundreds of resumes they receive.

To get past this, it’s important to tailor each of your resumes for the job you’re applying for. To do this, you need to cite the key words from the job ad in your resume.

(I’ll add a link here shortly to provide better detail.)

Otherwise, this simple example should give you enough information to successfully navigate an ATS.

![](https://drive.google.com/file/d/1F0cLwfjFUaL3TCYy1ycWjF2mJSR5LRRI/view?usp=sharing)

Looking at the role, the critical requirements for the job are:

- 5+ years of experience in space travel

- Experience managing a monthly budget in excess of $20,000

- Comfortable in situations of imminent death

Now, you need to tailor your resume to these requirements, which is as simple as mentioning them in your resume.

### Education
Education is easy:

- Program Name: “Bachelor of Computer Science”

- University Name: “Australian National University”

- Years Attended: “02/2013 - 10/2016”

- (Optional) Honors: Cum Laude, Magna Cum Laude, Summa Cum Laude.

- (Optional) Academic achievements: Any interesting papers you’ve written, Golden key, etc.

![](https://drive.google.com/file/d/1BeDiEJrIN_YcmiRgBIx7i0OUBq4l6pQ9/view?usp=sharing)

### Skills, Certifications & Projects

Another must-have inclusion in your resume are “Skills” and “Certifications” sections. Here, you want to mention all your know-how that makes you the perfect candidate for the job.

#### Skills

Tailor your skills to the job. No matter how cool your skill is, if it isn’t relevant for the job, don’t include it. There are 2 types of skills you can include when writing your resume:

- **Hard Skills (Measurable abilities)**: This can be anything from coding in Python to being able to do a backflip.

- **Soft Skills (Personal skills)**: This can be broad, but we recommend  communication, personal traits (persistent, curious, etc), and leadership. Where they’re applicable to you.

Hard skills are necessary. Soft skills should be considered optional. We prefer to demonstrate soft skills in our resume objective/summary.

#### Certifications

Have you acquired any industry relevant certificates from industry experts?

Let’s say, for example, you’re applying to become an AWS Cloud Engineer. It would be worth - acquiring and - listing specialist AWS certificates. But only if it is relevant to the position you’re applying for.

#### Projects

Projects - ideally somewhere on Github - are one of your greatest assets. Not only do they show off your passion but they provide tangible evidence that you can execute against the skills you have listed.

If you are pursuing a role, or attempting to advance in your career, in information security or software development then being able to demonstrate capability in this way is essential for landing a dream role.

If you’re looking for a role in information technology or information security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/).

How to make a resume

## Top cyber security stories of 13/12/21 to 20/12/21
Below are the top stories in the space of cyber security.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[The best log4j memes](https://log4jmemes.com/)** *Reported by Log4jmemes.com
 

2. #### **[No one writes useful software unless they're paid - Eulogy for open source](https://christine.website/blog/open-source-broken-2021-12-11)** *Reported by Christine*
 

3. #### **[uBlacklist: Blocks specific sites from appearing on Google search results](https://github.com/iorate/uBlacklist)** *Reported on Github*
 

4. #### **[Marketing is scary for a solo developer: A developer's story](https://raumet.com/marketing)** *Reported by Raumet.com*
 

5. #### **['Significant amounts of water' found in Mars' massive grand canyon](https://edition.cnn.com/2021/12/16/world/exomars-water-mars-grand-canyon-scn/index.html)** *Reported by CNN.com*
 

6. #### **[Lithuania evacuates its embassy in China](https://www.economist.com/china/lithuania-evacuates-its-embassy-in-china/21806843)** *Reported by the Economist*
 

7. #### **[Former Netflix executive sentenced to 30 months for bribing vendors](https://www.justice.gov/usao-ndca/pr/former-netflix-executive-sentenced-30-months-bribes-and-kickbacks-netflix-vendors)** *Reported by the Department of Justice*
 

8. #### **[Toyota owners have to pay $8/month to keep using their key fob](https://arstechnica.com/cars/2021/12/toyota-owners-have-to-pay-8-mo-to-keep-using-their-key-fob-for-remote-start/)** *Reported by arstechnica*
 

9. #### **[Why do I have to tolerate these cookie pop-ups?](https://news.ycombinator.com/item?id=29529062)** *Reported by ycombinator*
 

This round-up was generated for on 20 December, 9:05am and contains the top 9 stories between 13 December 9:11am and 20 December, 9:00am

Hacker News Round-up (20/12/21)

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

# Certs for progressing your pen testing career
One of the most common questions I get while helping job seekers find a role is “*what certification do I need?*”
It’s not surprising.

In the last year or two, every man and his dog who has heard the [‘How I made my first million’](https://podcastaddict.com/episode/128829424) podcast on the money-making potential of your own certification has created their own course and polluted the industry with uncertainty.

### Which certificate really matters?
What really matters is working out what you need to demonstrate to hiring managers (internal or external) that you can take on the role and cause minimal disruption.

This pen testing focused blog will be the first in a series of posts where I will break down infosec roles and walk through the certifications hiring managers are looking for at each phase of your career.

*This post isn’t intended to disqualify all self-paced learning outside these certifications. It is to highlight the learning that will help aspiring professionals progress in their career.*

### Your pen testing career
#### Starting from zero
Your starting point for hands-on experience should be Heath Adams’ [‘Linux Essentials for Ethical Hackers.’](https://www.youtube.com/watch?v=lZAoFs75_cs) In this course you will be introduced to everything you need to start any of the following hands-on exercise platforms that will build a foundation for your cyber career.

After this, there are a number of free hands-on resources for you to hone your skills.
Platforms like the [Mosse Cyber Security Institute](https://platform.mosse-institute.com/#/), [TryHackMe](https://tryhackme.com/) and [Hacker101](https://www.hacker101.com/) are guided hands-on hacking opportunities to introduce you to the foundational concepts you will need through your career.

You can progress to less ‘guided’ training platforms like [HacktheBox](https://www.hackthebox.com/), [root-me](www.root-me.org), [HackthisSite](hackthissite.org/mission/basics), and [AttackDefense](attackdefense.com).
Once you’re comfortable with the level of these resources, you can start looking into entry- and junior level penetration testing roles.
#### Entry-level job ready
If you’re looking for your first role as a pen tester, focus your attention on [PEH by TCM](https://academy.tcm-sec.com/p/practical-ethical-hacking-the-complete-course). This is the bar for entry-level penetration tester roles. If you have this most employers will feel confident that you are job-ready for an entry-level pentester role.

The course will cost you ~USD$30.00 (you can find it for free with appropriate googling) and compliments any university degree or TAFE certificate.

Alternatively you could pursue the [eJPT](https://elearnsecurity.com/product/ejpt-certification/). This certificate comes with slightly more weight in terms of job-seeking credibility but the fee is marginally higher. Is it worth it? We think so. PEH leaves you in a strong position in your job search, but we feel eJPT better sets you up for success long-term. It is also the precursor to the eCPPT (which we talk about in a moment) which you might want later in your career.

As a final possibility, the [CompTIA PenTest+](https://www.comptia.org/certifications/pentest) is widely recognised within the industry for entry- and junior penetration testing positions. We tend to lean away from this certificate as the materials - we feel - do not prepare you for the role as well as the previously mentioned certificates. It also comes with an incredibly high price tag at ~USD$370 and we cannot find any reason to justify this cost.
#### Progressing to the next stage of your pen testing career
The next step penetration testers have taken in their career, historically, has been the Offensive Security Certified Professional (OSCP), or [PEN-200](https://www.offensive-security.com/pwk-oscp/). This ethical hacking course is online and self-paced. It introduces more advanced penetration testing tools and techniques via hands-on experience. PEN-200 focuses on the skills and mindset required to be a successful penetration tester. It assesses you through a multiple choice exam.

The PEN-200 certification will set you back ~$999 to $1,350 for the materials and your first attempt at the exam.

An alternative to the OSCP, is the eCPPT. This certificate is less well known but we believe the materials are more valuable. The teaching concepts are far more advanced t han the OSCP and eCPPT is startin to increase in popularity as a result.

Rather than a multiple choice exam that will test your knowledge and - loosely - ability to keep notes, the eCPPT is built around building your experience while applying skills in a hands-on testing environment.

The best path to achieve the eCPPT is to purchase a subscription with [INE](https://ine.com/pages/plans) and follow the [Pen Tester](https://my.ine.com/path/9a29e89e-1327-4fe8-a201-031780263fa9) learning path. Most companies will be willing to pay for your INE subscription. If they aren’t willing, access to a full year is a very reasonable $749 or $49 monthly. Your subscription will also provide access to a number of other incredibly useful learning materials that you can [browse here](https://ine.com/).

#### Other certifications for late-career
Late in your career it used to be as simple as pursuing the OSCE. Unfortunately, this has since been retired. However, if you’re looking to really establish yourself as an expert in the field there are plenty of opportunities to specialise.

Too many for us to list here.

However, by this stage you have likely identified your preferred learning platform. For us, it has become [INE](https://ine.com/). Through their platform they offer no shortage of opportunities to specialise in cloud, web applications, networking and other areas for the same fee discussed above.


Certs for progressing your pen testing career

### Earn rewards by referring Upward Spiral
Recommend [Upward Spiral](upwardspiral.io) to your network, and we’ll reward you for the new users.

<h1> How it works </h1>

|(1) Refer | (2) Find work | (3) Earn |
|------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------|
| Refer the platform to friends in your network. | Job seekers find work through the Upward Spiral platform. | Get a cash reward for the eligible users you refer. |

Upward Spiral is a job seeker platform. Our mission is to help 1-million cyber professionals find a role that resonates with them. Earn for every new Upward Spiral referral who gets a new job or hires! Australian rates:
- Every successful job-seeker referral: AUD $500.00
- Every recruit hired by an employer referral: 10% of every placement commission up to AUD $20,000 per year per business referred

For example:
- *Payouts per new job seeker referral*: if you refer 10 new job seekers and 8 of them find their next job, you get paid for all 8 users: AUD $500 x 8 = $4,000.
- *Payouts per new employer referral*: if you refer 1 new employer account and they recruit 10 users through the platform, you get paid for all 10 recruits. If the recruits are all paid AUD $100,000 you will receive 10% of our commission fee (10%): 10 x ($10,000 x .1) = $10,000. Earn up to $20,000 per business referred per year.

### Frequently asked questions
##### Why should I join the [Upward Spiral](https://upwardspiral.io/) referral program?
The referral program is designed to accelerate Upward Spiral’s mission of helping 1-million cyber professionals find a role that resonates with them.

Joining the referral program allows you to help address the cyber skills shortage while receiving generous rewards for your efforts.

###### How much will I earn for each referral eligible for payout?
You’ll receive a cash payout for every new eligible user that you refer to Upward Spiral.

You will be rewarded based on the number of referrals and the number of recruits per employer. For example, if you refer one employer account that recruits ten employees you will be rewarded for all ten recruits for a portion of their annual salary.

###### How does it work?
One of our advisors on-boards every job seeker or employer to the platform. During the on-boarding we ask how they heard about us.

If they share your name we’ll reward you.

If they don’t and you can prove you referred them - email or other - we’ll reward you.

Earn rewards by referring Upward Spiral

### Companies: How do Upward spiral vet candidates?
Upward Spiral are a team of information security and technology professionals who have experience doing information security and technical hiring ourselves.

Our team considers a wide variety of criteria that includes formal education, work experience, side projects and independent learning. If a candidate has code or materials available - Github, BitBucket, etc - we'll review those.

Dozens of people apply to Upward Spiral on a weekly basis.

If we are still unsure, we require a candidate to complete a skill assessment or other relevant screening test, and then we review them based on their results and their profile together.


Companies: How do Upward spiral vet candidates?

### For job seekers
Upward Spiral helps information security candidates find amazing jobs. Our team has taken inspiration from Philip Joubert and reshaped the recruitment model. Instead of candidates having to apply for job after job, companies reach out to candidates they feel would be the ideal fit in their team with interview requests that include upfront salary and role information. At Upward Spiral we believe it should be easy for you to find a job. Upward Spiral creates a simple process that lets the candidate be in control of the recruiting process. You can compare salary information, work environment, learning & training opportunities at different companies and make the best choice for your personal goals.
#### How to get involved? 
It’s as simple as signing up to [Upward Spiral](https://upwardspiral.io/login). Upward Spiral isn’t for networking and by default we will hide your profile from companies until you (and us) are ready. Our team will review your profile after you sign up and get back to you within 48 hours. If you’re accepted, we’ll provide you with a talent advisor who will help you complete your profile and make any finishing touches before making the profile visible to companies. Once your profile is live, companies will be able to see your profile for 45 days. If a company is interested in you they will send you an interview request, which includes salary and role info. It’s entirely up to you if you choose to accept or decline the request. If you find a job through Upward Spiral, we’ll send you an epic pile of swag to say thanks for using the platform.
#### What to expect
“The best, easiest and most convenient way to find the perfect job!” That’s the bar we set at Upward Spiral. Our aim is to be a breath of fresh air in the information security space. Providing unparalleled advice, a superb process for finding a great job, and awesome swag at the end. Our goal is to make sure we place people in jobs they will love.

What does Upward Spiral do exactly?

### Companies: Background checks
Upward Spiral does not perform pre employment background checks on candidates. Nor does Upward Spiral undertake reference, criminal record, education, credit or otherwise checks.
Employers are responsible for performing due diligence on all candidates.


Companies: Does Upward Spiral do background checks?


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### Cyber Security Analyst Jobs
From 2013 to 2021, the [number of unfilled cybersecurity](https://cybersecurityventures.com/jobs/#:~:text=Over%20the%20eight%2Dyear%20period,to%203.5%20million%20in%202021) positions grew by a whopping 350%. It would be crazy to expect the demand for cyber security analysts to fall any time soon.  
A cybersecurity analyst protects an organisation from cyber threats and actively develops processes, protocols and systems to respond to and quell attacks. Cybersecurity analysts protect an organisation’s infrastructure, such as computer networks and hardware devices, from cybercriminals and hackers seeking to cause damage or steal sensitive information.
#### What is a cyber security analyst?
Cyber security analysts can work across the spectrum of computer and information networks. A security analyst is a trained cyber professional who specialises in network and IT infrastructure security. From corporate databases to banking networks and from office networks to military intelligence, cyber security analysts can be found anywhere that large amounts of 
In an organisation a cyber security analyst thoroughly understands cyberattacks, malware, and the behavior of cybercriminals, and actively seeks to anticipate and prevent these attacks. A well-trained security analyst will probably have an advanced understanding of both hardware and software, and how data is stored and managed. The analyst usually possesses at least a bachelor's degree in cybersecurity or a related field.

The top three cyber security threats facing information technology networks of all scales are ransomware attacks, social engineering attacks, and the theft or compromise of sensitive information. Typically, threats inside the organisation - often accidentally - are the greatest risk an organisation will face. This means that cybersecurity analysts need to be familiar with a wide variety of threats both internally and externally when it comes to security issues.
#### What does a cyber security analyst do?
A cyber security analyst often wears a lot of hats in an organization or company. They are likely involved in security, system design, system policy, trainer, and educator.
 
A cyber security analyst protects an organisation’s hardware, software, and networks from cyber criminals and other threats. The analyst's primary role is to understand the organisation's IT infrastructure in detail, monitor it at all times, and evaluate threats that could potentially breach the network. The cyber security analyst continuously looks for ways to enhance company network security and protect its sensitive information.
 
Cyber security analysts are often thought of as first responders, as they often triage security incidents. In practice, cyber security analysts spend their time developing policies, procedures and reviewing best practices to implement within an organisation. Then, training an organisation on the change.
 
In the ideal world for an organisation with strong security posture, a cyber security analyst has the opportunity to be proactive. Taking steps to prevent security breaches. They have the opportunity to constantly update processes, policies, systems and software, they can penetration test the organisation and try to find loopholes in computer code or operating systems to guarantee security.
 
Broadly, the cyber Security analyst is responsible for:
* **Configuring Tools:** This may come in the form of virus software, password protectors, and vulnerability management software. They will evaluate what the company needs and use these tools to protect its information.
* **Reporting:** The analyst will detail what is currently going on in the network and evaluate its strengths. One of the skills needed is learning to read these reports. They will show what is well-protected and indicate if there is any unusual activity in the network.
* **Evaluate Weaknesses:** No network is fully secure, but the goal is to make it as secure as possible at every opportunity. Part of the job is to continuously test all company networks and find weaknesses before bad actors or external threats can compromise them.
#### What education does a Cyber Security Analyst need?
Cyber security analysts are more entry-level roles in the cyber security field. In order to be qualified it is recommended to have formal education in cyber security or more broadly information technology. This type of education program will help you learn IT fundamentals as well as critical cybersecurity foundations that will prepare you for the requirements of the job. Scripting and programming, data management, penetration testing, hacking and countermeasures, and more will all be critical elements of your cyber security education.

**What skills does a Cyber Security Analyst need?** 
The skills and expertise a cyber security analyst needs will vary from job to job. Some security analyst openings seek very specific skills due to the nature of a particular network or the organisation’s employees.

For early - or soon-to-be - career professionals, the key to understanding the most marketable skills to acquire is to study different job descriptions. Investigate the key words, problems, languages they refer to. Researching this information will reveal how skills and experience will map to opportunities and it will change over time. It will also inform the type of training, education or verification you might want to pursue.

Despite the wide variability of cyber security analyst jobs, there are a number of characteristics or skills that are consistent for cyber security analysts across the spectrum. Both hard- and soft-skills. These include:

* **Programming experience:** Cyber security analysts are charged with defending digital infrastructure. Consequently, cyber security professionals are expected to have some base level of programming experience and familiarity with foundational programming languages such as C, C++, PHP, Perl, and Java. 
* **Communication:** Beyond understanding, is the expectation that you can communicate your understanding in laymen’s terms to others. You will have to communicate with others a lot in this job and work with a team that is responsible for security. 
* **IT Knowledge:** This job requires you to stay up-to-date on trends in the technology world. You need to be aware of the best practices, techniques, and any laws that change. 
* **Analytical:** Security analysts work with data from a variety of sources and so they need to be able to take information from many inputs to make decisions. 
* **Detail-oriented:** Much of the work of cybersecurity analysts comes down to examining small details — like lines of computer code or network commands — that could have major impacts. 
* **Forward-thinking:** Security analysts need to anticipate the future based on current data and trends and then make security recommendations accordingly. 
* **Creativity:** You may not think a cyber security expert needs to be creative, but this is a must! You need to think of creative ways that bad guys can breach your organisation's system, then think of creative solutions to prevent them. 
* **Strong Attention to Detail:** This is not something that should be overlooked. You need to be detail-oriented for this job, paying strong attention to the smallest adjustments and changes in your organisation's network. 
#### How to become a Cyber Security Analyst?
**Four steps to becoming a cyber security analyst:** 
* **Research:** The number of opportunities and and new roles within as a cyber security analyst continues to evolve, creating plenty of career opportunitities for cyber security professionals. The first step in becoming a cyber security analyst is to understand the kind of work you want to do and map out the relevant education and certifications you will need. Even entry-level cyber security analyst positions might require specialised training, so it’s best to plan in advance.
* **Education:** Most cyber security analysts have a bachelor’s degree in cyber security (or field such as mathematics, computer science, or information technology). However, this is not absolute. Cyber security certifications (see the next point) and associate’s degrees and/or relevant training or background (like military service, for example) can be sufficiant to obtain entry-level cyber security jobs in the private sector.
* **Certification:** It is very common for entry-level and mid-level opportunities to require differing levels of certification to demonstrate proficiency in the relevant skill.
* **Network:** An important part of becoming a cyber security analyst is developing a professional network. A network that is broad by aligned with the cyber security profession will help you stay informed about the latest trends, opportunities and changes in the sector.
#### Do Cyber Security Analysts need certifications?
**Yes.** 
To do the job, like any job, you need to be capable at the role. That doesn’t require a certification or degree but certifications and degrees make it much easier for recruiters to identify the candidates that are likely to be capable in the role. It’s really that simple when it comes to qualifications. In most fields.

Some of the industry-standard certifications you may want as a cyber security analyst are: 
* Certified Cloud Security Professional (CCSP)
* Systems Security Certified Practitioner (SSCP)
* A+ (CompTIA)
* Cybersecurity Analyst Certification, CySA+ (CompTIA)
* Network+ (CompTIA)
* Network Vulnerability Assessment Professional (CompTIA)
* Network Security Professional (CompTIA)
* Security Analytics Professional (CompTIA)
* Security+ (CompTIA)
* Project+ (CompTIA)
* PenTest+ (CompTIA)
* IT Operations Specialist (CompTIA)
* Secure Infrastructure Specialist (CompTIA)
* ITIL1 Foundation

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).


Cyber Security Analyst Jobs

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

### Malware Analyst Jobs
From 2013 to 2021, the [number of unfilled cybersecurity](https://cybersecurityventures.com/jobs/#:~:text=Over%20the%20eight%2Dyear%20period,to%203.5%20million%20in%202021) positions grew by a whopping 350%. It would be crazy to expect the demand for cyber security analysts to fall any time soon.

An important and rapidly growing role within the cyber security ecosystem is the malware analyst. This role is part security engineer, part programmer, and part digital forensics and is a crucial function in providing necessary intelligence after a cyber security incident. Once the initial incident has been addressed it is critical that a thorough analysis and examination of the incident takes place. This will typically involve a close look at the methods, techniques, tactics and tools used by the adversary.

By understanding the incident new defenses can be developed, or existing ones can be refined as needed. The ability to reverse engineer malicious code is paramount in all defensive strategies and this is where the malware analyst brings value to the cyber security team.
 
The cross between a highly-skilled programmer and a cyber detective makes this an attractive option for many highly skilled and curious tech types. This is a competitive and highly sought after role.
#### What is a malware analyst?
A malware analyst is the [Hercule Poirot](https://en.wikipedia.org/wiki/Hercule_Poirot) of an organisation’s cyber security team. The role is unique within an organisation’s security, defensive techniques and security principles.

A malware analyst is a cyber-sleuth, with capable programming skills. They leverage their programming capabilities to identify how an attack occurred, why it was or wasn’t successful, and most importantly how it can be defended.

A malware analyst possesses the knowledge and skill needed to understand the exploit and identify the vulnerability. This role is unique within a security enterprise because it requires an understanding of offensive as well as defensive techniques and security principles.
#### What does a malware analyst do?
A malware analyst identifies, examines, and understands the various forms of malware and their delivery methods. This includes all diverse forms of bots, buts, rootkits, adware, spyware, ransomware, trojan horses, viruses and worms.

The malware analyst comes into the picture after an organisation’s incident response team has identified and contained an attack. Their purpose is to disassemble, deconstruct, and reverse engineer the malicious code to allow the organisation to better protect against future attacks of similar capability and origin.

It is largely a function of solving puzzles and connecting seemingly unrelated dots.
While sometimes called in during the early stages of an attack to bring clarity to the type of attack and shed light on the methods being used by attackers a malware analyst isn’t typically considered a component of the incident response team or even the first line team. Commonly the malware analyst becomes more involved in mitigation and recovery efforts once the attack vector has been identified and the payload contained.

Regular activities include examining suspect code to determine if there is an element of a malware attack. This is particularly common when working with advanced persistent threats (APT), where code may be placed in small amounts over a longer period of time before being detonated. This makes the task of detecting and identifying malicious code more difficult, it also provides the malware analyst with enough time to examine and protect against an attack before harm is done.

Strength in analysing and reverse engineering code enables the malware analyst to be effective in protecting the network by predicting the objective of the code to establish a signature.

Broadly, the malware analyst is responsible for:
* **Reverse Engineering:** Reverse engineering (also known as backwards engineering or back engineering) is a process or method through the application of which one attempts to understand through deductive reasoning how a device, process, system, or piece of software accomplishes a task with very little (if any) insight into exactly how it does what it does.
* **Advise Incident Responders:** Providing advice and guidance services to incident respondets when making their choices to ensure they are appropriately informed about threat actors.
* **Examining Suspect Code:** The collection of information in a way that maintains its integrity allowing for the investigation and analysis of the data or system to determine if it was changed, how it was changed, who made the changes and what their intent may be.

**What skills does a malware analyst need?**
The ability to analyze and reverse engineer suspicious code enables the malware analyst to protect digital assets. An ideal candidate will have one or more of the following skills:
* IDA Pro, WinDbg, OllyDbg, Immunity Debugger
* Strong knowledge of C/C++, Windows API, and Windows OS internals
* Reconstruct unknown file formats & data structures
* Reconstruct unknown TCP/IP protocols
* Understand unpacking, deobfuscation, and anti-debugging techniques
* Python, Perl, Ruby scripting
* Ability to write technical reports

Common job responsibilities will include:
* Record malware threats and identify systems to avoid them
* Examine programs and software using analysis programs to identify threats
* Classify malware based on threats and characteristics
* Stay up to date on the latest malware and keep software updated to defend against them
* Write alerts to keep the security team informed
* Help create documentation for security policies
* Understand tools that identify zero-day cyber threats

While most malware is written in middle-level languages such as C or C++, the code will need to be disassembled to be readable. This requires that a malware analyst be able to read, understand, and program in the much more arduous low-level assembly language.

The ability to work with various high-level programming languages is important. The use of specialized and sophisticated digital tools will be required. Both hard- and soft-skills. These include:
* **Programming experience:** Malware analysts are charged with identifying actors through the exploration of code. Consequently, malware analysts are expected to have a strong understanding of commonly encountered languages. The middle-level languages (C or C++) encompass most malware. However, analysts need to be able to read, understand and program in the much more arduous low-level assembly languages. 
* **Communication:** Beyond understanding, is the expectation that you can communicate your understanding in laymen’s terms to others. You will have to communicate in high pressure situations in this job.
* **Detail-oriented:** Much of the work of malware analysts comes down to examining small details.
* **Forward-thinking:** Malware analysts need to be aware of up-to-date trends.
* **Digital tools:** The ability to use specialised and sophisticated digital tools is necessary.
#### How to become a Malware Analyst?
**Five steps to becoming a malware analyst:**
* **Education:** Having a bachelor’s degree in computer science or cyber security will greatly assist your career and prospect of acquiring a role. Success as a malware analyst is determined by an operator’s ability to stay ahead of skilled threat actors and a solid foundational education will greatly improve your success at accomplishing this. However, a degree is not essential.
* **Career path:** A common career path for this cyber security specialty is to spend several years as a programmer or developer. These skills arm the applicant with a necessary foundation for understanding how malicious software is created.
* **Professional certifications:** While there is no industry-wide prescribed professional certification required for a career as a malware analyst, one certification stands out. The Certified Information Systems Security Professional (CISSP) demonstrates that an applicant has a sound understanding of security architecture, engineering, and management.
* **Experience:** The knowledge and skill threshold for becoming a malware analyst is cross-functional and best suited for an experience cyber security professional or computer scientist. It is assumed entering the field you have a university level qualification in one of those fields and you will still require relevant work experience in both areas to be successful in the role.
* **Continued learning:** A critical qualifying step toward becoming a malware analyst is to demonstrate a drive and ability to stay abreast of cutting-edge attack techniques and methods. The ability to identify, contain, disassemble, and mitigate zero-day malware is the pinnacle of desirable skills.
 Largely, cyberattacks are successful because they contain some unexpected or unforeseen element in the cyber kill chain. The job of a malware analyst includes being able to look at past events and accurately predict what the next attack may look like.
#### How much do malware analysts make?
It takes special programming and language skills to become a malware analyst. It also requires a strong understanding of various complex tools. It is considered by most to be a role for experienced operators, rather than an entry-level role and it commends a commensurate level of compensation.

The average malware analyst salary is US$165,000 per year. Entry-level positions start at US$78,000 per year while experienced workers can make up to US$234,000 per year.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

A place for our blogs and content

Hire without bias
Adviser Jack - 1/21/2022

How to make a resume
Adviser Jack - 1/18/2022

Hacker News Round-up (20/12/21)
Adviser Jack - 12/21/2021

Certs for progressing your pen testing career
Adviser Jack - 12/3/2021

Earn rewards by referring Upward Spiral
Adviser Jack - 11/19/2021

Companies: How do Upward spiral vet candidates?
Adviser Jack - 11/16/2021

What does Upward Spiral do exactly?
Adviser Jack - 11/16/2021

Companies: Does Upward Spiral do background checks?
Adviser Jack - 11/16/2021

Cyber Security Analyst Jobs
Adviser Jack - 11/16/2021

Malware analyst jobs
Adviser Jack - 11/13/2021

A place for our blogs and content

Hire without bias.css-1v2gfp5{margin:0;font-family:"Roboto","Helvetica","Arial",sans-serif;font-weight:400;font-size:0.75rem;line-height:1.66;letter-spacing:0.03333em;}Adviser Jack - 1/21/2022

How to make a resumeAdviser Jack - 1/18/2022

Hacker News Round-up (20/12/21)Adviser Jack - 12/21/2021

Certs for progressing your pen testing careerAdviser Jack - 12/3/2021

Earn rewards by referring Upward SpiralAdviser Jack - 11/19/2021

Companies: How do Upward spiral vet candidates?Adviser Jack - 11/16/2021

What does Upward Spiral do exactly?Adviser Jack - 11/16/2021

Companies: Does Upward Spiral do background checks?Adviser Jack - 11/16/2021

Cyber Security Analyst JobsAdviser Jack - 11/16/2021

Malware analyst jobsAdviser Jack - 11/13/2021