The ultimate guide to landing a killer job before graduating

Some students graduate unemployed. Others graduate with fancy cyber jobs putting them in the top 2%, currently $81,300 at 22 years old in 2024. This guide marks the difference between these two outcomes. It's a combination of strategic wisdom and tactical steps to get you hired, whether you've already had three internships or are just starting out with zero experience.

Strategic themes

Perceptions > reality

People hire based on perceived expertise. The idiot from Harvard looks smarter than the genius from community college. Your overarching goal is to ensure your entire professional presentation (resume, interview skills, personal brand, etc) depicts you as knowledgeable in cyber, good at communicating, and eager to grow.

Action > worrying

The #1 stressor for students looking to get into cyber today is not knowing exactly what they want to do. (I know this because I've asked hundreds of students and they all say some variation of the same thing.) The root problem isn't in the not knowing. It's in the exactly. The need for certainty, and the anxiety that comes with it, is perhaps the most dangerous trap for students. Incident response or cyber operations? Cloud or digital forensics? Governance or government? Cyber is ginormous and it's easy to get lost. I see students agonize over these choices. It's not worth it. Remember, your goal is simply to be perceived as professionally knowledgable in cyber. As long as everything roughly points to cyber, you can tinker around the edges to present yourself in any way you need as your interests and skills evolve. You could spend years thinking about the exact right path for you, or you could just try something now. Actually doing something is always better than worrying about doing something. It's the only way to learn, it's the only way to grow. Your goal is to switch from a fear-based mindset to a curiosity-based mindset. Everyone's first few jobs are an experiment. Hypothesize and explore.

Avoid bad sources of guidance

Many professors have never had a "real" job in their life. Your parents learned how to make a resume in the fax machine era. Your guidance counselor probably thinks a SHA256 hash is a drug. Trust their career advice at your own risk. Instead, find mentors in the industry and develop a personal board of directors.

The tactical steps (subscribers only)

Your goal is to cultivate a perception of cyber expertise as quickly as possible. Let's breakdown how to get there, in a prioritized order and cute chart.

1. Professional experience: Nothing beats actual work experience for establishing yourself as a qualified candidate. I cannot emphasize this enough. Lust after certifications, good grades, or referrals all you want: companies want to see you've worked before. It's their #1 predictor of you being a successful employee. Your goal is to get professional experience on your resume as soon as possible.
2. Personal presentation: This can be summed up as: don't be sloppy. But it's more than that. Every email you send matters. The formatting of your resume matters. The timeliness of your replies matter. First impressions matter. Being on time matters. How you dress matters. Your LinkedIn profile matters. Being respectful and thankful matters. It may sound obvious, but I see so many students with stellar grades yet their resume is littered with typos. In most cases, you only have two opportunities to portray yourself to companies: resume and interviews. Prioritize them. The difference between a student who leaves interview prep to the last minute and one who practices (even just a little bit) is night and day. You could have everything else in this list and lose out because of a poor first impression.
3. Demonstrated skills: Here's where things get interesting, because it's entirely up to you. The secret is that it doesn't really matter how/which skills you demonstrate as long as they are obviously cyber adjacent. That being said, speaking at a conference is going to look cooler than simply taking a Python class. Here are the top ways to demonstrate skills in cyber, in no particular order. No need to do them all. Choose the ones where you personally stand out the most. If it's not fun, stop and do something else. The point of the following list is a starting point for two things: 1) learning what you actually like/are good at (i.e. your strengths), 2) making your resume more attractive while giving you interesting stuff to talk about in interviews. Don't do these things in a vacuum. Brag about 'em!
   1. CTFs: Go to CTFtime and compete in a CTF. If you can, win. Winners stand out. If you have no idea what a CTF is: Google it, find a guide, study, practice and then win. No one said this was going to be easy.
   2. Certifications: Ah, my favorite. Just kidding. Certs are generally overrated. They're often costly (in both time and money) and are practically the inverse of professional experience (the #1 thing you need) in that what most of them signal to a company is that you can read a study guide and do multiple choice. Some certs are certainly more attractive than others, but the notion they are a magic bullet is false. If you don't have/can't get any of the the other, more differentiated, stuff in this list or you're trying to make a pivot into cyber from something else: Ok, get Security+. Otherwise, the best thing you can do cert-wise is ask yourself "what am I getting this for?" If you don't have a solid, evidence-backed answer to that question, save your money. If you're looking for solid, evidence-backed answers to that question, peruse Reddit threads and join certification Discords to learn from actual people in the industry how different certs are perceived and in what circumstances they're valuable. Additionally, you can see for yourself how deep a rabbit hole this can be by looking at everyone's favorite (but overwhelming) cert resource: Paul Jerimy's roadmap. To summarize: any individual cert is only worth it if you have a reason to get it. Reason first, cert second.
   3. Personal brand: Students who run their own blogs or start their own YouTube channels look so damn cool. I'm not kidding. An employer looking for go-getters is going to take the kid with videos describing her Kali Linux lab over the kid with the perfect grades any day.
   4. Dev projects: If you can code, make a personal website and start publishing projects on GitHub. If you can't code, learn to code. Then again, even a website on something like Squarespace (no coding required) is better than no website at all. Wanna really look cool? Get a cute custom domain. If this is intimidating to you, Google a guide on how to publish a site on GitHub Pages, download a free template, customize it, boom, you have a nerdy, sophisticated website that will be free forever.
   5. Actual hacking: Finding your own CVE is sort of a mic drop situation. The people I've seen with CVEs on their resume go on to do incredible things in cyber. Join a bug bounty program, mess around. Even if you don't find anything reportable, simply listing the research you've done will make you stand out.
   6. Homelab: Hands down the best way to learn security tools is to get your hands dirty trying them yourself. Some students literally build Active Directory domains on virtual machines. Who says you can't be an enterprise administrator from your dorm? You could get a Raspberry Pi and set up PiHole and a VPN. Or buy a DigitalOcean droplet and follow a Linux server hardening guide. The sky's the limit!
   7. Self-paced learning: An afternoon on TryHackMe or Hack the Box will teach you more than almost any college class. And I mean more than just technical skills. It will also teach you about what you do and don't like, what you are and aren't good at. Remember, half the battle is reducing analysis paralysis and developing a professional narrative based on your own career hypotheses. Explore the stuff you find interesting!
4. Leadership experience: Leaders get hired easier, leaders get promoted faster, leaders get paid more. Become a leader. This could be TA'ing for your favorite cyber/cyber-adjacent class. This could be joining the executive team of your campus cyber club. Simply being a member is a step in the right direction, but if you really want to stand out (and gain invaluable experience) you gotta get on the executive board. Your school doesn't have a cyber club? Create it yourself. Easy shortcut to Founder/President on your resume. 🤘
5. Relationships and network: Everyone loves helping college kids. It's a little-known superpower more students should take advantage of. When a professional sends a cold email, everyone assumes he/she is selling something and ignores it. When a college student sends a cold email, it's an opportunity for someone to share their expertise. People love sharing their expertise. I include this as the last piece of the pyramid because it's not a fundamental requirement but a framework to live by. A mindset. A lifestyle. You want to unlock the best jobs? Develop relationships. You want the best mentorship? Develop relationships. You want to get promoted? Develop relationships. In other words, you should always be networking.

You don't necessarily need all five of the above categories in every situation, especially the younger you are. You will develop and strengthen them over time. Start early and pick your battles.

The super important stuff no one realizes until it's too late

1. On-campus recruiting is HUGE leg up, but easy to screw up:
   1. Understand what it looks like at your school. Get to know the companies that come to campus. Familiarize yourself with the process. Perhaps the best way to do this is make a friend with an upperclassman who can fill you in. They're literally experts. Utilize them.
   2. Find out the deadlines and actually follow them. The most tragic students I've encountered are the ones who missed their opportunity to follow the standard recruiting process. You don't want to be the kid who graduates without a job. Companies are practically foaming at the mouth to hire promising students. Don't let it pass you by.
2. Job descriptions are an incredible resource. I mean straight up going to LinkedIn, searching for the types of jobs you're interested in, and analyzing the responsibilities and requirements. There is literally no better place to determine what companies are looking for. A job description is them telling you! Find out what they want and give them that. Learn the skills they require. Tailor your resume to fit the language of the job description. It's insane to me that more people don't do this. You'll spend four years in college, supposedly preparing to get a job, and not look at the actual requirements for interesting jobs until the last second. If your goal is a successful career, shouldn't it be the other way around?
3. Your career center can help with your resume. They probably won't know cyber very well, so be cautious they don't lead you astray, but they're often an underutilized resource.
4. Actually go to campus recruiting events. Sensing a theme yet? It's incredible how many students overlook the power of the resources right in front of them. You want practice talking to recruiters? (A super valuable skill by the way.) Recruiting events are the perfect low pressure way to hone your elevator pitch and even to learn what's out there.

Where you can (and should) get creative

1. Professional experience doesn't have one, single definition. You need "work" on your resume so get it on there anyway you can. No one cares if you got paid, no one cares if it's a campus/work study job. I've seen gritty students create their own businesses and boom, now they have Founder/CEO on their resume. No one cares if your only client is your grandma. Reach out to your school's CIO/CISO and work on a project for them. Get a job at a campus IT department. Do research for a professor's company.
2. There is no excuse for not having demonstrated skills on your resume. It could be technical classes from college (kinda lame because any student can do that, but if that's what you've got, it's what you've got), it could be taking a free Python course, it could be attending a local cyber conference and participating in a workshop.

That's all for now. I intend to add to this guide and create additional sub-guides for some of the bigger pieces, like tailoring resumes, finding out what you want to do in the giant world of cyber, etc. If you found this useful, please share it! And if I left anything out or something is confusing, let me know!