If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

# Certs for progressing your pen testing career
One of the most common questions I get while helping job seekers find a role is “*what certification do I need?*”
It’s not surprising.

In the last year or two, every man and his dog who has heard the [‘How I made my first million’](https://podcastaddict.com/episode/128829424) podcast on the money-making potential of your own certification has created their own course and polluted the industry with uncertainty.

### Which certificate really matters?
What really matters is working out what you need to demonstrate to hiring managers (internal or external) that you can take on the role and cause minimal disruption.

This pen testing focused blog will be the first in a series of posts where I will break down infosec roles and walk through the certifications hiring managers are looking for at each phase of your career.

*This post isn’t intended to disqualify all self-paced learning outside these certifications. It is to highlight the learning that will help aspiring professionals progress in their career.*

### Your pen testing career
#### Starting from zero
Your starting point for hands-on experience should be Heath Adams’ [‘Linux Essentials for Ethical Hackers.’](https://www.youtube.com/watch?v=lZAoFs75_cs) In this course you will be introduced to everything you need to start any of the following hands-on exercise platforms that will build a foundation for your cyber career.

After this, there are a number of free hands-on resources for you to hone your skills.
Platforms like the [Mosse Cyber Security Institute](https://platform.mosse-institute.com/#/), [TryHackMe](https://tryhackme.com/) and [Hacker101](https://www.hacker101.com/) are guided hands-on hacking opportunities to introduce you to the foundational concepts you will need through your career.

You can progress to less ‘guided’ training platforms like [HacktheBox](https://www.hackthebox.com/), [root-me](www.root-me.org), [HackthisSite](hackthissite.org/mission/basics), and [AttackDefense](attackdefense.com).
Once you’re comfortable with the level of these resources, you can start looking into entry- and junior level penetration testing roles.
#### Entry-level job ready
If you’re looking for your first role as a pen tester, focus your attention on [PEH by TCM](https://academy.tcm-sec.com/p/practical-ethical-hacking-the-complete-course). This is the bar for entry-level penetration tester roles. If you have this most employers will feel confident that you are job-ready for an entry-level pentester role.

The course will cost you ~USD$30.00 (you can find it for free with appropriate googling) and compliments any university degree or TAFE certificate.

Alternatively you could pursue the [eJPT](https://elearnsecurity.com/product/ejpt-certification/). This certificate comes with slightly more weight in terms of job-seeking credibility but the fee is marginally higher. Is it worth it? We think so. PEH leaves you in a strong position in your job search, but we feel eJPT better sets you up for success long-term. It is also the precursor to the eCPPT (which we talk about in a moment) which you might want later in your career.

As a final possibility, the [CompTIA PenTest+](https://www.comptia.org/certifications/pentest) is widely recognised within the industry for entry- and junior penetration testing positions. We tend to lean away from this certificate as the materials - we feel - do not prepare you for the role as well as the previously mentioned certificates. It also comes with an incredibly high price tag at ~USD$370 and we cannot find any reason to justify this cost.
#### Progressing to the next stage of your pen testing career
The next step penetration testers have taken in their career, historically, has been the Offensive Security Certified Professional (OSCP), or [PEN-200](https://www.offensive-security.com/pwk-oscp/). This ethical hacking course is online and self-paced. It introduces more advanced penetration testing tools and techniques via hands-on experience. PEN-200 focuses on the skills and mindset required to be a successful penetration tester. It assesses you through a multiple choice exam.

The PEN-200 certification will set you back ~$999 to $1,350 for the materials and your first attempt at the exam.

An alternative to the OSCP, is the eCPPT. This certificate is less well known but we believe the materials are more valuable. The teaching concepts are far more advanced t han the OSCP and eCPPT is startin to increase in popularity as a result.

Rather than a multiple choice exam that will test your knowledge and - loosely - ability to keep notes, the eCPPT is built around building your experience while applying skills in a hands-on testing environment.

The best path to achieve the eCPPT is to purchase a subscription with [INE](https://ine.com/pages/plans) and follow the [Pen Tester](https://my.ine.com/path/9a29e89e-1327-4fe8-a201-031780263fa9) learning path. Most companies will be willing to pay for your INE subscription. If they aren’t willing, access to a full year is a very reasonable $749 or $49 monthly. Your subscription will also provide access to a number of other incredibly useful learning materials that you can [browse here](https://ine.com/).

#### Other certifications for late-career
Late in your career it used to be as simple as pursuing the OSCE. Unfortunately, this has since been retired. However, if you’re looking to really establish yourself as an expert in the field there are plenty of opportunities to specialise.

Too many for us to list here.

However, by this stage you have likely identified your preferred learning platform. For us, it has become [INE](https://ine.com/). Through their platform they offer no shortage of opportunities to specialise in cloud, web applications, networking and other areas for the same fee discussed above.


Certs for progressing your pen testing career

If you’re looking for a role in information technology or information security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/).
#### Our [TL:DR](https://www.how-to-x.space/how-to-write-a-resume/) tips for those who don’t want to read the full article

1. Not more than 1 page for your resume unless absolutely necessary. Then never more than 2 pages.

1. Use a reverse chronological resume template (check out our free [templates here](https://drive.google.com/drive/folders/1X0x-XJ1wk7cZNiYV87oAWQt860srbZ7o?usp=sharing)).

1. Your resume summary/objective goes first and needs to grab the HR manager’s attention.

1. Tailor your resume to the job. Match your skills with the keywords listed in the job ad. This way you won’t be filtered out by an applicant tracking system.

1. Only list relevant skills and certifications. If you’re applying for an information security position, I’m not interested in your [White Card](https://www.safework.nsw.gov.au/licences-and-registrations/white-cards).

### Writing your resume
For most job-seekers, a **good resume** is what stands between them and their dream job. If you can get your resume right you’ll be getting replies for every role you qualify for.

If your resume game is weak, though, you’ll end up sitting around for weeks, maybe even months, before getting a response.

Writing a resume that leads to HR managers inviting you to interviews can be done by following the steps below:

- Pick the right resume template & layout
- Use a resume summary or objective
- Tailor your resume to include information relevant to the advertised role
- List your work experience & achievements
- Mention your top skills, certifications and projects

### How to pick the right resume template?
There are three types of resume template and your choice should depend on the type of job you are applying for and your level of experience.

The 3 resume templates are:

1. **Reverse chronological resume template** - This is the most common resume and is ideal if you have work experience relevant to the position you’re applying for.

1. **Skills-based resume template** – If you are short on relevant work experience because you’re a recent graduate, or are looking to make a career change then this is the template type for you.

1. **Combination resume format** – The combination resume is a great choice for job-seekers with a very diverse skill-set who are applying for roles that require a broad range of expertise. Inadvertently, many job seekers add to their resume over time and end up with a combination template but this is likely something to try to avoid. Unless deliberate.

So, which one do you go for?

In almost all cases, unless you’re short on relevant experience, you’d want to stick to the **reverse-chronological resume template**.

### What do you include?
Most commonly, resumes include:
- Contact information
- Professional resume summary or objective
- Work experience (and achievements)
- Education
- Skills, certifications and projects

### What goes into my resume summary/objective?
Your resume summary or objective is your first impression.

A HR manager spends very little time scanning each resume they receive for a job opening. Yep, your carefully-worded, hand-crafted resume will be among 20 to 50 others that only get a cursory glance. Unless, of course, you manage to ‘wow’ them early.

Your resume summary/objective is how you accomplish this. Both are placed at the top of your resume. They are the first thing a HR manager sees after your name.

#### Resume summary

This is a 2 to 3 sentence summary of your career. The resume summary is used in literally every situation except where you’re a recent graduate or switching careers.

In your resume summary you should include:

1. **Your relevant role(s) and years of experience**: *Senior security analyst with demonstrated success maintaining information security systems for over 5 years*.

1. **1 or 2 achievements (or outcomes)**: *Over three years I contributed to a team that reduced the mean time to recovery by 80% for incidents*.

1. **What you’re looking to achieve**: *Seeking further opportunities to drive operational excellence and overcome unique and evolving challenges*.

![](arn:aws:s3:::upwardspiral-blog-image-storage-d1wlpel6ks5k8p141722-production/Education.png)

#### Resume objective

As I mentioned before, a resume objective is the go-to for anyone that either has no work experience or is going through a career change. Much like a resume summary, a resume objective should be around 2 to 3 sentences and includes information on:

- **Your field of study**: *Recent graduate with a Bachelor of Computer Science from the Australian National University*.
 
- **Skills and experience relevant to the job**: *Two years of experience maintaining my own virtual network of 15+ machines, practising both my red and blue team techniques*.

- **Why you’re applying for the role**: *I am seeking opportunities to grow as an information security professional and apply these skills with real-world infrastructure*.

Or if you’re going through a career change:

- **Relevant work experience**: *System administrator with 5+ years managing enterprise networks*.

- **Skills and experience relevant to the job**: *Developing an intimate knowledge of network configuration and hardening techniques*.

- **Why you’re applying for the role**: *I am seeking opportunities to apply my understanding of enterprise networks as a penetration tester to ensure network security through consulting roles*.

![](https://drive.google.com/file/d/1fxyVPe0ceP6IZ72EOOpfTYgrrNkX8ZlC/view?usp=sharing)

### Work experience
The standard format for your work experience is as follows:

- **Job Title/Position** - Your job title goes first. This ensures a hiring manager can see, at a glance, you have relevant work experience.

- **Company Name / Location / Description** - Then, the name of the employer, as well as the location of the office.

- **Responsibilities & Achievements** - This is the core of each work experience entry. Rather than a list of responsibilities, summarise your day-to-day life as if you were explaining it to a friend in 30 words or less. List key achievements below and tie them to metrics.

- **Dates Employed** - The timeframe of your employment in each company. The standard format expected by recruiters and employers is month/year.

One of the most common resume mistakes is listing responsibilities. For example:

----------
“Security Analysis - Internship

- Vulnerability scanning & assessment of web application.
- Technical reconnaissance.
- Amazon Web Service (AWS) security audits using prowler.
- Vulnerability report writing for clients outlining the potential issues to their infrastructure. 
- Forensic report on threat actor gain access to system or database.
- etc...”
----------

It’s more than likely everyone applying for the role has a similar background. And 90% of those resumes will likely have the same list. It does nothing to distinguish you but consumes valuable real estate.

So, to stand out, you want to focus on mentioning achievements in your resume instead. Or in simple terms, how exactly you helped the company grow, reach quarterly goals, etc.

Here’s an example:

![](https://drive.google.com/file/d/18eEGcI42lmNlq1V_nkN29ERJA298XE2c/view?usp=sharing)

Keep in mind, though, that in some fields, there aren’t that many achievements you can mention. In such fields, it’s pretty hard to distinguish yourself, so it’s totally OK to stick to responsibilities instead.

### Tailor your resume
Applicant Tracking Systems (ATS) are the thing you’ve never heard of that filter ~70% of resumes before they’re ever read.

An ATS is software that helps a company filter through the hundreds of resumes they receive.

To get past this, it’s important to tailor each of your resumes for the job you’re applying for. To do this, you need to cite the key words from the job ad in your resume.

(I’ll add a link here shortly to provide better detail.)

Otherwise, this simple example should give you enough information to successfully navigate an ATS.

![](https://drive.google.com/file/d/1F0cLwfjFUaL3TCYy1ycWjF2mJSR5LRRI/view?usp=sharing)

Looking at the role, the critical requirements for the job are:

- 5+ years of experience in space travel

- Experience managing a monthly budget in excess of $20,000

- Comfortable in situations of imminent death

Now, you need to tailor your resume to these requirements, which is as simple as mentioning them in your resume.

### Education
Education is easy:

- Program Name: “Bachelor of Computer Science”

- University Name: “Australian National University”

- Years Attended: “02/2013 - 10/2016”

- (Optional) Honors: Cum Laude, Magna Cum Laude, Summa Cum Laude.

- (Optional) Academic achievements: Any interesting papers you’ve written, Golden key, etc.

![](https://drive.google.com/file/d/1BeDiEJrIN_YcmiRgBIx7i0OUBq4l6pQ9/view?usp=sharing)

### Skills, Certifications & Projects

Another must-have inclusion in your resume are “Skills” and “Certifications” sections. Here, you want to mention all your know-how that makes you the perfect candidate for the job.

#### Skills

Tailor your skills to the job. No matter how cool your skill is, if it isn’t relevant for the job, don’t include it. There are 2 types of skills you can include when writing your resume:

- **Hard Skills (Measurable abilities)**: This can be anything from coding in Python to being able to do a backflip.

- **Soft Skills (Personal skills)**: This can be broad, but we recommend  communication, personal traits (persistent, curious, etc), and leadership. Where they’re applicable to you.

Hard skills are necessary. Soft skills should be considered optional. We prefer to demonstrate soft skills in our resume objective/summary.

#### Certifications

Have you acquired any industry relevant certificates from industry experts?

Let’s say, for example, you’re applying to become an AWS Cloud Engineer. It would be worth - acquiring and - listing specialist AWS certificates. But only if it is relevant to the position you’re applying for.

#### Projects

Projects - ideally somewhere on Github - are one of your greatest assets. Not only do they show off your passion but they provide tangible evidence that you can execute against the skills you have listed.

If you are pursuing a role, or attempting to advance in your career, in information security or software development then being able to demonstrate capability in this way is essential for landing a dream role.

If you’re looking for a role in information technology or information security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/).

How to make a resume

# Hire without bias
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.
## 10 Steps To Reduce Unconscious Bias In Hiring Processes
Unconscious bias isn’t something a business can address overnight by passing a mandate. Even after rectifying the issues that need to be taken to improve the hiring process and income more diverse talent, recruiter bias may detail efforts and prevent the company from finding the best and brightest talent.

Below,  we explore 10 methods a company can implement to identify and reduce the impact of the biases that people within your organisation may hold. Improving your hiring practices and the many documented benefits of a more diverse workforce.

**1. Define Diversity And Set Goals**

Set business goals so that everyone knows that removing unconscious bias and building diversity is a priority. With that, define what diversity means to the company. What ethnicities, ages, genders and sexual preference groups are underrepresented and need to be addressed. Next, set metrics to achieve at each step in your candidate pipeline: applicant funnels, interview conversion rates and acceptances. Finally, communicate successes.

**2. Admit That Implicit Bias Exists**

Admit that there is bias. You have to name it to tame it. We need to not only look at qualifications, but also at what diversity is and how an outsider’s perspective can be an advantage. Instead of pretending to not notice differences, ask, “What will someone who is diverse, and in what way, add to our organization?”

**3. Create A Foundation Of Trust**

Creating a foundation of trust, commitment, accountability and collaboration is critical in supporting a company’s diversity, equity and inclusion strategy. Offering productive conflict development programs for learning how to better communicate creates unity that is essential.

**4. Make Hiring A Collective Effort**

Bias could exist in the design of the hiring process itself. Most processes are designed from one perspective (e.g., level, function, identity). In designing the process, make sure that it is a collective effort, with input from differing perspectives and identities. Or investigate a [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform).

**5. Have A Cross-Functional Interview Team**

Having a cross-functional interview team is a great way to reduce bias in the hiring process. Another good practice is to have a session with the interview team to brainstorm what to look for and what to watch out for.

**6. Appreciate Diversity In Management**

Hire more diverse managers and show appreciation for them. By definition, those with unconscious biases don’t realize they have them. So the best approach is to focus on creating an environment with true diversity.

**7. Use A Structured Interview**

Develop the interview while developing the job description, creating questions to discern candidates’ knowledge, skills and abilities relative to the job. Be disciplined about asking all applicants the same questions, which allows hiring decision makers to base decisions on informed comparisons about applicants’ capabilities rather than their first impressions.

**8. Check Yourself With Project Implicit**

[Project Implicit](https://implicit.harvard.edu/implicit/) is an excellent resource from Harvard. Noticing the impact biases have on decisions is illuminating. We recommend semi-regular checks with Project Implicit several times a year to stay consciously aware.

**9. Analyze Each Step Of The Hiring Process**

Unconscious biases don’t just happen at the interview stage. Your hiring process is a series of steps, not a single act. Analyze each step and gather data. That will allow you to determine where the problem lies (e.g., advertising for candidates, a small talent pool, the application process, interviews).

**10. Focus On The Job’s Behavioral Needs**

Focus on the behavioral needs of the job role instead of skills and experience. Skills and experience are poor predictors of candidate success; in fact, skills are the easiest to train for. Instead, organizations should focus on assessing people against a behavioral target, followed by a structured behavioral interview designed to uncover alignment with culture and values.

If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.


Hire without bias

### Earn rewards by referring Upward Spiral
Recommend [Upward Spiral](upwardspiral.io) to your network, and we’ll reward you for the new users.

<h1> How it works </h1>

|(1) Refer | (2) Find work | (3) Earn |
|------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------|
| Refer the platform to friends in your network. | Job seekers find work through the Upward Spiral platform. | Get a cash reward for the eligible users you refer. |

Upward Spiral is a job seeker platform. Our mission is to help 1-million cyber professionals find a role that resonates with them. Earn for every new Upward Spiral referral who gets a new job or hires! Australian rates:
- Every successful job-seeker referral: AUD $500.00
- Every recruit hired by an employer referral: 10% of every placement commission up to AUD $20,000 per year per business referred

For example:
- *Payouts per new job seeker referral*: if you refer 10 new job seekers and 8 of them find their next job, you get paid for all 8 users: AUD $500 x 8 = $4,000.
- *Payouts per new employer referral*: if you refer 1 new employer account and they recruit 10 users through the platform, you get paid for all 10 recruits. If the recruits are all paid AUD $100,000 you will receive 10% of our commission fee (10%): 10 x ($10,000 x .1) = $10,000. Earn up to $20,000 per business referred per year.

### Frequently asked questions
##### Why should I join the [Upward Spiral](https://upwardspiral.io/) referral program?
The referral program is designed to accelerate Upward Spiral’s mission of helping 1-million cyber professionals find a role that resonates with them.

Joining the referral program allows you to help address the cyber skills shortage while receiving generous rewards for your efforts.

###### How much will I earn for each referral eligible for payout?
You’ll receive a cash payout for every new eligible user that you refer to Upward Spiral.

You will be rewarded based on the number of referrals and the number of recruits per employer. For example, if you refer one employer account that recruits ten employees you will be rewarded for all ten recruits for a portion of their annual salary.

###### How does it work?
One of our advisors on-boards every job seeker or employer to the platform. During the on-boarding we ask how they heard about us.

If they share your name we’ll reward you.

If they don’t and you can prove you referred them - email or other - we’ll reward you.

Earn rewards by referring Upward Spiral

## Top cyber security stories of 13/12/21 to 20/12/21
Below are the top stories in the space of cyber security.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[The best log4j memes](https://log4jmemes.com/)** *Reported by Log4jmemes.com
 

2. #### **[No one writes useful software unless they're paid - Eulogy for open source](https://christine.website/blog/open-source-broken-2021-12-11)** *Reported by Christine*
 

3. #### **[uBlacklist: Blocks specific sites from appearing on Google search results](https://github.com/iorate/uBlacklist)** *Reported on Github*
 

4. #### **[Marketing is scary for a solo developer: A developer's story](https://raumet.com/marketing)** *Reported by Raumet.com*
 

5. #### **['Significant amounts of water' found in Mars' massive grand canyon](https://edition.cnn.com/2021/12/16/world/exomars-water-mars-grand-canyon-scn/index.html)** *Reported by CNN.com*
 

6. #### **[Lithuania evacuates its embassy in China](https://www.economist.com/china/lithuania-evacuates-its-embassy-in-china/21806843)** *Reported by the Economist*
 

7. #### **[Former Netflix executive sentenced to 30 months for bribing vendors](https://www.justice.gov/usao-ndca/pr/former-netflix-executive-sentenced-30-months-bribes-and-kickbacks-netflix-vendors)** *Reported by the Department of Justice*
 

8. #### **[Toyota owners have to pay $8/month to keep using their key fob](https://arstechnica.com/cars/2021/12/toyota-owners-have-to-pay-8-mo-to-keep-using-their-key-fob-for-remote-start/)** *Reported by arstechnica*
 

9. #### **[Why do I have to tolerate these cookie pop-ups?](https://news.ycombinator.com/item?id=29529062)** *Reported by ycombinator*
 

This round-up was generated for on 20 December, 9:05am and contains the top 9 stories between 13 December 9:11am and 20 December, 9:00am

Hacker News Round-up (20/12/21)

### Companies: Background checks
Upward Spiral does not perform pre employment background checks on candidates. Nor does Upward Spiral undertake reference, criminal record, education, credit or otherwise checks.
Employers are responsible for performing due diligence on all candidates.


Companies: Does Upward Spiral do background checks?


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### Cyber Security Analyst Jobs
From 2013 to 2021, the [number of unfilled cybersecurity](https://cybersecurityventures.com/jobs/#:~:text=Over%20the%20eight%2Dyear%20period,to%203.5%20million%20in%202021) positions grew by a whopping 350%. It would be crazy to expect the demand for cyber security analysts to fall any time soon.  
A cybersecurity analyst protects an organisation from cyber threats and actively develops processes, protocols and systems to respond to and quell attacks. Cybersecurity analysts protect an organisation’s infrastructure, such as computer networks and hardware devices, from cybercriminals and hackers seeking to cause damage or steal sensitive information.
#### What is a cyber security analyst?
Cyber security analysts can work across the spectrum of computer and information networks. A security analyst is a trained cyber professional who specialises in network and IT infrastructure security. From corporate databases to banking networks and from office networks to military intelligence, cyber security analysts can be found anywhere that large amounts of 
In an organisation a cyber security analyst thoroughly understands cyberattacks, malware, and the behavior of cybercriminals, and actively seeks to anticipate and prevent these attacks. A well-trained security analyst will probably have an advanced understanding of both hardware and software, and how data is stored and managed. The analyst usually possesses at least a bachelor's degree in cybersecurity or a related field.

The top three cyber security threats facing information technology networks of all scales are ransomware attacks, social engineering attacks, and the theft or compromise of sensitive information. Typically, threats inside the organisation - often accidentally - are the greatest risk an organisation will face. This means that cybersecurity analysts need to be familiar with a wide variety of threats both internally and externally when it comes to security issues.
#### What does a cyber security analyst do?
A cyber security analyst often wears a lot of hats in an organization or company. They are likely involved in security, system design, system policy, trainer, and educator.
 
A cyber security analyst protects an organisation’s hardware, software, and networks from cyber criminals and other threats. The analyst's primary role is to understand the organisation's IT infrastructure in detail, monitor it at all times, and evaluate threats that could potentially breach the network. The cyber security analyst continuously looks for ways to enhance company network security and protect its sensitive information.
 
Cyber security analysts are often thought of as first responders, as they often triage security incidents. In practice, cyber security analysts spend their time developing policies, procedures and reviewing best practices to implement within an organisation. Then, training an organisation on the change.
 
In the ideal world for an organisation with strong security posture, a cyber security analyst has the opportunity to be proactive. Taking steps to prevent security breaches. They have the opportunity to constantly update processes, policies, systems and software, they can penetration test the organisation and try to find loopholes in computer code or operating systems to guarantee security.
 
Broadly, the cyber Security analyst is responsible for:
* **Configuring Tools:** This may come in the form of virus software, password protectors, and vulnerability management software. They will evaluate what the company needs and use these tools to protect its information.
* **Reporting:** The analyst will detail what is currently going on in the network and evaluate its strengths. One of the skills needed is learning to read these reports. They will show what is well-protected and indicate if there is any unusual activity in the network.
* **Evaluate Weaknesses:** No network is fully secure, but the goal is to make it as secure as possible at every opportunity. Part of the job is to continuously test all company networks and find weaknesses before bad actors or external threats can compromise them.
#### What education does a Cyber Security Analyst need?
Cyber security analysts are more entry-level roles in the cyber security field. In order to be qualified it is recommended to have formal education in cyber security or more broadly information technology. This type of education program will help you learn IT fundamentals as well as critical cybersecurity foundations that will prepare you for the requirements of the job. Scripting and programming, data management, penetration testing, hacking and countermeasures, and more will all be critical elements of your cyber security education.

**What skills does a Cyber Security Analyst need?** 
The skills and expertise a cyber security analyst needs will vary from job to job. Some security analyst openings seek very specific skills due to the nature of a particular network or the organisation’s employees.

For early - or soon-to-be - career professionals, the key to understanding the most marketable skills to acquire is to study different job descriptions. Investigate the key words, problems, languages they refer to. Researching this information will reveal how skills and experience will map to opportunities and it will change over time. It will also inform the type of training, education or verification you might want to pursue.

Despite the wide variability of cyber security analyst jobs, there are a number of characteristics or skills that are consistent for cyber security analysts across the spectrum. Both hard- and soft-skills. These include:

* **Programming experience:** Cyber security analysts are charged with defending digital infrastructure. Consequently, cyber security professionals are expected to have some base level of programming experience and familiarity with foundational programming languages such as C, C++, PHP, Perl, and Java. 
* **Communication:** Beyond understanding, is the expectation that you can communicate your understanding in laymen’s terms to others. You will have to communicate with others a lot in this job and work with a team that is responsible for security. 
* **IT Knowledge:** This job requires you to stay up-to-date on trends in the technology world. You need to be aware of the best practices, techniques, and any laws that change. 
* **Analytical:** Security analysts work with data from a variety of sources and so they need to be able to take information from many inputs to make decisions. 
* **Detail-oriented:** Much of the work of cybersecurity analysts comes down to examining small details — like lines of computer code or network commands — that could have major impacts. 
* **Forward-thinking:** Security analysts need to anticipate the future based on current data and trends and then make security recommendations accordingly. 
* **Creativity:** You may not think a cyber security expert needs to be creative, but this is a must! You need to think of creative ways that bad guys can breach your organisation's system, then think of creative solutions to prevent them. 
* **Strong Attention to Detail:** This is not something that should be overlooked. You need to be detail-oriented for this job, paying strong attention to the smallest adjustments and changes in your organisation's network. 
#### How to become a Cyber Security Analyst?
**Four steps to becoming a cyber security analyst:** 
* **Research:** The number of opportunities and and new roles within as a cyber security analyst continues to evolve, creating plenty of career opportunitities for cyber security professionals. The first step in becoming a cyber security analyst is to understand the kind of work you want to do and map out the relevant education and certifications you will need. Even entry-level cyber security analyst positions might require specialised training, so it’s best to plan in advance.
* **Education:** Most cyber security analysts have a bachelor’s degree in cyber security (or field such as mathematics, computer science, or information technology). However, this is not absolute. Cyber security certifications (see the next point) and associate’s degrees and/or relevant training or background (like military service, for example) can be sufficiant to obtain entry-level cyber security jobs in the private sector.
* **Certification:** It is very common for entry-level and mid-level opportunities to require differing levels of certification to demonstrate proficiency in the relevant skill.
* **Network:** An important part of becoming a cyber security analyst is developing a professional network. A network that is broad by aligned with the cyber security profession will help you stay informed about the latest trends, opportunities and changes in the sector.
#### Do Cyber Security Analysts need certifications?
**Yes.** 
To do the job, like any job, you need to be capable at the role. That doesn’t require a certification or degree but certifications and degrees make it much easier for recruiters to identify the candidates that are likely to be capable in the role. It’s really that simple when it comes to qualifications. In most fields.

Some of the industry-standard certifications you may want as a cyber security analyst are: 
* Certified Cloud Security Professional (CCSP)
* Systems Security Certified Practitioner (SSCP)
* A+ (CompTIA)
* Cybersecurity Analyst Certification, CySA+ (CompTIA)
* Network+ (CompTIA)
* Network Vulnerability Assessment Professional (CompTIA)
* Network Security Professional (CompTIA)
* Security Analytics Professional (CompTIA)
* Security+ (CompTIA)
* Project+ (CompTIA)
* PenTest+ (CompTIA)
* IT Operations Specialist (CompTIA)
* Secure Infrastructure Specialist (CompTIA)
* ITIL1 Foundation

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).


Cyber Security Analyst Jobs

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

### Malware Analyst Jobs
From 2013 to 2021, the [number of unfilled cybersecurity](https://cybersecurityventures.com/jobs/#:~:text=Over%20the%20eight%2Dyear%20period,to%203.5%20million%20in%202021) positions grew by a whopping 350%. It would be crazy to expect the demand for cyber security analysts to fall any time soon.

An important and rapidly growing role within the cyber security ecosystem is the malware analyst. This role is part security engineer, part programmer, and part digital forensics and is a crucial function in providing necessary intelligence after a cyber security incident. Once the initial incident has been addressed it is critical that a thorough analysis and examination of the incident takes place. This will typically involve a close look at the methods, techniques, tactics and tools used by the adversary.

By understanding the incident new defenses can be developed, or existing ones can be refined as needed. The ability to reverse engineer malicious code is paramount in all defensive strategies and this is where the malware analyst brings value to the cyber security team.
 
The cross between a highly-skilled programmer and a cyber detective makes this an attractive option for many highly skilled and curious tech types. This is a competitive and highly sought after role.
#### What is a malware analyst?
A malware analyst is the [Hercule Poirot](https://en.wikipedia.org/wiki/Hercule_Poirot) of an organisation’s cyber security team. The role is unique within an organisation’s security, defensive techniques and security principles.

A malware analyst is a cyber-sleuth, with capable programming skills. They leverage their programming capabilities to identify how an attack occurred, why it was or wasn’t successful, and most importantly how it can be defended.

A malware analyst possesses the knowledge and skill needed to understand the exploit and identify the vulnerability. This role is unique within a security enterprise because it requires an understanding of offensive as well as defensive techniques and security principles.
#### What does a malware analyst do?
A malware analyst identifies, examines, and understands the various forms of malware and their delivery methods. This includes all diverse forms of bots, buts, rootkits, adware, spyware, ransomware, trojan horses, viruses and worms.

The malware analyst comes into the picture after an organisation’s incident response team has identified and contained an attack. Their purpose is to disassemble, deconstruct, and reverse engineer the malicious code to allow the organisation to better protect against future attacks of similar capability and origin.

It is largely a function of solving puzzles and connecting seemingly unrelated dots.
While sometimes called in during the early stages of an attack to bring clarity to the type of attack and shed light on the methods being used by attackers a malware analyst isn’t typically considered a component of the incident response team or even the first line team. Commonly the malware analyst becomes more involved in mitigation and recovery efforts once the attack vector has been identified and the payload contained.

Regular activities include examining suspect code to determine if there is an element of a malware attack. This is particularly common when working with advanced persistent threats (APT), where code may be placed in small amounts over a longer period of time before being detonated. This makes the task of detecting and identifying malicious code more difficult, it also provides the malware analyst with enough time to examine and protect against an attack before harm is done.

Strength in analysing and reverse engineering code enables the malware analyst to be effective in protecting the network by predicting the objective of the code to establish a signature.

Broadly, the malware analyst is responsible for:
* **Reverse Engineering:** Reverse engineering (also known as backwards engineering or back engineering) is a process or method through the application of which one attempts to understand through deductive reasoning how a device, process, system, or piece of software accomplishes a task with very little (if any) insight into exactly how it does what it does.
* **Advise Incident Responders:** Providing advice and guidance services to incident respondets when making their choices to ensure they are appropriately informed about threat actors.
* **Examining Suspect Code:** The collection of information in a way that maintains its integrity allowing for the investigation and analysis of the data or system to determine if it was changed, how it was changed, who made the changes and what their intent may be.

**What skills does a malware analyst need?**
The ability to analyze and reverse engineer suspicious code enables the malware analyst to protect digital assets. An ideal candidate will have one or more of the following skills:
* IDA Pro, WinDbg, OllyDbg, Immunity Debugger
* Strong knowledge of C/C++, Windows API, and Windows OS internals
* Reconstruct unknown file formats & data structures
* Reconstruct unknown TCP/IP protocols
* Understand unpacking, deobfuscation, and anti-debugging techniques
* Python, Perl, Ruby scripting
* Ability to write technical reports

Common job responsibilities will include:
* Record malware threats and identify systems to avoid them
* Examine programs and software using analysis programs to identify threats
* Classify malware based on threats and characteristics
* Stay up to date on the latest malware and keep software updated to defend against them
* Write alerts to keep the security team informed
* Help create documentation for security policies
* Understand tools that identify zero-day cyber threats

While most malware is written in middle-level languages such as C or C++, the code will need to be disassembled to be readable. This requires that a malware analyst be able to read, understand, and program in the much more arduous low-level assembly language.

The ability to work with various high-level programming languages is important. The use of specialized and sophisticated digital tools will be required. Both hard- and soft-skills. These include:
* **Programming experience:** Malware analysts are charged with identifying actors through the exploration of code. Consequently, malware analysts are expected to have a strong understanding of commonly encountered languages. The middle-level languages (C or C++) encompass most malware. However, analysts need to be able to read, understand and program in the much more arduous low-level assembly languages. 
* **Communication:** Beyond understanding, is the expectation that you can communicate your understanding in laymen’s terms to others. You will have to communicate in high pressure situations in this job.
* **Detail-oriented:** Much of the work of malware analysts comes down to examining small details.
* **Forward-thinking:** Malware analysts need to be aware of up-to-date trends.
* **Digital tools:** The ability to use specialised and sophisticated digital tools is necessary.
#### How to become a Malware Analyst?
**Five steps to becoming a malware analyst:**
* **Education:** Having a bachelor’s degree in computer science or cyber security will greatly assist your career and prospect of acquiring a role. Success as a malware analyst is determined by an operator’s ability to stay ahead of skilled threat actors and a solid foundational education will greatly improve your success at accomplishing this. However, a degree is not essential.
* **Career path:** A common career path for this cyber security specialty is to spend several years as a programmer or developer. These skills arm the applicant with a necessary foundation for understanding how malicious software is created.
* **Professional certifications:** While there is no industry-wide prescribed professional certification required for a career as a malware analyst, one certification stands out. The Certified Information Systems Security Professional (CISSP) demonstrates that an applicant has a sound understanding of security architecture, engineering, and management.
* **Experience:** The knowledge and skill threshold for becoming a malware analyst is cross-functional and best suited for an experience cyber security professional or computer scientist. It is assumed entering the field you have a university level qualification in one of those fields and you will still require relevant work experience in both areas to be successful in the role.
* **Continued learning:** A critical qualifying step toward becoming a malware analyst is to demonstrate a drive and ability to stay abreast of cutting-edge attack techniques and methods. The ability to identify, contain, disassemble, and mitigate zero-day malware is the pinnacle of desirable skills.
 Largely, cyberattacks are successful because they contain some unexpected or unforeseen element in the cyber kill chain. The job of a malware analyst includes being able to look at past events and accurately predict what the next attack may look like.
#### How much do malware analysts make?
It takes special programming and language skills to become a malware analyst. It also requires a strong understanding of various complex tools. It is considered by most to be a role for experienced operators, rather than an entry-level role and it commends a commensurate level of compensation.

The average malware analyst salary is US$165,000 per year. Entry-level positions start at US$78,000 per year while experienced workers can make up to US$234,000 per year.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

Malware analyst jobs

### For job seekers
Upward Spiral helps information security candidates find amazing jobs. Our team has taken inspiration from Philip Joubert and reshaped the recruitment model. Instead of candidates having to apply for job after job, companies reach out to candidates they feel would be the ideal fit in their team with interview requests that include upfront salary and role information. At Upward Spiral we believe it should be easy for you to find a job. Upward Spiral creates a simple process that lets the candidate be in control of the recruiting process. You can compare salary information, work environment, learning & training opportunities at different companies and make the best choice for your personal goals.
#### How to get involved? 
It’s as simple as signing up to [Upward Spiral](https://upwardspiral.io/login). Upward Spiral isn’t for networking and by default we will hide your profile from companies until you (and us) are ready. Our team will review your profile after you sign up and get back to you within 48 hours. If you’re accepted, we’ll provide you with a talent advisor who will help you complete your profile and make any finishing touches before making the profile visible to companies. Once your profile is live, companies will be able to see your profile for 45 days. If a company is interested in you they will send you an interview request, which includes salary and role info. It’s entirely up to you if you choose to accept or decline the request. If you find a job through Upward Spiral, we’ll send you an epic pile of swag to say thanks for using the platform.
#### What to expect
“The best, easiest and most convenient way to find the perfect job!” That’s the bar we set at Upward Spiral. Our aim is to be a breath of fresh air in the information security space. Providing unparalleled advice, a superb process for finding a great job, and awesome swag at the end. Our goal is to make sure we place people in jobs they will love.

What does Upward Spiral do exactly?

### Companies: How do Upward spiral vet candidates?
Upward Spiral are a team of information security and technology professionals who have experience doing information security and technical hiring ourselves.

Our team considers a wide variety of criteria that includes formal education, work experience, side projects and independent learning. If a candidate has code or materials available - Github, BitBucket, etc - we'll review those.

Dozens of people apply to Upward Spiral on a weekly basis.

If we are still unsure, we require a candidate to complete a skill assessment or other relevant screening test, and then we review them based on their results and their profile together.


Companies: How do Upward spiral vet candidates?


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

### Top 10 highest paying jobs in cyber / information security
Looking for a job in cyber security? There are plenty available. [Cybersecurity ventures](https://cybersecurityventures.com/jobs/#:~:text=Over%20the%20eight%2Dyear%20period,to%203.5%20million%20in%202021)  estimates there will be approximately 3.5 million vacancies in the industry by the end of 2021. It makes sense, the global spend on the information security sector is expected to exceed [US$150 billion](https://www.gartner.com/en/newsroom/press-releases/2021-05-17-gartner-forecasts-worldwide-security-and-risk-managem) in 2021. It seems logical that organisations will be recruiting help to manage these new solutions and finding that many people isn’t easy...
  
The problem many job seekers face is that information security is a growing and evolving industry. It isn’t easy for aspiring - and often experienced - information security professionals to know how to navigate a career path. It becomes even more complicated when we start talking about which certifications are most relevant.

To help everyone out, here are the top 10 highest paying information security jobs based on overall median pay grade.
### #10: Digital Forensics Analyst
A digital forensics analyst gathers evidence off computers, networks, and other data storage devices for investigating instances of digital crime.

As a digital forensics analyst, you'll use a range of specialised software and other techniques to secure, retrieve and analyse data linked to a range of criminal activities. These illegal activities can include:

- hacking
- network intrusions
- online scams and fraud
- political, industrial and commercial espionage
- terrorist communications
- the use of illegal images
- theft of confidential information.

You could be working for the police or other law enforcement agencies, for a specialist computer forensic company or investigative team, or large companies such as banks.

Digital forensics analysts make a median salary of $102,200. They can expect to earn at least - a very nice - $69.5K, according to [PayScale](https://www.payscale.com/research/US/Job=Forensic_Computer_Analyst/Salary).

### #9: Information Security Specialist
An [information security specialist](https://blog.upwardspiral.io/blogs/cyber-security-analyst-jobs) is an entry- to mid-level employee whose job functions help to strengthen the security of an organisation.

Information security specialists often wear a lot of hats in an organisation or company. They are likely involved in security, system design, system policy, trainer, and educator.

An information security specialist protects an organisation’s hardware, software, and networks from cyber criminals and other threats. The analyst's primary role is to understand the organisation's IT infrastructure in detail, monitor it at all times, and evaluate threats that could potentially breach the network. The information security specialist continuously looks for ways to enhance company network security and protect its sensitive information.

Information Security Specialists earn a median salary of $106,000. According to [PayScale](https://www.payscale.com/research/US/Job=Information_Security_Specialist/Salary), they can expect to earn at least - a very nice - $69.5K but can take home as much as $164,900.

### #8: IT Security Consultant
An IT Security Consultant is an outside expert who helps an organization implement the best solutions according to their security needs. To be completely realistic, the duties performed are in-line with an information security specialist but include an added element of consultancy.

In broad strokes, consultancy is about understanding a problem statement quickly, having necessary background experience to propose a solution and the capability to support delivery against the proposed. All the while accepting that the proposed is unlikely to be the final product and you will be required to adapt and bring stakeholders on a journey of change to solve the original problem statement.

IT Security Consultants can then use this knowledge to implement a set of security tools they see fit depending on an organization’s requirements.

IT Security Consultants make a median salary of $115,000, according to [PayScale](https://www.payscale.com/research/US/Job=Security_Consultant%2C_IT/Salary). They can expect to bring home at least $86, and they can earn as much as $191K a year.

### #7: Penetration Tester
A Penetration Tester is responsible for probing applications, systems, and networks for vulnerabilities as a test of an organization’s digital security defenses. This role is highly sought after as it is a lot of fun.

A penetration tester, colloquially known as a pen tester or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; this is not to be confused with a vulnerability assessment. Penetration testers must be prepared to conduct physical security assessments of critical IT assets, design and create new penetration tools, employ social engineering to uncover security gaps, as well as provide feedback on their assessments.

Penetration Testers make a median salary of $119,500. Overall, they can expect to earn between $80K and $190K, reveals [PayScale](https://www.payscale.com/research/US/Job=Penetration_Tester/Salary).

### #6: Malware Analyst
A [malware analyst](https://blog.upwardspiral.io/blogs/malware-analyst-jobs) is responsible for helping an organisation understand the ransomware, worms, bots, Trojans, and other malicious software that threaten its network on a daily basis.

This role is part security engineer, part programmer, and part digital forensics and is a crucial function in providing necessary intelligence after a cyber security incident. Once the initial incident has been addressed it is critical that a thorough analysis and examination of the incident takes place. This will typically involve a close look at the methods, techniques, tactics and tools used by the adversary.

The cross between a highly-skilled programmer and a cyber detective makes this an attractive option for many highly skilled and curious tech types. This is a competitive and highly sought after role.

Malware Analysts make a median salary of $127,000, says [PayScale](https://www.payscale.com/research/US/Job=Malware_Analyst/Salary). They can expect to earn at least $90K, but some can take home as much as $161K a year.

### #5: Security Engineer
A security engineer is a mid-level employee who builds and maintains an organisation’s IT security solutions. In this capacity, security engineers configure firewalls, test new security solutions, and investigate intrusion incidents.

If you aspire to become a security engineer you must possess a strong technical background in vulnerability and penetration testing, virtualisation security, application and encryption technologies, and network and web-related protocols. Security engineering is the process of incorporating security controls into an information system so that the controls become an integral part of the system’s operational capabilities.

The more tools and concepts with which a security engineer is familiar, the more they can help troubleshoot problems concerning an organization’s security systems.

Security Engineers make a median salary of $129,500, according to [PayScale](https://www.payscale.com/research/US/Job=Security_Engineer/Salary). They can expect to make at least $87K, though some Security Engineers can earn as much as $189K a year.

### #4: IT Security Manager
An IT security manager is a mid-level employee who manages an organisation’s IT security policy. IT security managers are leaders, so to be successful, they must have strong interpersonal and communication skills.

Security managers’ daily duties depend on where they work, their industry, and the size of their company. Those at large investment banks, for example, may oversee teams of [information security specialists](https://blog.upwardspiral.io/blogs/cyber-security-analyst-jobs) and other technology personnel. Security managers working for small businesses may manage just a few people. In big companies, these professionals often focus on managerial responsibilities, while managers in smaller companies may take on more hands-on roles.

When it comes to education, employers generally require information security workers to hold a bachelor’s degree. They usually prefer applicants with degrees in information security-related disciplines, such as information technology, information assurance, or cybersecurity. Many universities offer information security as a concentration within a computer science bachelor’s program.

Individuals who are interested in becoming an IT security manager must be prepared to create and execute security strategies based on the input from the Security Director and/or the CISO. They must also test and implement new security tools, lead security awareness campaigns, and administer both department budgets and staff schedules.

IT security managers make on average a salary of $156,000. They can expect to earn at least $101K, according to [PayScale](https://www.payscale.com/research/US/Job=Security_Manager%2C_IT/Salary), but those in larger organisations can make as much as $203K.

### #3: IT Security Architect
An IT security architect is a senior-level employee who is responsible for building and maintaining the computer and network security infrastructure for an organization. Security architects provide guidance to information technology (IT) security team members. They also lead IT analysts, security administrators, and security engineers to coordinate effective security protocols. Security architects also respond to security breaches.

This position requires that individuals develop a comprehensive picture of an organisation’s technology and information needs, which they can then use to develop and test security structures.

IT security architects are expected to be knowledgeable in ISO 27001/27002, ITIL, and COBIT frameworks; risk assessment procedures; operating systems; and perimeter security controls, among other best practices.

IT security architects make a median salary of $171,400. According to [PayScale](https://www.payscale.com/research/US/Job=Security_Architect%2C_IT/Salary), those on the lower end of the spectrum make around $116K, whereas the highest-paid IT security architects earn approximately $231K.

### #2: Security Director
An information security director is someone who is responsible for implementing, designing, managing and allocating all the technology security measures within an organisation. A security director is a senior-level employee whose task is to oversee the implementation of all IT security measures throughout an organisation. 

Security directors must possess backgrounds like those of CISOs with respect to their knowledge of IT strategy, enterprise architecture, and other security-related concepts. They report directly to a CISO or CTO and assume the position of this executive role in smaller organisations.

Security directors’ median salary is $207,500. [PayScale](https://www.payscale.com/research/US/Job=Security_Director%2C_Computing_%2F_Networking_%2F_Information_Technology/Salary) reports the salary range for Security directors between $116K and $249K.

### #1: Chief Information Security Officer (CISO)
The CISO is a C-level management executive (sometimes slightly beneath the typical C-suite and resides under the CTO) whose primary task is to oversee the general operations of an organisation’s IT security department and other related staff. They are responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal and external threats.

The organisation’s overall security is the foremost concern of the CISO. As such, persons who aspire to become a CISO must demonstrate a strong background in IT strategy and security architecture.

They must also possess people and communication skills, which they are expected to use when assembling and managing a team of IT security experts as well as when consulting with other organisational executives and/or federal agencies depending on the nature of their workplace.

CISOs make a median salary of $225,700, according to [PayScale](https://www.payscale.com/research/US/Job=Chief_Information_Security_Officer/Salary). On the lower end, CISOs should expect at least $143K, but those in larger organisations can earn as much as $311K.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly). It is likely the roles above are available to you.

Top 10 highest paying jobs in cyber / information security


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### Jobs hiring immediately
A handful of industries have seen their hiring needs dramatically rise to keep up with the demand for their services. At the front of this wave of employment is cyber security.
> Reporting shows in the United States approximately 2,227,725 jobs were cut in 2020 due to the COVID-19 pandemic. A figure 298% higher than the same period in 2019. 

If you’re looking for jobs hiring immediately you’re not alone. Finding work is difficult, but you’re not alone. Don’t lose hope. 

A number of areas have cited COVID-19 related job difficulties, while many regions have broadly increased layoffs due to the slowing economy. The transportation, warehousing, and food service industries have been crippled by the events of the past 24-months. 

U.S based [Challenger, Gray & Christmas](https://www.challengergray.com/blog/november-2020-job-cuts-report-cuts-fall-for-second-consecutive-month/) tracked 2,227,725 job cuts in 2020 alone for the United States, 298% higher than the same period in 2019. The highest annual total on record. And this has been attributed to the COVID-19 pandemic. 

Over this same period a handful of industries have seen their hiring needs increase dramatically to keep up with the demand for their services. Information security, cyber security, DevOps, DevSecOps, and SecOps are in-demand and there is a drastic shortage in candidates entering the industry.
#### Jobs hiring immediately
If you aren’t familiar with Upward Spiral, you can read more about what we do for job seekers [here](“https:www.upwardspiral.io/https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly”). 

There are a lot of roles in cyber security, many of which aren’t technical at all. Organisations are in desperate need of eager personnel, with more than [4 million unfilled positions around the world](https://thecyberwire.com/stories/0e1b915f738448e181cc72ab3fa42f37/understanding-the-cybersecurity-skills-gap-and-how-education-can-solve-it). 

But what cyber roles are you most likely to have success in? well, we’ve put some thought into the five most in-demand job titles:
* **5. Application security engineer**

**What they do:** Application security engineers can work in any number of industries to create, implement, and maintain computer applications and software. They spend almost all their time in an office environment, with most of their work involving writing code and testing software.
Some organizations put their application security engineers in teams, enabling them to collaborate on projects. 

**Necessary qualifications:** A bachelor’s degree in an IT-related subject, such as computer science or computer engineering, is common. Though a diploma, graduate certificate, or a number of industry specific credentials is often acceptable.

Knowledge of multiple programming languages, including C, C#, Java, Python, Ruby, and JavaScript, is also essential.

Most vital is experience in the aforementioned languages and the ability to demonstrate capability. If successful in this, it is possible to look past the absence of formal qualifications.

**Salary:** [According to Indeed](https://www.indeed.com/career/application-security-engineer/salaries), the average annual salary is about US$126,000.

* **4. Security engineer** 

**What they do:** Security engineers are responsible for creating and implementing solutions that ensure an organization’s products and systems are secure. They also need to be able to assess an organization’s workflows and anticipate future issues.
As such, they must be adept at incident response and have a strong understanding of computer forensics.

**Necessary qualifications:** A bachelor’s degree in engineering, computer science, or similar field is recommended. Though a diploma, graduate certificate, or a number of industry specific credentials is often acceptable.

Significant experience in IT security will typically also be necessary.

**Salary:** [According to Indeed](https://www.indeed.com/career/security-engineer/salaries), the average annual salary is about US$98,000.
* **3. Network security engineer** 

**What they do:** Network security engineers are an essential part in the deployment, configuration, and administration of network- and security-related hardware and software. This includes firewalls, routers, network monitoring tools, and VPNs (virtual private networks).
They are also tasked with performing network security risk assessments, and might be asked to help design network infrastructure. 

**Necessary qualifications:** There are many non-degree industry related qualifications that you can earn to gain a network security engineer role. In the past, this has typically required a CISSP (Certified Information Systems Security Professional) qualification but a number of vendors have emerged that are also seen as industry appropriate.

Generally, experience in two or more of the eight CBOK (Common Body of Knowledge) domains is also preferred. But not at all necessary.

**Salary:** [According to Indeed](https://www.indeed.com/career/network-security-engineer/salaries), the average annual salary is about US$112,000.

* **2. Information security analyst** 

**What they do:** Information security analysts are responsible for examining security problems and finding solutions. Their duties include researching the industry, finding security threats, and developing strategies to ensure their organization remains secure.

The job demands a wide skill set, and requires individuals to work with a broad range of people, including analysts inside and outside the organization and senior personnel.  Key to this role are personal skills, problem solving and determination.

**Necessary qualifications:** A bachelor’s degree in IT or network security makes job applications easier, as is practical experience. Though a diploma, graduate certificate, or a number of industry specific credentials is often acceptable.

Additional information security qualifications, such as those related to [ISO 27001](https://www.itgovernanceusa.com/iso27001), are helpful and easy to get. 

**Salary:** [According to Indeed](https://www.indeed.com/career/information-security-analyst/salaries), the average annual salary is about US$85,000.

* **1. IT security specialist** 

**What they do:** IT security specialists analyse an organisation’s cyber security posture and its past breaches to understand how incidents occur and what needs to be done to prevent them.
Given that IT and cybersecurity are such broad topics, organisations will usually have many IT security specialists, each one focusing on a specific area.

For example, one person might work exclusively on web applications while another works on the organisation’s networks. 

**Necessary qualifications:** A bachelor’s degree in computer science or related field is preferred, though there are a number of online certifications that will be sufficient.
As you move into a specialist area, you will need to pass relevant exams.

**Salary:** [According to Indeed](https://www.indeed.com/career/it-security-specialist/salaries), the average annual salary is about US$56,000.

#### Getting started in a career in cyber security
If you’re thinking about a career in cyber security, [learning pathways](https://www.itgovernanceusa.com/it-governance-usa-learning-paths) are the best way to work out which roles are right for you and what professional qualifications you need.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

Jobs hiring immediately

## Top cyber security stories of 22/11/21 to 29/11/21
Below are the top stories in the space of cyber security.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[All the cyber security acronyms and definitions you need to know](https://www.reddit.com/r/UpwardSpiral/comments/r211tr/all_the_cyber_security_acronyms_and_definitions/)** *Reported on Reddit*
 

2. #### **[Live heat map of all Black Friday sales globally ](https://datastories.shopify.com/)** *Provided by Shopify*
 

3. #### **[9.3M+ Androids running 'malicious' games from Huwawei](https://threatpost.com/9m-androids-malware-games-huawei-appgallery/176581/)** *Reported by threatpost*
 

4. #### **[More than 90% of Black Friday deals were the same price or cheaper in the six months before](https://www.bbc.com/news/business-59380453)** *Reported by BBC*
 

5. #### **[AWS free tier data transfer expansion](https://aws.amazon.com/blogs/aws/aws-free-tier-data-transfer-expansion-100-gb-from-regions-and-1-tb-from-amazon-cloudfront-per-month/)** *Reported by AWS*
 

6. #### **[Cyber insurers running scared: Ransomware "as profitable as cocaine"](https://www.verdict.co.uk/cyber-insurance-hike-premiums-but-cut-covers-as-ransomware-gangs-become-as-profitable-as-cocaine/)** *Reported by Verdict*
 

7. #### **[Zoom CISO Jason Lee shares cyber security predictions for 2022](https://www.freepressjournal.in/business/2022-cybersecurity-predictions-from-zoom-ciso-jason-lee)** *Reported by The Free Press Journal*
 

8. #### **[Top 8 cyber security and privacy trends in 2022](https://www.immuniweb.com/blog/top-8-cybersecurity-privacy-trends-2022.html)** *Reported by ImmuniWeb*
 

9. #### **[German government calls for ban on biometric mass surveillance](https://reclaimyourface.eu/new-german-government-calls-for-european-ban-on-biometric-mass-surveillance/)** *Reported by reclaimyourface*
 

10. #### **[Apple share threat notifications for state-sponsored attacks](https://support.apple.com/en-us/HT212960)** *Reported by Apple*
 

This round-up was generated for on 29 November, 9:05am and contains the top 10 stories between 22 November 9:11am and 29 November, 9:00am

Hacker News Round-up (29/11/21)

# Russian Authorities on the Hunt for Hackers

#### Authorities on the Hunt for Hackers

The Russian Government have articulated a new strategy aimed at assigning attribution in particular areas of defence. This document - originally in [Russian](https://iz-ru.cdn.ampproject.org/c/s/iz.ru/export/google/amp/1292377?fbclid=IwAR1EjfK0jkViQ5zL3f7ioro_8fGy56U3subd4VHWeGFWPyFJynDGzBhlFco) - details the Government's approach to attribution and includes skepticism from Russian information security specialists who believe attribution is often without value.

If you’re growing your information security, information technology or data team, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice for candidate sourcing. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.
________________________________________
## Russian Cybersecurity Centre Targeting Infiltration Locations

The Ministry of Digital Transformation has launched an industry cybersecurity centre whose task is to protect government information systems. Its distinctive feature is its wide functionality - in addition to protection itself, the centre will also deal with attribution - the search for the initiators of attacks and the establishment of their involvement in certain threat groups. Such investigations are unusual for industry security centres, experts say. Izvestia figured out how significant the contribution of the Ministry of Digital Investigation can be in identifying hackers.

### To Assess and Counter

One of the main goals of the industry security centre of the Ministry of Digital Transformation will be to coordinate countermeasures against attacks, as well as their attribution - that is, the search for those who are behind such attacks. This follows from the materials distributed by the department at the [Infoforum-2022 thematic event](https://dev-talk.space/russia-infoforum-2022/). Cyber-attacks on structures subordinate to the Ministry of Digital Transformation, such as the Main Centre for Special Communications, Federal State Unitary Enterprise Kosmicheskaya Svyaz, as well as state information systems - GIS housing and communal services and others, will be investigated.

The centre, launched by the Ministry of Digital Development in early February, is not the first in Russia. Earlier, a similar structure - [FinCERT](https://theentrepreneur.space/fincert/) - was organized by the Bank of Russia. At the same Infoforum-2022, the Ministry of Energy announced the creation of Energy CERT. A similar project that is being developed for the healthcare sector. However, only in the case of the Ministry of Digital Development, the attribution function was publicly announced.

Discussing this, [Alexey Lukatsky](https://who-is-x.space/aleksey-lukatsk-biography/), Cisco Systems security business consultant, noted that in most cases, centres do not need this option, since it has little effect on the organization's protection, and at the same time it is extremely difficult to implement.

> “That's why most response centres — neither government nor corporate — don't include it in their list of tasks,” says Lukatsky.

As a rule, attack attribution means identifying the perpetrator or identifying a particular country by digital traces, such as linguistic features in malware codes. Often such detailed investigations are reserved for well-organized hacker groups.

At the same time, the identification and capture of a specific hacker may not be the goal of attribution, said Evgeny Goncharov, head of the industrial systems security research centre at Kaspersky Lab. According to him, attribution is more often a system of knowledge about the tools of groups of criminals. It helps to assess and classify threats to increase the effectiveness of countering them.

> The attribution of computer attacks involves, among other things, the identification of groups of cybercriminals in terms of tools and methods for implementing targeted attacks. Methods and processes for attributing computer attacks are confidential information, the press service of the Ministry of Digital Development noted.

The ministry said that to solve the tasks set, the industry centre will work with the forces of full-time specialists. However, they did not rule out the involvement of third-party experts in the work if a specific incident or model of work with a particular customer requires it.

## Worth the Investment

Some experts interviewed by Izvestia believe that attribution in industry security centres is an appropriate and potentially useful practice. At least because they accumulate a lot of information that makes sense to use it for investigations, says Mikhail Adonyev, director for interaction with government authorities at Rostelecom-Solar.
> Attribution of cyberattacks involves a whole range of activities. They require, among other things, the cooperation of various centres for responding to cyber-attacks, as well as the involvement of law enforcement agencies. CERT (Сomputer Emergency Response Team is the common name for response groups to emergency computer incidents. — Izvestia) can be an important link in this chain, — he said.

Vladimir Makarov, chief specialist of the information security audit department at T.Hunter, believes that assigning the attribution function to the centre of the Ministry of Digital Development can be a successful experiment, a new stage in the evolution of state CERTs.

> In my opinion, this is an interesting decision, which in the end will either lead to an increase in the overall level of competence of specialists employed in the centres or show that the functionality is redundant. I believe that this was what they were guided by, when giving such a functionality to only one “pilot” centre,” Makarov said.

## Not so Simple

At the same time, several representatives of the industry community are sceptical about the desire of the Ministry of Digital Investigation to engage in complex investigations of cyber incidents. At least because, due to the development of technologies used by attackers, their identification or even assignment to a particular country based on digital footprints is already conditional.

According to Aleksey Novikov, director of the Positive Technologies cybersecurity expert centre, a steady trend has formed in cybercriminal circles for groups to reuse each other's tools. This reduces the effectiveness of the adopted tactics for identifying hacker groups by digital footprints. Previously, only group "A" used one set of tools, therefore, if traces of these tools were found, the attack could be attributed to group "A". Today, the tools of group "A" can be used by group "B". Therefore, it would be incorrect to point to group “A” in such an investigation.

Alexey Lukatsky, in turn, noted that the investigation of cyber incidents in government centres, up to identifying hackers, may be ineffective for another reason: it is difficult for a Russian court to bring a criminal from another country to justice.

> For the court to accept evidence of attribution, it is necessary to carry out a very large amount of work, which not everyone and not always can they do. Yes, and it is not clear what to do with it. In an international court, this evidence is not valid, since there is no appropriate and recognized by all States legal basis for this, he said.

However, both experts agreed that regardless of what goals the industry security centres pursue in the framework of investigations, the very fact of creating such structures is a positive moment. It helps to increase the security of the state information structure.

## Looking to Build Your IT Team?

Innovative hiring practices, asking the correct questions, and finding the best people will change the trajectory of your organisation. If you want to improve your hiring practices for software engineers, security professionals or data experts, [Upward Spiral](https://upwardspiral.io/hire) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.


Russian Authorities on the Hunt for Hackers

# Making the right hiring decisions
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.

## 7 Steps To Make The Right Hiring Decision

There is a lot that goes into filling a vacant position and making sure that you have the best candidate for the role. One of these responsibilities is the hiring decision itself. Even if a candidate seems to fit your needs, it's important to be diligent about the evaluation to be sure of your decision. In this article, we share the steps you can take to make a hiring decision for your organisation.

**1. Know What You Want**

This hiring criteria should apply to every position at the organisation, from senior level executives to entry-level employees. The owner, CEO and human resources team can work together to form these criteria that will drive the company culture, address the needs of the business, customer base and more. Universal hiring criteria is helpful to begin with, and then individual hiring managers can evaluate each candidate to make sure they are a good fit for the particular position they're applying for.

To do this well, focus on the behavioral needs of the organisation instead of skills and experience. Skills and experience are poor predictors of candidate success; in fact, skills are the easiest to train for. Instead, organisations should focus on assessing people against a behavioral target, followed by a structured behavioral interview designed to uncover alignment with culture and values.

**2. Look in the Right Places**

To recruit the right talent, you need to look in the right places. One of the most effective means of making a good hiring decision is to implement an employee referral program. Employee referrals have a much better success rate in recruiting — the applicant-to-hire ratio for employee referrals is 10 to 1, whereas it takes 72 applicants from traditional sources to make one hire.

Use a modern [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform) to increase your candidate pipeline. You can also tap into the potential of social media to expand your pipeline. Platforms like LinkedIn, Twitter and Facebook are great tools to recruit passive candidates and those who already buy into your brand and culture. 

**3. What questions are candidates asking? Pay close attention**

What sorts of questions is the candidate asking? By listening closely to their questions, you’ll get a sense of where their interest(s) lies. I.e., what aspects of the job role and company culture interest them the most. What are they engaging with? Are they prepared, informed, and understanding of your company? If not, is there a reason?

**4. Use A Structured Interview**

Develop the interview while developing the job description, creating questions to discern candidates’ knowledge, skills and abilities relative to the job. Be disciplined about asking all applicants the same or similar questions, this makes it easier to company applicants.
[Project Implicit](https://implicit.harvard.edu/implicit/) is an excellent resource from Harvard. Noticing it will help you identify your biases in interviews. We recommend semi-regular checks with Project Implicit to stay consciously aware.
5. Focus on the candidate’s skills and attitude
As many as 29% of recruiters say one of the reasons they made a bad hire was because they struggled to find a qualified candidate. This same percentage also said they regret focussing on just the applicant’s skills without considering their attitude.

From this, we learn it’s equally imperative to assess a candidate’s skills as well as their attitude. For example, if proactiveness and motivation to push themselves forward are important to the job in question and to your company, you shouldn’t look only at whether or not an applicant has the skills you need but also what their attitude to work is like.

You can ask them specific interview questions to learn more about their work ethic, or instance. Here a couple of examples of such questions:

- Can you give an example of a time when you were unsatisfied with your work? Why? What did you do or not do? How did you feel about it? Looking back, what would you do differently?
- Describe a situation that demonstrates your willingness to challenge and stretch your current skills and abilities.

**6. Winnow the List**

Experts agree that it's best to limit the number of face-to-face interviews to no more than eight candidates. You will wear yourself out scheduling 20 or more interviews and have all the candidates blur in your mind.

A good way to prune the candidate list is to conduct a 10- to 20-minute phone interview with the best applicants, asking them to walk you through their resume. Have the candidate start at the beginning of their career. People like to start at the present and work backward, but that doesn't give you as much color around why they made a specific move or why they picked a specific company to work for.

**7. Be quick about your decision**

Although you should be sure to carefully consider the candidates, try to come to a final decision on who you'll be offering the job to in a timely manner. Often, candidates are applying for more than one job at a time, so while they may have finished an interview with your company and are waiting for a decision, they could receive a formal offer from another business. If you want to make sure you don't lose a candidate, ask everyone involved in the hiring process to think everything over and come to a decision by a certain date.

**Common Hiring Mistakes to Avoid**

The most common mistake managers make is either trying to hire a candidate too quickly or taking too much time to make a decision. At a certain point, the data and your intuition must come together to make an educated decision. Even if you need the position filled immediately, don't rush a hiring decision but also don't let it drag on.

If it's going to take time to get approval to make a hiring decision, be upfront about it with the applicant. Candidates lose interest in positions when hiring managers don't share feedback or a timeline.

Another pitfall is not being honest with the candidate about the position. If the candidate's salary requirement is $75,000 but the position only pays $50,000, or if the position doesn't offer a path for advancement, it's important to address that in the interview. There's no need to address it in the first interview, but it needs to be discussed at some point.

If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.

Making the right hiring decisions

## Top cyber security stories of 29/11/21 to 06/12/21
Below are the top stories in the space of cyber security.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[U.S State Department phones hacked with Israeli company spyware](https://www.reuters.com/technology/exclusive-us-state-department-phones-hacked-with-israeli-company-spyware-sources-2021-12-03/)** *Reported on Reuters*
 

2. #### **[Buried in the Infrastructure Bill is a mandatory backdoor kill switch for your car](https://hothardware.com/news/bidens-infrastructure-bill-mandatory-backdoor-car-kill-switch)** *Reported by hothardware.com*
 

3. #### **[Common infrastructure errors I've made](https://matduggan.com/mistakes/)** *Reported by MatDuggan*
 

4. #### **[Certs for progressing your pen testing career](https://upwardspiral.io/blog/Certs-for-progressing-your-pen-testing-career)** *Reported by Upward Spiral*
 

5. #### **[New German government plans 'right to encrypt'](https://tutanota.com/blog/posts/germany-right-to-encryption/)** *Reported by Tutanota*
 

6. #### **[Stealing Gigabytes of data to extort your former employer ](https://www.justice.gov/usao-sdny/pr/former-employee-technology-company-charged-stealing-confidential-data-and-extorting)** *Reported by United States Department of Justice*
 

7. #### **[Why doesn't anyone create a search engine comparable to 2005 Google](https://news.ycombinator.com/item?id=29417061)** *Reported by ycombinator*
 

8. #### **[That shouldn't have happened: A vulnerability postmortem](https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html)** *Reported by Google Project Zero*
 

9. #### **[Ideal monitor rotation for programmers](https://sprocketfox.io/xssfox/2021/12/02/xrandr/)** *Reported by Sprocketfox*
 

This round-up was generated for on 06 December, 9:05am and contains the top 10 stories between 29 November 9:11am and 06 December, 9:00am

Hacker News Round-up (06/12/21)

# What are passive candidates and how can you recruit them?
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.

### What is a passive candidate and how do you recruit them? Read on as we explain everything you need to know.
Business leaders know very well how difficult it is to make the right decision when it comes to talent. They first need to understand their current workforce and the ways in which it needs to evolve to be successful, both today and going forward. They are then tasked with the ongoing struggle of finding the right people to execute against their vision. This is a long and windy road, sometimes taking longer than expected, or requiring you to go back and start again in some cases.

For most open roles, companies start on the traditional route. Someone begrudgingly writes a job description or finds one on the internet that - mostly - works. This is posted on the company’s website and a few job boards and then they wait for standout applications to flood in. However, with the job market being more competitive than ever for employers, this method often won’t deliver. It’s also not very quick.

Instead of waiting for a perfect candidate to apply, companies are investigating other ways to identify and acquire standout talent. In 2022, more than 70% of candidates are passive candidates, making it the most successful way to fill open roles.

So what is a passive candidate and how do you find them? Read on as we explain.

## What are passive candidates?

A **passive candidate** is a person who is not actively applying for a new job. However, they are exploring opportunities and possess the right skills, qualifications and experience for a role the organisation is looking to fill.

The best way to find these individuals is through a [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform), designed to build your talent pipeline. Other more expensive solutions might include recruiters, outsourced recruitment agencies or an applicant tracking system (ATS) database.

Passive candidates often have a wealth of experience and knowledge or have highly sought after skills. These desirable candidates are usually found in technical fields, such as technology and engineering or manufacturing fields, or areas where there are skill shortages like information security.

## Where can you source passive candidates?

If you’re trying to find these candidates without spending anything, you need to invest your time into creating relationships and expanding your professional network. That can be in-person meetups, or virtually via mediums like LinkedIn. These personal connections can help you source the best passive candidates available.

[Talent intelligence platforms](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform) are another affordable solution for increasing your [talent pipeline](https://www.how-to-x.space/how-to-build-a-talent-pipeline/). These tools allow you to filter from an immediately available candidate base at any time to identify potential candidates with your desired skills, qualifications and experience.

If you have a large budget, recruitment agencies and recruiters are another option for sourcing passive candidates. You equip these parties with a role description and they do the leg-work engaging with candidates via their social media and bring interested parties to your attention.

In any case, these qualified candidates may not be actively applying for your particular role, however, may be open for a confidential chat after learning more.

### Digital solutions

One of the easiest ways to source passive candidates is to register with a [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform). These services maintain a healthy talent pipeline of potential candidates that significantly improve hiring velocity metrics. They are particularly strong in the space of information technology and information security. They are also free to register, search for candidates (visa skill, qualification and experience), and engage them.

### Applicant tracking

These days, it’s easier than ever to search for potential candidates via social media and send a quick message explaining the role. From here, you can gauge interest and understand if they’re interested in learning more about the role and opportunity available.

You can get reasonable returns by pairing this effort with an applicant tracking system (ATS). Though, these tools are not the cheapest. If an employee submits an application, or you reach out to a potential candidate, and they do not end up winning or accepting the role, you can add them to your own talent pool repository in the ATS.

If you have no other strategy for approaching passive candidates, applicant tracking can be very handy if you’re going through a growth phase.

### Recruiters or recruitment agencies

A legacy system for sourcing passive candidates is to outsource the process to recruiters. These parties will leverage their social media networks to advertise your role and identify potentially suitable candidates.

These days, it’s easier than ever for recruiters to search for potential candidates and send a quick message explaining the role. Here is a free [candidate outreach template](https://employmenthero.com/thank-you/downloadable/?origin=passive-candidate-outreach-template&origin_id=727gH%2B7%2B4RjdY32V%2BFzCnLAfULJR9SPaEgeglBjvHJOTwGwFe0XEoIbjqtHXiX4qhZpl1yGENddkDPDQ5HDRAA%3D%3D) that illuminates the approach.

This is by-far the most expensive option for sourcing passive candidates or expanding your talent pipeline.

 ### Ask your existing team for referrals

The most cost-effective recruitment strategy is leveraging your current workforce to refer great candidates from their own network. The benefit of this strategy is that your employees would’ve already done most of the vetting. In fact, employee-referred new hires are overall stronger performers compared to those who apply through a job board, and they have a longer average tenure.

In order to really engage your employees into the referral scheme, we suggest setting an incentive. If their referral is successful, they should be rewarded for saving you money.

Unfortunately, scaling this solution is near-impossible. It can be incredibly beneficial through the life of a company, but only ever as a complementary solution.

## Hiring passive candidates – is it really that easy?

When you see it written down, hiring passive candidates appears to be a simple pathway for recruiting top talent to your business. It sounds easy to do. Reach out to a network who fits the job description, have a chat and then they’ll join your business. Not exactly. In most cases, it’s quite difficult.

You need to remember that hiring managers are going to have a similar recruitment strategy to you, meaning passive candidates can be in hot demand. The reality is, passive candidates are most likely getting multiple LinkedIn messages a week about open positions. They’ll be receiving another handful of messages from a recruiter or recruitment agency. This is where it is important that your approach to passive candidates stands out for the right reasons - bringing us to our final point.

## Standing out and landing candidates

It is vital do two things:

1. You must stand out from the crowd. What is your [employee value proposition](https://www.how-to-x.space/how-to-write-an-employee-value-proposition/), what makes your company a compelling place to work, how does your approach to hiring help you stand out?

2. Devise a strategy for identifying passive candidates who would be open to leaving their current role. Research has shown that most employees would be willing to leave their current employer for a pay rise of 20%. A high number that typically accompanies candidates you cold-call or receiver from a recruiter. If you’re uncomfortable with this figure - whether you realise it is occurring or not - our thoughts are that you need to identify candidates who are already willing to leave their current role.

## The wrap up

Passive candidates are one of the most effective ways to bring top talent into your business. As they’re not actively applying for roles, it is more difficult to attract them and more difficult to find them. Success with these candidates is defined by your ability to identify those already preparing to leave their current employer. [Talent intelligence platforms](https://upwardspiral.io/hire) are an unrivaled way to achieve this. They allow passive candidates to share that they are seeking a new role, their skills, experience and salary expectations.

It’s time to open up your talent pool and learn how you and your team can leverage the power of passive candidates!

## Want to know more?

Take a look at our Employee hiring and retention report 2022. Or [talk to one of our professionals](https://upwardspiral.io/hire).

If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.


What are passive candidates and how can you recruit them?

## Top cyber security stories of 15/11/21 to 22/11/21
Below are the top stories in the space of cyber security.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[FBI Email System Reportedly Hacked to Send Fake DHS Cyberattack Messages](https://www.newsweek.com/fbi-email-system-reportedly-hacked-fake-dhs-cyberattack-messages-1648966)** *Reported by Newsweek*
 

2. #### **[GitHub’s commitment to npm ecosystem security](https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/#security-issues-related-to-the-npm-registry)** *Reported by github*
 

3. #### **[Microsoft Calls Firefox’s Browser Workaround “Improper,” Will Block It](https://www.howtogeek.com/768727/microsoft-calls-firefoxs-browser-workaround-improper-will-block-it/)** *Reported by How-To Geek*
 

> #### **[Upward Spiral](upwardspiral.io) [launch referral program where each job-finder earns you $500 cash](https://blog.upwardspiral.io/blogs/earn-rewards-by-referring-upward-spiral)** Upward Spiral is a job seeker platform. Our mission is to help 1-million cyber professionals find a role that resonates with them. Earn for every new Upward Spiral referral who gets a new job or hires through the platform!

4. #### **[DHS launches program to close cyber talent gap](https://therecord.media/dhs-launches-new-effort-to-attract-cybersecurity-talent/)** *Reported by the Record*
 

5. #### **[What quantum computing will really mean for the tech industry](https://www.crn.com.au/feature/after-the-science-what-quantum-computing-will-really-mean-for-the-tech-industry-562414)** *Reported by CRN*
 

6. #### **[A list of router security vulnerabilities](https://modemly.com/m1/pulse)** *Reported by Modemly Pulse*
 

7. #### **[Space debris forces astronauts on space station to take shelter in return ships](https://www.space.com/space-debris-astronauts-shelter-november-2021)** *Reported by Space.com*
 

8. #### **[The bullet effects in Terminator 2 weren’t CGI](https://hackaday.com/2021/11/14/those-bullet-effects-in-terminator-2-werent-cgi/)** *Reported by hackaday*
 

10. #### **[Is tasking developers with creating detailed estimates a waste of company money?](https://iism.org/article/is-tasking-developers-with-creating-detailed-estimates-a-waste-of-company-money-42)** *Reported by iism*
 

This round-up was generated for on 22 November, 9:05am and contains the top 10 stories between 15 November 9:11am and 22 November, 9:00am

Hacker News Round-up (22/11/21)

# The hidden costs of recruitment: What’s recruiting costing you?
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.
## The hidden costs of recruitment: What’s recruiting costing you?
Today, we want to look at the hidden recruitment costs you might not know about, and discuss the more cost-effective ways to hire new employees into your business.

Employees are the ones that make a business thrive and determine how successful it will be in the future. People are the foundation of every business; if you can get the people element of your business right, the results are outstanding.

Bringing the best and the brightest talent to your business comes at a price. This blog looks at the hidden recruitment costs you might not know about, and discusses more cost-effective ways to hire new employees.

### Recruitment costs definition
There are a number of factors that go into the [recruitment process](https://upwardspiral.io/blog/employee-hiring-and-retention-2022), on top of planning and onboarding a new employee. As a hiring manager, your company or department may require you to outline various expenses associated with this task, so we’ve gone and broken them down for you.
### Monetary costs
The actual monetary cost of recruitment comes first. This includes;

- Salary of your recruitment team
- Salaries of extra team members involved in the hiring process
- Internal commissions or referral bonuses you might have set up
- Advertising and online job board costs
- Any software that you use to hire employees

These are some of the biggest recruitment expenses and arguably are the easiest ones to identify and price up. When you add everything up, the average cost of a new hire can be anywhere between $3,000 to $15,000.
### Time invested by staff during the hiring phase
In business, time is valuable. While you may have already allocated a certain financial cost to recruitment including the items we listed above, it’s easy to underestimate the time it takes to hire a new recruit.
- Writing, creating and posting to and promoting the job ad to networks will take a lot of time out of your hiring managers day-to-day tasks.
- During the time you are hiring, there’s either no productivity in the role you’re hiring for, or limited productivity. If the hiring process takes longer than usual, this extends the lost productivity time and output for your company.
- Time taken out for filtering through applicants will take a considerable amount of time.
- When you finally reach the decision to hire someone, the negotiation stage can draw out the process longer. Leading to more HR wages allocated to the hire, and productivity and output lost in the role you are hiring for.

These elements of the recruitment stage won’t come with a physical price tag, but the cost of lost time for current employees is considerable. And the longer it takes to find the right employee, the higher these costs get.

### The recruitment cost of “bad” hires
A new hire who doesn’t quite “fit” can be costly to your business. Whether they’re not right for the role, leave the company or are asked to leave by the business.

This will not only mean having to start the hiring process again, but it can also have a negative impact on the rest of your team. It will often lead to less productivity among remaining staff, lower employee morale and you continue to be an employee down. The cost associated with this can be significant for your business.

### Recruitment outsourcing costs
These costs don’t apply to everyone, but more companies are starting to outsource components of the hiring process to various entities to avoid some or all of the above costs associated with hiring. While this can help with upfront costs, leveraging recruitment agencies exposes the business to far greater risk of “bad hires.

Recruitment agencies have more manpower invested in the recruitment space than most companies. This results in a larger candidate pipeline and can speed up the hiring process.

Whether or not you choose to recruit in-house or through an agency, be sure to factor in the extra time, energy and effort outside of the financial recruitment cost.

### The most cost-effective recruitment strategies
Now, every business wants to save money and be efficient. And as you can see, the mixture of monetary and timely recruitment expenses adds up to a significant sum. So we’ve pulled together the low-cost recruitment strategies that can save you time and money when you next need to hire.

#### Recruitment Tools
In today’s modern workforce decisions are increasingly backed by data, permitting companies and hiring managers to be confident in the efficacy of their hiring decisions. Hiring giants like Google, Apple and Amazon have demonstrated the importance of [hiring velocity](https://theentrepreneur.space/getting-a-job-at-amazon-or-google/) in low-cost and efficient hiring practices. Success in this area defines the trajectory of a business.

Leveraging a [talent intelligence platform](https://upwardspiral.io/blog/hiring-through-a-talent-intelligence-platform) to provide you with direct access to the largest talent pool of [vetted](https://www.google.com/url?q=https://blog.upwardspiral.io/blogs/how-do-upward-spiral-vet-candidates&sa=D&source=docs&ust=1642611453489902&usg=AOvVaw3ehyWwwbQnvtqbVfWWnXpW) professionals and ensures a great candidate experience. These tools provide a great alternative to recruitment agencies and help companies easily identify talent to fill job, role and skill gaps quickly for a fraction of the cost of a recruiter.

Another tool you may not have considered is a robust applicant tracking system (ATS) - such as JobAdder. Although it might seem like a big up-front cost, if you’re opening a large number of openings - more than 50 at once - they help streamline your process, reduce duplication of work and data entry, protect candidate data and better comply with the requirements of the GDPR.

#### Recruitment Referrals
A cost-effective recruitment strategy is leveraging your current workforce to refer great candidates from their own network. The benefit of this strategy is that your employees would’ve already done most of the vetting. It’ll also cost significantly less than a recruitment agency.

In order to really engage your employees into the referral scheme, we suggest setting an incentive. If their referral is successful, they should be rewarded for saving you money.
#### Brand Ambassadors
Another tip that goes hand in hand with recruitment referrals is turning your current employees into brand ambassadors. Job seekers are product consumers.

In the same way as they would when buying a new pair of shoes, they will do their research on a business before applying for a job or accepting a role. They might ask colleagues, peers and friends for their impression of a business, consult their LinkedIn connections or read reviews on Glassdoor for insider knowledge. Employee advocacy is essential and powerful - while inexpensive - for scaling your business.

#### Social Media
Social media is a cost-effective recruitment strategy for an obvious reason; it’s free to post. If you have access to an innovating marketing team, creating graphics to advertise your role is a simple and very effective strategy.

When it comes to social media posting, remember;
- Video content is very important, they’re more effective in grabbing people’s attention in the newsfeed and favour the algorithms much more.
- Don’t be afraid to use images! Graphics are important for social media posts, so ensure images are incorporated into your social media recruiting strategy.
- Hashtags are important. Especially for video content.

#### Job Fairs and Industry Conferences
Job fairs are a low-cost way to find employees. You don’t necessarily have to invest in a large, expensive stand. You can simply attend the event and network with other visitors on the day. Share your business cards and that’s all you need.

Be sure to attend relevant industry conferences. Not those centred around recruiting.

#### Create job ads that speak for themselves
It’s vital that your job ad be on-brand, appealing and engaging.

Your job ad not only has to be well written, but it also needs to be compelling, optimised for search, and clearly outlines the job’s key requirements and responsibilities.

#### Reduce the need to recruit
The final low-cost recruitment strategy is to simply reduce the need to recruit in the first place!

This can be done by improving the way you support and engage your existing employees. Supporting them with internal training, upskilling opportunities, as well as incentives, will overall improve your company culture and employee engagement levels. This, in turn, lowers your staff turnover and therefore reduces the need to recruit in the first place!

### The wrap up
As you can see, there’s a lot more hidden recruitment costs than first meets the eye! But with a few cost-effective strategies in place you can save your business time and money and still recruit top talent. If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.


The hidden costs of recruitment: What’s recruiting costing you?

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [check out what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

### Player’s Player of Information Security
This isn’t a “people’s choice” award. It is a “player’s player” of information security. People on this list have contributed significant value as hands-on operators. Their contribution to the world of information security is evident. Or to be more clear: They have done shit that matters.
> "the biggest personal award you can get in the game" - [Teddy Sheringham](https://en.wikipedia.org/wiki/Teddy_Sheringham) describing the **Professional Footballers' Association Men's Players' Player of the Year** award in 2001

It is the ultimate accolade to be voted for by your fellow professionals.

In considering their votes, the panel investigates if the candidate has demonstrated a profound knowledge of programming, systems, techniques and tactics of complex information security tasks.

Of equal importance, is the candidate’s willingness to give back. In what way is the candidate advancing the information security community? How long have they been doing this? What impact does their contribution have? It isn’t enough to be excellent as an operator, one must be excellent as a professional.

### Deciding the nominees
The initial shortlist consisting of 30 names in contention for consideration is assembled by an editorial team of information security professionals.

Following the compilation of the 30-person shortlist, a jury of infosec experts representing a variety of nations and demographics was engaged, and given the task of voting for the professional they deem worthy of first, through to fifth place.

### What is the voting process for the Player’s player?
After the jury was selected, they chose their top five infosec professionals from within the 30-person shortlist and then proceeded to rank them based on descending order of merit.

The rules and regulations that the jury followed to choose and rank their top five selections are below:
* Performance of the individual through the year.
* Professional class (contribution to the infosec community).
* Overall judgment of the professional’s career to-date.

The top-ranking professional from each panel member’s selection will receive six points, with the second-ranking professional earning four points, then three, two and one going down from the rest of their top five picks.

### How is a winner chosen for a Player’s player?
After each jury member has selected their top five candidates for the award, the total points are calculated and added, and the candidate to receive the most points will be awarded the top honour.

In the event of a tie for first place, however, the candidates are determined by the number of times they are voted in first place. If the tie still stands, then the tie-breaker will consider the number of votes for second place, and then by the number of votes for third place.

#### The results
<ol>
 <li value="5"> 
<a href="https://www.linkedin.com/in/johnhammond010/">John Hammond</a>
 provides a higher level penetration testing explanation in video format that doesn't bore you to death with every tiny detail while still covering each of the steps you need to understand to execute. You can check out his work at his <a href="https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw">Youtube channel</a>. </li>
 <li value="4"><a href="https://www.linkedin.com/in/nicholas-w-white/">Nick White</a> is a tech influencer, community leader and programmer. He delivers a Youtube series covering just about anything you might want to know (including where is best to find the things he can't teach you). You can learn more about him at his <a href="https://www.youtube.com/channel/UC1fLEeYICmo3O9cUsqIi7HA">Youtube channel</a>.</li>
 <li value="3"><a href="https://www.linkedin.com/in/ezequielpereiralopez/">Ezequiel Pereira Lopez</a> found a critical vulnerability in Google Cloud and was awarded $164,674 in total. Learn more about his journey <a href="https://www.youtube.com/watch?v=g-JgA1hvJzA">here</a> .</li>
 <li value="2"><a href="https://www.linkedin.com/in/musalbas/">Mustafa Al-Bassam</a>, a former member of Anonymous and one of the founders of LulzSec. If you get the opportunity to hear him speak in person, I would recommend it. He has done a lot of hacking, but isn’t braggy. He explains what he did in the most normal way possible. You can check out one such example <a href="https://www.youtube.com/watch?v=HXXoO0FwUKQ">here</a>.</li>
 <li value="1">Chul-eun Lee is a former high-ranking North Korean government official who defected to South Korea in 2016. On June 15, 2021 he was <a href="https://www.youtube.com/watch?v=t9rLqYXTaFI">interviewed</a> about his journey, his former job with the North Korean government, and the differences he sees between North and South Korea. You won't find him on LinkedIn, but he isn't hard to find.</li>
</ol>


#### Joining the panel
If you’re keen to be involved in next year’s panel, or submit a name for consideration, [sign up here](http://eepurl.com/hMLlxT) to be notified when submissions open.


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [check out what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

Top 5 InfoSec professionals to follow

### Companies: What type of professional can we expect?
Upward Spiral accepts and works with talented professionals of all levels of experience with varying degrees of technical and operational expertise. Companies can hire junior employees, CSOs and everything in between through Upward Spiral.

Most commonly we see penetration testers, security analysts and GRC professionals recruited.


Companies: What type of professional can we expect?

## Top information technology stories of 17/01/22 to 24/01/22
Below are the top stories in the space of information technology.

This regular delivery of the top hacker news stories means you don’t have to be constantly distracted, trying to keep up with the latest even if you’re AFK for a bit.

If you’d like to receive this straight to your inbox you can [sign-up here](http://eepurl.com/hMLlxT).

Here are the stories from the past week:

1. #### **[Someone made a Pokemon FPS](https://www.reddit.com/r/unrealengine/comments/s5n2ux/i_spent_the_past_month_making_a_pokemon_fps/)** *Reported on Reddit (r/unrealengine)*
 

2. #### **[Senate passes Bill to address supply chain attacks](https://www.scmagazine.com/analysis/legislation/senate-passes-cyber-bills-to-address-supply-chain-security-aid-state-and-local-governments)** *Reported by SCmedia*
 

3. #### **[European Space Agency invites applications from attackers who want to hack the OPS-SAT spacecraft](https://www.theregister.com/2022/01/11/ops_sat_hack/)** *Reported on The Register*
 

4. #### **['Dev' corrupts NPM libs 'colors' and 'faker' breaking thoughts of apps to protest Open source](https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/)** *Reported by BleepingComputer*
 

5. #### **[Remote workers work longer, not more efficiently](https://www.economist.com/business/2021/06/10/remote-workers-work-longer-not-more-efficiently)** *Reported by the Economist*
 

6. #### **[10 cybersecurity statistics you should know in 2022](https://www.forbes.com/sites/chuckbrooks/2022/01/21/cybersecurity-in-2022--a-fresh-look-at-some-very-alarming-stats/?sh=7736e2056b61)** *Reported by Forbes*
 

7. #### **[WordPress themes and plug ins backdoored in supply chain attack](https://www.bleepingcomputer.com/news/security/over-90-wordpress-themes-plugins-backdoored-in-supply-chain-attack/)** *Reported by Bleeping Computer*
 

8. #### **[22 year-old building chips in his parents garage](https://www.wired.com/story/22-year-old-builds-chips-parents-garage/)** *Reported by Wired*
 

9. #### **[Framework Open source their firmware](https://frame.work/blog/open-sourcing-our-firmware)** *Reported by Frame.work*
 

This round-up was generated for on 24 January, 9:05am and contains the top 9 stories between 17 January 9:11am and 24 January, 9:00am

# What does the Cybersecurity & Infrastructure Security Agency (CISA) assessment and evaluation standardisation mean for the industry?

If you’re looking to grow your cyber security team, be sure to register your interest at [Upward Spiral](https://upwardspiral.io/hire) and [create an account](https://upwardspiral.io/login?create) for access to a network of the industry’s best cyber security professionals.

### The Cybersecurity & Infrastructure Security Agency (CISA)
The Cybersecurity and Infrastructure Security Agency (CISA) are the operational lead for the federal security team in the United States. They lead the national effort to understand, manage, and reduce risk to cyber and physical infrastructure.

They objective is to connect stakeholders, industry and government to each other and to resources, analyses, and tools to help them build their own cyber, communications, and physical security and resilience.

The hope, this will in turn ensure a secure and resilient infrastructure for the American people.

> *We lead the National effort to understand, manage, and reduce risk to our cyber and physical infrastructure.* - CISA

### CISA assessment and evaluation standardisation
CISA has introduced an assessment evaluation and standardisation (AES) program to ensure a national standard for the information security workforce.

In 2019, CISA launched the AES program to expand the availability of organisations and individuals qualified to administer cybersecurity assessments in accordance with CISA’s standards and in a manner that provides data back to CISA for risk management purposes.

The purpose of this first way of standardisation is to ensure there is an appropriate workforce to evaluate capability.

At the end of 2021, the program is only available for assessors affiliated with government entities (including federal civilian agencies, the Department of Defense, or State, Local, Tribal, and Territorial governments). Over the coming 12 months CISA will expand the AES program to enable private sector assessors.

The program will enable organisations to have a trained individual that can perform several cybersecurity assessments and reviews in accordance with industry and/or federal information security standards.

### Available courses
#### High Value Assets (HVA)
The HVA course prepares students to evaluate the federal government’s approach to managing risk, and provide an unbiased, third-party review of the cybersecurity posture and operations of the government’s most critical HVA. The course verifies that successful students have the capability to inform respective agency leadership to fully understand and manage the risk which is inherent in its selected cybersecurity solution(s). The process depends on in-person interviews, documentation reviews, in-depth technical analysis, and resilience testing through vulnerability scanning and penetration testing. The assessment results in a detailed analysis of how the HVA’s individual security components integrate and operate, including how data is managed and secured.

#### Cyber Resilience Review (CRR)
The CRR course and resulting examination focuses on operational resilience and cyber security best practices. The CRR has a service-oriented approach, meaning that one of the foundational principles of the CRR is that an organisation deploys its assets (people, information, technology, and facilities) to support specific operational missions (or services). The CRR is offered in a facilitated workshop format and as a self-assessment package. Successful students will be well versed in executing both formats. Further students are informed on the [Protected Critical Infrastructure Information Act of 2002](https://www.dhs.gov/publication/critical-infrastructure-information-act), which limits the material collected in a facilitated CRR, which is protected from disclosure. Students gain mastery of automated data capture and report generation tools, a facilitation guide, comprehensive explanation of each question, and a crosswalk of CRR concepts to the corresponding [National Institute of Standards and Technology](https://www.nist.gov/) (NIST) Cybersecurity Framework.

#### External Dependencies Management (EDM)
The EDM course gives students the capability to facilitate an assessment which is intended for system owners and operators of critical infrastructure organisations, which measures and reports on the ability of the subject organisation to manage external dependencies, as they relate to the supply and operation of information and communications technology (ICT). This area of risk management is also sometimes called Third Party Risk Management or Supply Chain Risk Management.

#### Risk and Vulnerability Assessment (RVA)
The RVA course gives the tools students would need to develop an in-depth analysis which would detail what a sample attack path which a cyber threat actor could take, to compromise a given organisation’s weaknesses. The attack paths are representative of Tactics, Techniques, and Procedures (TTPs) which CISA has observed being leveraged by malicious actors. Course content and infographics provide a high-level snapshot of five potential attack paths and breaks out the most successful techniques for each tactic that the RVAs have documented. Both the analysis and resulting infographics, map threat actor behavior to the MITRE ATT&CK® framework.

### Does CISA matter if I’m not in the United States?
Yes. It does.

It signals to the world that governments will act to ensure information technology, a critical infrastructure, is managed with the same level of scrutiny as industries as vital as oil, gas, water and logistics.

While CISA only directly impacts the United States, tracking their progress is a strong indicator of what is to come across the globe.

If you’re looking to grow your cyber security team, be sure to register your interest at [Upward Spiral](https://upwardspiral.io/hire) and [create an account](https://upwardspiral.io/login?create) for access to a network of the industry’s best cyber security professionals.



What does the CISA assessment and evaluation standardisation mean for the industry?

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

### Risk Manager Jobs
There are numerous entry opportunities for risk managers; their fields of activity vary depending on the areas of risk they are in charge of. Their responsibilities may include the management of risks related to (material) assets, products, employees or corporate finance. Risk managers are needed in all industries and in various departments of companies.

These, along with some of their subcategories, include:
* Market Risk 
  * Interest and currency exchange rates 
  * The fluctuating cost of materials 
  * Changing trade laws 
  * Compliance Regulations 
* Credit Risk
  * Customer defaults
  * Vendor relationships
* Reputational Risk
  * Brand perception
  * Data breach or exposure
* Operational risk
  * Fraud
  * Employment and Business practices
  * Continuity processes
  * Employee safety and security
  * Property and data protection
#### What is a risk manager?
An organisation’s corporate risk manager is involved in many aspects of the business. The position of risk manager is often a part of the executive team and in some companies is elevated to the C Suite with the Chief Risk Officer (CRO) role. Ultimately where the risk manager falls within the organisation’s hierarchy is often an indication of the organisation’s risk appetite or willingness to accept risk.

Simply put, the risk manager’s job is to understand everything that could go wrong and what the consequences or impact on the business would be if it did go wrong.

In addition to understanding the various aspects relevant to an organisation’s threat profile, the risk manager must also understand the probability of a particular threat.

In short... Risk = Threat x Probability x Criticality. Or… Risk = Threat x Vulnerability x Consequence.
#### What does a risk manager do?
An organisation’s risk manager defines the businesses risk appetite. They strategize to minimize, eliminate, or transfer the risk a business faces. Risks can be either minimal (small chance of occurring or small consequence if it does occur). Those risks may just be assumed by the organisation and are likely noted but left unaddressed. Other risks, however, must be eliminated or transferred in the form of insurance.

Threats and risk factors are quantified and communicated through a risk assessment. A risk assessment is a tool used by risk management professionals to examine known risk factors and benchmark them against known probable consequences. A risk assessment is used to formulate appropriate ways to eliminate or minimise risk.

In well-resourced businesses, the risk manager may be able to rely on input from peers and subordinates, such as:
* Cyber risk specialists
* Security director
* Chief information officer
* Threat intelligence specialists

The risk manager’s job is to evaluate input from these sources and then quantify risks for senior decision-makers in the company. They often assist senior management in defining business strategies that avoid or mitigate risks. Or help them understand the risk they are accepting.

The range of tasks a risk manager covers includes the identification, analysis and evaluation as well as the monitoring, management and control of all types of risks, e.g. technical, financial, environmental or software risks. They do not only make sure that risk owners understand the existing risks but also evaluate risks and prepare risk (assessment) reports, applying statistical methods for their work.
#### What education does a Risk Manager need?
Risk managers require a range of business and technical knowledge, skill and experience. Consequently the training and education requirements of the risk manager role vary widely depending on the industry and organisation. However, some of the educational requirements that are applicable across all industries and organisation’s include:
* A bachelor's degree in management or business administration is highly preferred
* An MBA is preferred and these can be found specific to the cyber security industry
* A law degree
* A degree in finance or economics
* Expertise in computer science or software engineering 

**What skills does a Risk Manager need?** 
Risk management careers span across all industries and organisation types. Risk managers must have a commensurate variety of skills and ensure they have sufficient knowledge in business administration, excellent methodical skills. They must also appreciate the art of compromise, as often risk will be accepted. Below some of the key skills all risk managers should develop to be successful in their job.
* Ability to objectively analyze data and information to form a big-picture view of risk
* Ability to digest detailed information to determine trends and tendencies
* In-depth knowledge of their industry, including competitors and adversaries
* Knowledge of business administration
* Knowledge of statistical methods
* Knowledge of finance
* Ability to communicate effectively at an executive level
* Ability to be agile and react to changes in the business environment
* Organizational and leadership skills
* Mathematics skills
* IT skills
* Team spirit
* Strong communication skills

#### Salary
The job of a risk manager is very demanding. Very few applicants will meet the high requirements. The role is also in high demand. Accordingly the starting salaries are competitive, at roughly US$42,000 to US$70,000, depending on industry and region. With increasing experience, the salary can rise to between US$75,000 and US$103,200.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).


Risk manager jobs

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### What is Kubernetes
Kubernetes is an open-source container-orchestration system for automating application deployment, scaling, and management. It was originally designed by Google and is now maintained by the Cloud Native Computing Foundation.

> Cloud Native Computing Foundation (CNCF) is a vendor-neutral home for many of the fastest-growing open source projects.

Kubernetes enables higher-velocity software development at a lower cost than traditional infrastructure. Cloud native — orchestrating containers as part of a microservices architecture — is a departure from traditional application design.

Kubernetes is a very popular container orchestration system. It became one of the fastest-growing projects in the history of open-source and forms a significant portion of many organisation’s compute stack.

With the benefits of Kubernetes, it introduces new security challenges and - given the nature of how essential Kubernetes has become for many organisations - requires constant attention to manage numerous security uncertainties that eventuate in containerised environments.
### Introduction
Kubernetes is incredibly popular as a tool. As a result, new tools are constantly being released around Kubernetes. Both the OpenSource and commercial flavours. Some time ago I read an article on security tools to support Kubernetes implementations and felt it important to provide an updated take as the tools have continued to develop.

These tools are commonplace, for two obvious reasons:

- Kubernetes is a challenging beast even for experienced practitioners; and
- The AdmissionController Resource in Kubernetes (K8) with the ValidatingWebhook and MutatingWebhook resources, makes it possible to build valuable security integrations for K8.

This is by no means a comprehensive list of all K8 security tools, but a list of some of the best OpenSource tools available.

### Audit2RBAC
Audit2RBAC is a small utility that helps you identify the right role-based access control (RBAC) Policy for your resources based on the K8 audit log. It takes the Audit log as input and generates a reasonably good RBAC policy for the resources you're working with.

Audit2RBAC can be somewhat fiddly as you pursue greater granularity and control of privilege.

[Here](https://github.com/liggitt/audit2rbac) is a link to Audit2RBAC on Github

### KubeAudit
The team at Shopify have built this tool and it comes with the glitz you expect of an engineering team that built the best online sales interface. KubeAudit is a suite of features that allows you to assess and audit K8 clusters for security flaws.

KubeAudit is exceptional at uncovering major and minor security issues in clusters.

KubeAudit can be used both as a CLI and golang library, to encourage integrations which allows you to check your manifests and creates a more security-optimized version of the manifest. Often it sets a bar far higher than you’re willing to maintain, but it does a great job providing you with ample opportunity to implement change for better security.

The community keeps Kubeaudit constantly updated and continues to add features. Manifest mode, for instance, allows KubeAudit to be used as a static analyzer against K8 YAML manifests.cli.

[Here](https://github.com/Shopify/kubeaudit) is a link to KubeAudit on Github

### Kube-Bench
Kube-bench is a Go application and deployable as a container. Pre-made job.yaml files are designed to help run Kube-bench in a K8 cluster or on a managed K8 service (Azure K8 (AKS), etc). It is easy to implement and use.

Kube-bench runs a series of benchmarking tests based on the guidelines for K8 security from the Center for Internet Security (CIS). It is used to detect insecure, open default settings and improper user authentication and authorization, and highlight insecure data in transit and at rest.

[Here](https://github.com/aquasecurity/kube-bench) is a link to Kube-bench on Github

### Kube-Hunter
Kube-hunter is an offensive tool (written in python, which is very handy) from Aquasec that helps you offensively explore K8 clusters. If you’re a Pentester, Red-Teamer or other, this is a tool you can’t do without. It has just about everything you might need to identify and exploit vulnerabilities in your K8 clusters, remotely or locally.

The tool, like its orientation, is meant to identify and exploit. In many instances, a great tool for read-teaming yourself some success in K8 hosted CTFs (If we get enough feedback, I might write up how to do this).

[Here](https://github.com/aquasecurity/kube-hunter) is a link to Kube-Hunter on Github
### Polaris
Polaris is a Policy-Management Tool for Kubernetes from Fairwinds. It’s basically a series of AdmissionControl checks that apply rules for a set of security, networking and general best practices in a K8 cluster. It rejects resources that violate these rules. It’s not complex but highly valuable.

This is akin to PodSecurityPolicy, but unlike a PodSecurityPolicy, Polaris has a more user-friendly rules approach. It also has a much nicer user interface for visualising the overall health of the K8 cluster based on the checks.

Finally, it can be leveraged to perform CI/CD checks against a cluster and setup thresholds for failed builds. Automating a lot of the QA work you will otherwise be doing manually.

[Here](https://github.com/FairwindsOps/polaris) is a link to Polaris on Github.

### Vault by Hashicorp
When you’re starting to learn and using Kubernetes for the first time you discover that there is this special object called Secret that is designed for storing various kinds of confidential data. However, when you find out it is very similar to ConfigMap object and is not encrypted (it can be optionally encrypted at rest) you realise it isn’t super secure.

On top of that, managing these Secret object definitions (e.g. yaml files) is not a fun or easy task.

This is what Vault is for. It is a project designed to help you store and securely access your confidential data. It is designed for this purpose only and has many excellent features, many of which are specific for K8 environments.

[Here](https://github.com/hashicorp/vault) is a link to Vault in Github.


If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [checkout what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

Top 6 Kubernetes Security Tools

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [check out what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### Cyber security jobs
This guide contains everything you need to know to get up to speed on the rapidly growing cyber security job market. The guide is intended to provide enough “at-a-glance” information, but also give enough depth to be useful in finding the latest cybersecurity job opportunities.
#### In this guide

- Cyber security jobs demand

- Cyber security salary information

- Remote cyber security jobs

- Cyber security jobs and salaries

- [Top 10 highest paying jobs in cyber / information security](https://blog.upwardspiral.io/blogs/top-10-highest-paid-jobs-in-cyber)
### Cyber security jobs — A world of change
Looking for a job in cyber security? There are plenty available.
The industry is ideal for anyone who lives approaching new problems, embracing opportunity and tackling new, unique and evolving challenges. According to Cyber security ventures there will be approximately 3.5 million vacancies in the industry by the end of 2021. The Bureau of Labor Statistics (USA) estimates the demand for cyber security jobs will grow by as much as 31 percent over the next ten years.

It makes sense, the global spend on the information security sector is expected to exceed [US$150 billion](https://www.gartner.com/en/newsroom/press-releases/2021-05-17-gartner-forecasts-worldwide-security-and-risk-managem) in 2021. It seems logical that organisations will be recruiting help to manage these new solutions and finding that many people isn’t easy.
The cyber security job market has grown so rapidly over the past several years, that applicants are in a strong position with many options in front of them. A problem for businesses that is getting worse, as attracting and retaining talent becomes more and more difficult.


An entry-level cyber security job that is common in the profession is that of a [cyber security analyst](https://blog.upwardspiral.io/blogs/cyber-security-analyst-jobs) in a security operations center (SOC). Historically their career has progressed from here to senior security analyst or incident responder. Other opportunities for entry-level cyber security jobs include things like:

- Digital forensics analyst: working directly with both or either law enforcement and/or private firms to investigate cases.
- [Malware analyst](https://blog.upwardspiral.io/blogs/malware-analyst-jobs): A malware analyst is the [Hercule Poirot](https://en.wikipedia.org/wiki/Hercule_Poirot) of an organisation’s cyber security team. The role is unique within an organisation’s security, defensive techniques and security principles.

More commonly in recent times, cyber security jobs have become more focused on programming and software design. Opening opportunities for a career as a security software developer.

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [check out what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).
### Cyber security salary information
In 2020 the median pay of an entry-level cyber security job was $98,192 per year or $49.10 per hour. For context, the median annual wage in Australia is $90,329. 
The lowest paid 10 percent of cyber security workers earn $81,581 per year. The highest paid 10 percent of entry-level cyber security workers earn $116,204 per year or more. 

Several services provide detailed information about the salary for a cyber security professional, depending on which industry they’re from. These are the median annual wages for various industries, as measured in 2020. 

- Finance and insurance $142,439
- Computer systems design and related services $140,334
- Information technology $113,838
- Management of companies and enterprises $134,086
- Administrative and support services $132,366

As is the case in many industries, cyber security managers typically make more than cyber security technicians. According to Payscale the median annual salary for a computer and information systems manager is $201,450 per year. That equates to $96.86 per hour. 

The following five cities are the most sought after locations for cyber security jobs. Median salary is provided for each city.

- Canberra — $84,993
- Melbourne — $97,000
- Sydney — $79,689
- Perth — $92,750
- Brisbane — $91,580

### Remote cybersecurity jobs
Working from the comfort of one’s own home is the dream for many. For others, the flexibility to travel without having their job hold them back is where their heart is. Fortunately for those in cyber security, it’s possible to find a job that is either completely or partially remote that offers the flexibility to pursue these dreams.

This dream became an even more accessible reality given the world-changing events of 2019-2021. Demonstrating that in many areas, especially in the digital age, being tied to a desk in an office is completely unnecessary and often hinders success.

This luxury isn’t all-encompassing in the cyber security jobs space. For example, to operate as a penetration tester where testing physical controls is part of your role, evidently your presence on-site will remain a vital part of your role.

On the other hand, an individual tasked with reverse engineering a piece of malware may be able to do so from anywhere in the world. A lot of penetration testing - software style - also occurs remotely. Places like BugCrowd are an excellent example of such opportunities.

There are plenty of tools ranging from remote access software to virtual private networks, that allow professionals to be on their organisation’s network without physically being in the same geographical location. These tools are also being exploited by the broader software engineering community as remote work becomes increasingly popular as competition for talent increases.

Some job sites, [Upward Spiral](https://upwardspiral.io/) for instance, allow job seekers to search exclusively for remote work opportunities. This ensures only offers from companies willing to allow remote work are provided to the job seeker. Ensuring they are not locked into a specific working location.

Another option for remote work is freelancing. Working for an organisation permanently is not a good fit for everyone. Having the freedom to choose which projects you work on and having the ability to create your own schedule is a path many choose. Alternatively a role in independent consulting offers great levels of flexibility.

### Example cybersecurity careers with salaries 
 This section provides detailed salary statistics, including salary variations for particular roles.
The following are some of the most common job types within the field of cybersecurity, and their respective salaries. All information is provided by Payscale.

- **Cyber security incident responder** — In the event of a data breach or a hack the incident responder is the first person to get a call. An incident responder is responsible for identifying the scope of the attack and responding to it as quickly as possible. 
*Median annual salary — $116,500*
- **Security administrator** — A security administrator is responsible for maintaining the security and functionality of a company’s computer systems and networks. 
*Median annual salary — $85,000*
- **Security code auditor** — A security code auditor analyzes code to check for potential vulnerabilities. An auditor typically has extensive experience in programming and network infrastructure, and this is not an entry level position. 
*Median annual salary — $90,500*
### Top 10 [highest paying jobs](https://blog.upwardspiral.io/blogs/top-10-highest-paid-jobs-in-cyber) in cyber / information security
- **#10: Digital forensics analyst** - A digital forensics analyst gathers evidence off computers, networks, and other data storage devices for investigating instances of digital crime. 
*Median annual salary: $102,200*
- **[#9: Information security specialist](https://blog.upwardspiral.io/blogs/cyber-security-analyst-jobs)** - An [information security specialist](https://blog.upwardspiral.io/blogs/cyber-security-analyst-jobs) is an entry- to mid-level employee whose job functions help to strengthen the security of an organisation. Information security specialists often wear a lot of hats in an organisation or company. They are likely involved in security, system design, system policy, trainer, and educator. 
*Median annual salary: $106,000*
- **#8: IT security consultant** - An IT Security Consultant is an outside expert who helps an organization implement the best solutions according to their security needs. To be completely realistic, the duties performed are in-line with an information security specialist but include an added element of consultancy. 
*Median annual salary: $115,000*
- **#7: Penetration tester** - A Penetration Tester is responsible for probing applications, systems, and networks for vulnerabilities as a test of an organization’s digital security defenses. This role is highly sought after as it is a lot of fun. 
*Median annual salary: $119,500*
- **[#6: Malware analyst](https://blog.upwardspiral.io/blogs/malware-analyst-jobs)** - A [malware analyst](https://blog.upwardspiral.io/blogs/malware-analyst-jobs) is responsible for helping an organisation understand the ransomware, worms, bots, Trojans, and other malicious software that threaten its network on a daily basis. 
*Median annual salary: $127,000*
- **#5: Security engineer** - A security engineer is a mid-level employee who builds and maintains an organisation’s IT security solutions. In this capacity, security engineers configure firewalls, test new security solutions, and investigate intrusion incidents. 
*Median annual salary: $129,500*
- **#4: IT security manager** - An IT security manager is a mid-level employee who manages an organisation’s IT security policy. IT security managers are leaders, so to be successful, they must have strong interpersonal and communication skills. 
*Median annual salary: $156,000*
- **#3: IT security architect** - An IT security architect is a senior-level employee who is responsible for building and maintaining the computer and network security infrastructure for an organization. Security architects provide guidance to information technology (IT) security team members. They also lead IT analysts, security administrators, and security engineers to coordinate effective security protocols. Security architects also respond to security breaches. 
*Median annual salary: $171,400*
- **#2: Security director** - An information security director is someone who is responsible for implementing, designing, managing and allocating all the technology security measures within an organisation. A security director is a senior-level employee whose task is to oversee the implementation of all IT security measures throughout an organisation. 
*Median annual salary: $207,500*
- **#1: Chief information security officer (CISO)** - The CISO is a C-level management executive (sometimes slightly beneath the typical C-suite and resides under the CTO) whose primary task is to oversee the general operations of an organisation’s IT security department and other related staff. They are responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal and external threats. 
*Median annual salary: $225,700*

If you’re looking for a role in cyber security, be sure to apply for [Upward Spiral](https://upwardspiral.io/login) or [check out what we’re about](https://upwardspiral.io/blog/what-does-upward-spiral-do-exactly).

Cyber security jobs

### Why your next hire should be through a talent intelligence platform
If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.

### Making the right hiring decisions
Business leaders know very well how difficult it is to make the right decision when it comes to talent. They first need to understand their current workforce and the ways in which it needs to evolve to be successful, both today and going forward. They are then tasked with the ongoing struggle of finding the right people to execute against their vision.

Success in this area defines the trajectory of a business. So much so that the leaders in this field - Amazon, Google, Apple, etc - have created detailed processes to ensure they nail it. Amazon have gone so far as to develop specific programs to train their internal recruiters - “[bar raisers](https://blog.aboutamazon.eu/working-at-amazon/what-is-a-bar-raiser-at-amazon)” - and ensure they execute on Amazon’s vision for people.

> “*I’d rather interview 50 people and not hire anyone than hire the wrong person*.” - Jeff Bezos

The most successful businesses are passionate about finding the right person for the job. Hiring is something that must be taken seriously, and it has a broad and long-lasting impact on the livelihood, creativity and viability of the products and services a business provides. For these businesses, hiring velocity has become the metric of choice to track recruitment performance.

Hiring velocity measures one thing: The percentage of jobs filled on time. Hiring velocity answers the question asked at every growth organisation: are we able to hire the right people when we need them? Businesses that succeed look to talent intelligence platforms to make this possible.

### What is a talent intelligence platform?

Advances in computing power, data availability, and computing techniques make deep learning AI possible. Talent intelligence platforms are AI driven and help talent-acquisition and human-resources departments better source, screen and plan for their growth. Maintaining a healthy talent pipeline of potential candidates that can demonstrate improvements in hiring velocity metrics by up to 90%.

They achieve this by consistently improving three fundamental HR objectives for companies. First, they continually improve on their strict [talent pipeline](https://www.how-to-x.space/how-to-build-a-talent-pipeline/) framework that acquires vetted professionals and develops relationships to ensure these candidates are ready for their next opportunity. Second, their specialists continually assess the talent available to ensure it is diverse enough to address the needs of any company in the industry. Finally, they provide a great candidate experience to reduce turnaround time for your recruitment process.

#### Talent pipeline
The best thing any organisation can do is build a talent pipeline well before it is needed. Even before you have an open role. Since doubling down on proactive sourcing, the team at Shopify has scaled from 550 employees to more than 2,000 employees in only 3 years.
#### Talent assessment
Talent pipeline specialists will ensure the talent available is diverse enough to address the needs of any company in the industry. They consider:
- Do the levels of experience available meet the needs of companies within the industry?
What challenges might the candidates face, are they equipped to overcome those challenges and can we improve their performance?

- What new skills is each candidate looking to develop to further improve themselves?
 
- Do their personal goals align with those of companies within the industry?
Is the talent pool diverse?

#### Candidate experience
Top-tier candidates have many choices when it comes to where they want to work, and will pass on your opportunity if you have a tedious application process.

The median time from the moment a candidate enters a pipeline to when they’re hired is 34 days. This includes staying in contact with them, treating them well during interviews, and pre-closing them prior to submitting an offer.


Talent intelligence platforms like [Upward Spiral](upwardspiral.io/hire) keep the candidate engaged in the process, so your business can close quickly.

### Making the most of a Talent Intelligence Platform

In today's modern workforce decisions are increasingly backed by data, permitting companies and hiring managers to be confident in the efficacy of their [hiring decisions](https://theentrepreneur.space/getting-a-job-at-amazon-or-google/). [Upward Spiral](https://upwardspiral.io/hire) is the only platform in the information technology or information security space providing hiring managers and teams with direct access to a cohort of job-ready candidates; including a breakdown of their knowledge, skills, experience, and salary expectations. The platform leverages an underlying global data set to fully understand the availability, maturity, relevance, evolution of candidate skills and salaries throughout the global market.

In the transient worlds of information technology and information security where these valuable candidates are in increasing demand and change roles more frequently than ever, having access to a vetted pool of ready-to-sign candidates is critical for growth. Registering for a [talent intelligence platform](https://upwardspiral.io/hire) is free and you are immediately granted access to the talent pipeline. Allowing you to search through the entire candidate pool based on skills, knowledge, experience and salary expectations.

### The wrap up
Success in hiring defines the trajectory of a business. The most successful businesses are passionate about finding the right person for the job. Businesses that lead in the recruitment space rely on talent intelligence platforms to make this possible.

Talent intelligence platforms are AI driven and help talent-acquisition and human-resources departments better source, screen and plan for their growth. They demonstrate improvements in hiring velocity metrics by up to 90%. They achieve this by improving an organisation’s talent pipeline and candidate experience while continually assessing and improving the available talent.

This talent is available 24/7. With ~34 new candidates added monthly. Talent is also restricted from re-entering the pipeline for a period of 18 months. Ensuring hires you make through the platform will not be transient ones.

If you’re looking to hire in the space of information technology or information security, [Upward Spiral](https://upwardspiral.io/login) is the platform of choice. [Checkout what they can do for your business](https://upwardspiral.io/) before making your next recruitment decision.

Why your next hire should be through a talent intelligence platform

### Companies: Upward Spiral terms and fees
Signing up for Upward Spiral is free. We charge 10% of the candidates first year cost-to-company if you hire someone through Upward Spiral.

The fee is payable within 30 days of the start date. Practically our billing team will send you an invoice within the first week of the candidate starting at your company.

If things don't work in the first 3 months, we'll refund you the entire fee (i.e. a 90-day money-back guarantee).

If you haven't seen them already, here's a link to our [terms](https://upwardspiral.io/terms).

Earn rewards by referring Upward Spiral

Earn rewards by referring Upward Spiral

Frequently asked questions

Why should I join the Upward Spiral referral program?

How much will I earn for each referral eligible for payout?

How does it work?