It's time for your annual performance review. Your boss asks you to summarize what you've done over the past year. But last year was like... 12 months ago and you barely remember what you did this weekend.

With crappy or nonexistent evidence of your achievements, good luck getting the raise you hoped for.

Never rely on someone else to get what you want. That's the simple rule behind the concept of professional sunshine.

Sunshine is a document, an email folder, a note, for storing a record of your accomplishments. Complete a big project? Add a bullet to your sunshine. Get a shoutout from your boss? Throw it in your sunshine. Improve a process that helped the business but may not be obvious to everyone else? Write a quick blurb in your sunshine.

It's all too easy to move right onto the next thing. Next thing you know, it's May and all the cool stuff you did in January is a distant blur. Get into the habit of taking stock of all the things you're accomplishing. You may not ever use all the stuff you collect in your sunshine. But you'll be glad you have it for your performance review, your salary negotiation, and updating your resume.

You're doing great work. Don't leave it up to chance that the right people will notice.

Emily Dering is a Cyber Senior Manager at Capital One bank. In a fascinating example of mastering perceptions and exploiting leverage, Emily's never let her youth and relative inexperience hold her back.

I brought her on the Decrypt Cyber podcast to share her top strategies for being taken seriously early in your career.

Emily's Top 3:

1. Come with solutions instead of problems
2. Become the champion of your own career
3. Strategically raise your hand to build your brand

We also discuss how the Big 4 (Deloitte, PwC, EY, and KPMG) can be career playgrounds for you to explore and learn your strengths while establishing your credibility at a name brand.

Listen here.

It's easy to get it backwards, to start sending out job applications before you know two things:

1. What you want
2. What they want

#1 comes first, but #2 is ultimately more important. When you send out an application before answering these questions, you're sending your app into the wind. You're throwing mud at the wall and hoping some sticks. I've seen people send out hundreds, even thousands, of applications and get nowhere while thinking they're making progress the entire time.

Don't confuse effort with achievement. Sending out a ton of applications rarely gets you anywhere if you haven't answered these two questions.

#1 What you want

This isn't some grandiose thing. It's not an intellectual exercise. You don't need a cabin in the woods alone with your thoughts to figure this out.

As the marvelous Amy Krouse Rosenthal said:

What's already interesting? Super technical red team stuff? Do more of that. Cyber compliance? Explore it! Consulting seems intriguing? Dig in.

Even people who have no clue what they want to do still pay attention to some things more than others. Start there.

As difficult as it is, it pays to be specific. And being specific means closing doors. This reduces the total number of opportunities while amplifying the chance of landing the ones that truly fit you well.

Almost every student starts out with the inverse perspective. They want to keep all their doors open. The problem with this perspective is not choosing often means not trying. And without trying how are you ever going to validate what you like and what you're good at? Choose, try, repeat. Viewing life as one big experiment takes a lot of the edge off. In an experiment you're not expected to get it right 100% of the time. It's called trial and error for a reason.

"What you want" isn't forever. It's a hypothesis based on an educated guess. What can you do now to grow and set yourself up for the future? Trying and learning is always better than waiting and worrying.

#2 What they want

You've got your guess, your thesis, for a role, industry, or company you want to explore. It's no longer about you at this point. It's all about them. It's about figuring out what that role/industry/company expects from top candidates. Once you've figured out what they want, give them that.

Thankfully they make it super easy. Companies tell you precisely what they're looking for in the form of job descriptions. It's literally as simple as searching LinkedIn for a bunch of roles as specifically tied to #1 (your thesis) as possible. You want to filter as much as you can. By location, industry, title, company, etc... Once you've found a bunch, study them. Paste the requirements and responsibilities in a separate doc and analyze for patterns. What do they emphasize? What do they leave out?

The better you understand what companies are looking for, the better you craft your professional narrative to fit what they're expecting. The better you fit what they're expecting, the faster you move to the top of the applicant pile. There's no room for guesswork or assumptions when you do this research. No more applications sent out into the ether with your fingers crossed.

The cool part is your professional narrative is entirely up to you. There are no rules. People who take their careers seriously craft their own stories. Don't leave it up to the recruiter to hopefully see your resume through a compelling narrative. Construct the narrative yourself.

Your resume needs to give them what they're looking for. No more, no less. Any line that doesn't speak to the identified expected patterns needs to change or be deleted. There's no room for mixed messages on a document that's skimmed for six seconds.

The number of college students who take the time to look at job descriptions before writing their resume is staggeringly low, close to zero. When looking for a job, they're one of the only things that concretely matters.

To ignore them is delulu.

Most students are terrified of the recommendations in this post. That's why they're recommended. Doing things that scare most people is a surefire way to stand out and get ahead.

The earlier you discover the power of a strong professional network, the earlier your career enters the stratosphere. As a student, you are in the strongest position to grow your network known to modern science. Why? Everyone loves helping college kids.

To the outside world, college kids are naive, adorable little creatures who play "TikTok" and eat Tide Pods. Adults can't help but give you guidance. For the overworked professional, the chance to help out a student can be a refreshing break in their monotonous day.

This is in stark contrast to everyone else who tries to get the attention of the full-time professional. Spammers, scammers, sales folk. The average cyber manager is drenched in requests for their attention. Startups looking for partners, big companies looking to win contracts, Steve from accounting, the list goes on. Cyber managers despise this. In general, these types of attention grabbers are extremely annoying.

But college students? Harmless. Simply because you're not selling anything! I point this out because almost every student who hears this message is surprised or doubtful. They think reaching out to strangers is annoying, demanding, rude. Sigh... I get it, but no. When done respectfully, it's exactly the opposite.

Every non-asshole* in cyber is genuinely excited to help college students. That doesn't mean they're gonna have all the answers, or that they're going to respond to all your messages, or that they're going to reply in a timely fashion. But it does mean they are NOT offended that you reached out. Respectful communication is respectful.

So what to do? Send out a ton of LinkedIn connection requests and cold emails. It's that simple. Your four years in college are a golden opportunity to grow your network. You're never going to have an easier time in your entire life getting people to share their wisdom with you. Don't pass it up.

Send out cold messages that get interesting people on the phone. Who counts as interesting? Anyone doing things you're interested in. Use cold messages to:

• Learn about internships
• Talk to recruiters
• Practice pitching yourself
• Understand the industry better
• Refine your career goals
• Validate if you're a good fit for a particular role
• Learn about individual company cultures
• Understand the recruiting process for your dream jobs
• Connect with school alumni who love to give back

You're going to learn more in a 30 minute call with an expert in the field than you ever could by anxiously spiraling in your head or talking with your kind but clueless relatives.

Don't know how to craft a cold message? Here's are two excellent examples. Because most folks are terrified of it, most folks suck at it. Follow these templates and you'll blow people away with your maturity and thoughtfulness.

LinkedIn connection request:

Cold email:

Why do these work so well?

• Respectful tone
• Short and clear
• Catchy subject line
• Direct, thoughtful questions
• Specific times in their timezone (this is SO underrated)
• Your phone number

This template waves goodbye to the back-and-forth scramble of settling on a time and then realizing neither of you have the other's phone number at the last minute. A busy professional only has to send one message: "Sure, let's chat Thursday at 9" and boom, you've just grown your network.

Recognize your power as a harmless, eager-to-learn student. Be confident and respectful. Help them help you. Eat up.

Some students graduate unemployed. Others graduate with fancy cyber jobs putting them in the top 2%, currently $81,300 at 22 years old in 2024. This guide marks the difference between these two outcomes. It's a combination of strategic wisdom and tactical steps to get you hired, whether you've already had three internships or are just starting out with zero experience.

Strategic themes

Perceptions > reality

People hire based on perceived expertise. The idiot from Harvard looks smarter than the genius from community college. Your overarching goal is to ensure your entire professional presentation (resume, interview skills, personal brand, etc) depicts you as knowledgeable in cyber, good at communicating, and eager to grow.

Action > worrying

The #1 stressor for students looking to get into cyber today is not knowing exactly what they want to do. (I know this because I've asked hundreds of students and they all say some variation of the same thing.) The root problem isn't in the not knowing. It's in the exactly. The need for certainty, and the anxiety that comes with it, is perhaps the most dangerous trap for students. Incident response or cyber operations? Cloud or digital forensics? Governance or government? Cyber is ginormous and it's easy to get lost. I see students agonize over these choices. It's not worth it. Remember, your goal is simply to be perceived as professionally knowledgable in cyber. As long as everything roughly points to cyber, you can tinker around the edges to present yourself in any way you need as your interests and skills evolve. You could spend years thinking about the exact right path for you, or you could just try something now. Actually doing something is always better than worrying about doing something. It's the only way to learn, it's the only way to grow. Your goal is to switch from a fear-based mindset to a curiosity-based mindset. Everyone's first few jobs are an experiment. Hypothesize and explore.

Avoid bad sources of guidance

Many professors have never had a "real" job in their life. Your parents learned how to make a resume in the fax machine era. Your guidance counselor probably thinks a SHA256 hash is a drug. Trust their career advice at your own risk. Instead, find mentors in the industry and develop a personal board of directors.

The tactical steps (subscribers only)

Your goal is to cultivate a perception of cyber expertise as quickly as possible. Let's breakdown how to get there, in a prioritized order and cute chart.

1. Professional experience: Nothing beats actual work experience for establishing yourself as a qualified candidate. I cannot emphasize this enough. Lust after certifications, good grades, or referrals all you want: companies want to see you've worked before. It's their #1 predictor of you being a successful employee. Your goal is to get professional experience on your resume as soon as possible.
2. Personal presentation: This can be summed up as: don't be sloppy. But it's more than that. Every email you send matters. The formatting of your resume matters. The timeliness of your replies matter. First impressions matter. Being on time matters. How you dress matters. Your LinkedIn profile matters. Being respectful and thankful matters. It may sound obvious, but I see so many students with stellar grades yet their resume is littered with typos. In most cases, you only have two opportunities to portray yourself to companies: resume and interviews. Prioritize them. The difference between a student who leaves interview prep to the last minute and one who practices (even just a little bit) is night and day. You could have everything else in this list and lose out because of a poor first impression.
3. Demonstrated skills: Here's where things get interesting, because it's entirely up to you. The secret is that it doesn't really matter how/which skills you demonstrate as long as they are obviously cyber adjacent. That being said, speaking at a conference is going to look cooler than simply taking a Python class. Here are the top ways to demonstrate skills in cyber, in no particular order. No need to do them all. Choose the ones where you personally stand out the most. If it's not fun, stop and do something else. The point of the following list is a starting point for two things: 1) learning what you actually like/are good at (i.e. your strengths), 2) making your resume more attractive while giving you interesting stuff to talk about in interviews. Don't do these things in a vacuum. Brag about 'em!
   1. CTFs: Go to CTFtime and compete in a CTF. If you can, win. Winners stand out. If you have no idea what a CTF is: Google it, find a guide, study, practice and then win. No one said this was going to be easy.
   2. Certifications: Ah, my favorite. Just kidding. Certs are generally overrated. They're often costly (in both time and money) and are practically the inverse of professional experience (the #1 thing you need) in that what most of them signal to a company is that you can read a study guide and do multiple choice. Some certs are certainly more attractive than others, but the notion they are a magic bullet is false. If you don't have/can't get any of the the other, more differentiated, stuff in this list or you're trying to make a pivot into cyber from something else: Ok, get Security+. Otherwise, the best thing you can do cert-wise is ask yourself "what am I getting this for?" If you don't have a solid, evidence-backed answer to that question, save your money. If you're looking for solid, evidence-backed answers to that question, peruse Reddit threads and join certification Discords to learn from actual people in the industry how different certs are perceived and in what circumstances they're valuable. Additionally, you can see for yourself how deep a rabbit hole this can be by looking at everyone's favorite (but overwhelming) cert resource: Paul Jerimy's roadmap. To summarize: any individual cert is only worth it if you have a reason to get it. Reason first, cert second.
   3. Personal brand: Students who run their own blogs or start their own YouTube channels look so damn cool. I'm not kidding. An employer looking for go-getters is going to take the kid with videos describing her Kali Linux lab over the kid with the perfect grades any day.
   4. Dev projects: If you can code, make a personal website and start publishing projects on GitHub. If you can't code, learn to code. Then again, even a website on something like Squarespace (no coding required) is better than no website at all. Wanna really look cool? Get a cute custom domain. If this is intimidating to you, Google a guide on how to publish a site on GitHub Pages, download a free template, customize it, boom, you have a nerdy, sophisticated website that will be free forever.
   5. Actual hacking: Finding your own CVE is sort of a mic drop situation. The people I've seen with CVEs on their resume go on to do incredible things in cyber. Join a bug bounty program, mess around. Even if you don't find anything reportable, simply listing the research you've done will make you stand out.
   6. Homelab: Hands down the best way to learn security tools is to get your hands dirty trying them yourself. Some students literally build Active Directory domains on virtual machines. Who says you can't be an enterprise administrator from your dorm? You could get a Raspberry Pi and set up PiHole and a VPN. Or buy a DigitalOcean droplet and follow a Linux server hardening guide. The sky's the limit!
   7. Self-paced learning: An afternoon on TryHackMe or Hack the Box will teach you more than almost any college class. And I mean more than just technical skills. It will also teach you about what you do and don't like, what you are and aren't good at. Remember, half the battle is reducing analysis paralysis and developing a professional narrative based on your own career hypotheses. Explore the stuff you find interesting!
4. Leadership experience: Leaders get hired easier, leaders get promoted faster, leaders get paid more. Become a leader. This could be TA'ing for your favorite cyber/cyber-adjacent class. This could be joining the executive team of your campus cyber club. Simply being a member is a step in the right direction, but if you really want to stand out (and gain invaluable experience) you gotta get on the executive board. Your school doesn't have a cyber club? Create it yourself. Easy shortcut to Founder/President on your resume. 🤘
5. Relationships and network: Everyone loves helping college kids. It's a little-known superpower more students should take advantage of. When a professional sends a cold email, everyone assumes he/she is selling something and ignores it. When a college student sends a cold email, it's an opportunity for someone to share their expertise. People love sharing their expertise. I include this as the last piece of the pyramid because it's not a fundamental requirement but a framework to live by. A mindset. A lifestyle. You want to unlock the best jobs? Develop relationships. You want the best mentorship? Develop relationships. You want to get promoted? Develop relationships. In other words, you should always be networking.

You don't necessarily need all five of the above categories in every situation, especially the younger you are. You will develop and strengthen them over time. Start early and pick your battles.

The super important stuff no one realizes until it's too late

1. On-campus recruiting is HUGE leg up, but easy to screw up:
   1. Understand what it looks like at your school. Get to know the companies that come to campus. Familiarize yourself with the process. Perhaps the best way to do this is make a friend with an upperclassman who can fill you in. They're literally experts. Utilize them.
   2. Find out the deadlines and actually follow them. The most tragic students I've encountered are the ones who missed their opportunity to follow the standard recruiting process. You don't want to be the kid who graduates without a job. Companies are practically foaming at the mouth to hire promising students. Don't let it pass you by.
2. Job descriptions are an incredible resource. I mean straight up going to LinkedIn, searching for the types of jobs you're interested in, and analyzing the responsibilities and requirements. There is literally no better place to determine what companies are looking for. A job description is them telling you! Find out what they want and give them that. Learn the skills they require. Tailor your resume to fit the language of the job description. It's insane to me that more people don't do this. You'll spend four years in college, supposedly preparing to get a job, and not look at the actual requirements for interesting jobs until the last second. If your goal is a successful career, shouldn't it be the other way around?
3. Your career center can help with your resume. They probably won't know cyber very well, so be cautious they don't lead you astray, but they're often an underutilized resource.
4. Actually go to campus recruiting events. Sensing a theme yet? It's incredible how many students overlook the power of the resources right in front of them. You want practice talking to recruiters? (A super valuable skill by the way.) Recruiting events are the perfect low pressure way to hone your elevator pitch and even to learn what's out there.

Where you can (and should) get creative

1. Professional experience doesn't have one, single definition. You need "work" on your resume so get it on there anyway you can. No one cares if you got paid, no one cares if it's a campus/work study job. I've seen gritty students create their own businesses and boom, now they have Founder/CEO on their resume. No one cares if your only client is your grandma. Reach out to your school's CIO/CISO and work on a project for them. Get a job at a campus IT department. Do research for a professor's company.
2. There is no excuse for not having demonstrated skills on your resume. It could be technical classes from college (kinda lame because any student can do that, but if that's what you've got, it's what you've got), it could be taking a free Python course, it could be attending a local cyber conference and participating in a workshop.

That's all for now. I intend to add to this guide and create additional sub-guides for some of the bigger pieces, like tailoring resumes, finding out what you want to do in the giant world of cyber, etc. If you found this useful, please share it! And if I left anything out or something is confusing, let me know!

I met a friend at a corporate training once who told me she tries to do one interview per month. I thought she was crazy.

• Isn't it disingenuous to interview for positions you're not actually interested in??
• Aren't you burning bridges if you ultimately walk away?
• What happens if they give you an unexpectedly awesome offer??

Years later, it became clear to me I was looking at it backwards. She's a genius.

Interviewing once a month is the ultimate career flex.

Evaluating different opportunities keeps your career strategy mindset constantly engaged

I was afraid of damaging relationships or looking dumb if I interviewed at places I wasn't interested in. This is the wrong way of looking at it. Apply to roles you're genuinely interested in, even if you think there's no way you'd actually take the job. Sending out applications on a regular basis is the only way to truly stay on top of the market. Cyber career strategist Jason Blanchard spends 15 minutes job hunting every day, even while he's employed at a job he enjoys. Doing so keeps you constantly exposed to the skills and requirements needed for the jobs you're seeking. And it ensures you're always aware of the evolving opportunities that are out there.

Got an interesting LinkedIn message from a recruiter? Call them back!

See an intriguing role open up at a company you've always admired? Apply!

Occasionally applying to jobs forces you to keep your resume up to date

Most people only update their resume once they're desperate for a new job, a great way to ensure your resume sucks when you need it most. Consistently interviewing means your resume is updated at all times. You'll be looking at it a lot more, refining how you portray your story and experiences, versus the person who throws it all together at the last minute and hopes for the best.

Having an updated resume is powerful. Applying to jobs while you're employed is an amazing, pressure-free way to experiment. You can try out different variations of your resume and apply to roles at different levels. The only way to know what works and what doesn't is to try!

The best way to get better at interviewing is to... interview

You’d think this is obvious, but it’s not. Without dedicating time to interview practice, you're likely terrible at interviewing. Even if you think you're a pretty good interviewer, I guarantee there are things you can improve. Presenting yourself professionally and being able to confidently express your story and achievements is a super power. Hone it.

Without practice, how can you be sure you're any good?

Mock interviews are great, but nothing substitutes for the real thing. You can't simulate nerves and anxiety. After doing a bunch of interviews you'll be amazed at the boost to your self confidence. Even "failing" an interview is invaluable. It stings in the moment, but you walk away with such clarity on what to prioritize and focus on.

Another HUGE benefit is the boost to your negotiation skills. Having the "compensation conversation" is terrifying. Until you've done it a bunch of times. After enough practice it becomes no big deal and you'll walk through it effortlessly. Remember, recruiters have these conversations all day long. How do you stand a chance if you don't also have some practice under your belt?

Interviews are never a waste of time

I used to be afraid of wasting my time and the company's time by interviewing when I wasn't "looking" for a job. I had to get over this mindset. Interviewing is inherently valuable.

• It's a chance to explore a new company and learn about their product, culture, mission, etc
• It's a chance to meet new people (a good interview could lead to a future mentor!)
• You're evaluating them as much as they're evaluating you.

The last point is critical and it's key to why interviewing often is a great idea. I used to have the flawed notion that I was only interviewing if I knew I wanted the job. This mindset keeps you too attached to each individual opportunity and holds you back. There's a reasonably low chance you'll get any particular job. Don't get attached. Each interview is a chance to learn as much about the company and role as possible.

You're not interviewing because you know you want to work there. You're interviewing to find out if you want to work there.

Make it a habit!

You've been following Decrypt Cyber long enough to know finding and staying in touch with mentors is the #1 career hack. But once you get someone on the phone, what do you talk about?

I recently heard a story about someone who Googled "questions to ask during interview" and I immediately felt sorry for them. Good luck standing out, making an impression, and developing an authentic connection with a stranger if your questions came from a generic, SEO-optimized blog post likely written by ChatGPT...

A few guidelines to keep in mind for every networking phone call:

• Always come with questions prepared: You need a pre-written list of questions in front of you before you pick up the phone. This forces you to approach the conversation deliberately and reduces the chances of awkwardness or wasted time.
• Send some of the topics/questions ahead of time in the invite: You're already writing up questions ahead of time, so why not share them? In fact, it's often to your advantage to share them ahead of time because it makes you appear thoughtful and intentional. Everyone hates a meeting invite with no agenda. At the very least, it will make you stand out because almost nobody else does this.
• Keep the questions limited to what you're genuinely interested in learning about: This is why it saddens me to see someone taking questions from whatever happened to be at the top of Google. The best questions are authentic. They don't come from someone else. They come straight from your own curiosity. What are the burning things on your mind? What have you always wondered about? What have you been afraid to ask? Those are starting points for good, genuine questions.
• Never ask questions that are easily Googleable or available on the company's website: It makes you sound naive and is a waste of time for everyone involved. Not a good look. Instead, take a peek at the company's website and ask questions about things you can't find answers to there. Many websites are just surface-level marketing. Use the buzzwords to inspire questions that dig deeper.
• Don't be afraid to ask questions about them as individuals: Most coffee chats cover the same boring topics. "What does your typical day look like?" or "where do you see the industry going in five years?" So boring! Everyone asks these. Instead, construct questions that engage the other person to think critically and creatively about their own lives. These questions can get a bit vulnerable. That's the point. Vulnerability, invoked in a respectful and curious manner, is a source of genuine connection.

Ok, now that I've convinced you to avoid the lazy route of other people's questions, I'll share some that have worked for me. 😉

• Why are you in your position and not others?
• What are some of your favorite parts of your job?
• What would you change about the company if you were queen/king for a day?
• What makes you sigh at the end of the day?
• What are some of the most stressful parts of your job?
• What annoys you?
• What do people get wrong about your role?
• What makes someone successful in your role?
• What gets you super excited about the industry?
• What are some surprising things you've learned between when you started and where you're at now?
• What are some previously held notions or ideas about the job/company/industry you've since changed your mind on?
• What would you go back and tell your younger self?
• What do you regret about your career?
• What do you think you've done really well in your career?

But there's still something missing from the questions above: SPECIFICS. It's worth Googling the person/finding them on LinkedIn and perusing their entire work history.

• Maybe you both went to the same school
• Maybe you both grew up in the same area
• Maybe you just went on a vacation to their home state
• Maybe your favorite sports team is based in the city they work in
• Did they have an interesting first job? Second job? Third job?
• Have they published anything? Go read it.
• Have they spoken at a conference? Go watch the recording.

Noticing the above details helps you construct a conversation that sparks connection. It shows a genuine interest in the other person which is the strongest way to build rapport.

Some of my strongest professional relationships, ones that have lasted years, were born out of a single phone call where the other person felt like I had "done my homework." Like discovering an executive published a book on a super nerdy topic 30 years ago. No one else knew this guy had written a book. He was delighted and impressed that I brought it up. Doing your homework is rare. Those who do it stand out. Effort is salient.

Do your homework.

I recently had a call with a scared college junior. She felt she was falling behind, like she was struggling to keep up. Everyone around her had a job lined up. Everyone else had their life figured out. I called BS.

It's a common trap everyone gets stuck in at one point or another. You can either let the trap hold you back, or you can wriggle yourself free. By the end of the phone call, she had chosen option two and was excited for her future.

Why was she so scared?

• She had gotten rejected from her top-choice companies.
• She wasn't sure what she wanted to do with her life.
• She was anxious about her unconventional background.
• She didn't think she was reaching her full potential.

Pathetic right? It's tragic nobody can relate to this poor young woman. Especially you. You've never been rejected. You're 100% sure you're on the right path. You're confident your life is as great as it could possibly be.

The Trap

She had built a narrative in her head, coming up with every reason to think poorly of herself. She was an expert in self-delusion, with lines like "Everyone has a great job lined up." I cut her off. Sorry, but that's objectively false. Everyone? Many people never even get the opportunity to go to college, much less a college like the fancy one she's at. And over 40% of recent graduates are underemployed, working in a job that doesn't even require a bachelor's degree.

"Ok fine, but I feel like I don't know what to do with my life." This one is probably my favorite because it's universal, yet everyone seems to think it's unique to them. I remember meeting a multimillionaire business owner at a conference who told me he still has days when he's anxious about being on the "right" path in life. He said it never goes away, that he's just winging it.

The girl on the phone asked if I personally ever felt that way.

ALL. THE. TIME.

She was shocked. She assumed that because I have a reputable job and a blog I must have it all figured out. I laughed. Nothing could be further from the truth. I'm just as terrified as she is. Deep down, I have no idea what I'm doing.

I have an awful relationship with uncertainty. Am I living in the right city? Am I in the right career? Am I spending my time the right way? I even ask this about fun stuff, like am I watching the right movies or reading the right books. I'm still working my way through Red Dead Redemption 2 despite loving the game since I bought it over four years ago. It's exhausting. I'm doing the best I can (shout out therapy) and I get a little better each day at recognizing more uncertainty means less I can control, and the less I can control, the less I can possibly worry about.

The woman on the phone told me she had an unconventional background that set her apart. (Born in a foreign country, woman studying engineering.) In the next breath she told me she was falling behind the traditional path. These two ideas are fundamentally incompatible. You can't acknowledge your uniqueness and expect to follow a traditional path at the same time. You're writing your own story. Everybody is. If the people around you make you feel bad about your path, you may be hanging with the wrong people. Any negative voice like that (the one in your head is often loudest) is a hater. It's all noise. No need to listen to haters.

When we dug into it, she had lots to be excited about.

• She was anxious she hadn't gotten a job. There's still an entire year before college is over. Are you quitting now? Don't count yourself out. She later admitted she literally had an interview the next day with a prestigious consulting company. Even people with amazing opportunities get scared sometimes.
• She was worried if she didn't get a job lined up she'd be toast. This is interesting because when I asked what she'd do in that case, she had a great plan for a startup she'd start with a friend. Amazing. Likely, the startup will totally fail, but the skills she'll build will last a lifetime and I guarantee it'll be the #1 thing people ask her about in future interviews. "Whoa, tell me about the time you were founder/CEO!"

The Truth

• There's always going to be the person who's more X than you. Fill in the blank.
  • Someone who appears to have it more figured out. Someone who got the promotion faster. Someone who simply makes you feel bad about yourself. You can either focus on their success and how you supposedly don't measure up, or you can focus on living your own life. The grass is always greener on the side fertilized with bullshit. We're all gonna die. Live while you can.
  • This can be really flippin’ hard though. I wrote the first draft of this article, then a few days later listened to a podcast that had me reeling from self-doubt. After listening to this young investor confidently discuss things like procrastination and finding your calling, I was convinced I was falling behind. I was panicking about my current path not being bold enough. Then I spoke with a friend who pointed out podcasts like this are essentially PR pieces designed to make people look like geniuses and that I alone get to decide what "enough" is in my life. I calmed down. Thanks homie. I include this anecdote because I think it’s hilariously ironic that after writing over 1000 words about not getting stuck in mental narratives and not comparing yourself to others, I fell in the same trap after hearing one polished interview. We all get knocked down sometimes.
• A little bit of gratitude goes a long way (with mountains of scientific evidence backing this up)
  • I keep a weekly gratitude journal, spending just a few minutes each Monday writing a few sentences on two things I’m grateful for from the week before. Sometimes it’s people, relationships, chance occurrences, good weather, etc. Anything that brings a smile to my face. One time I wrote about the beautiful view out of the window in an airplane bathroom. I had never seen a window in an airplane bathroom before and thought it was magical. I had been grumpy during the entire flight until that little window brought some sunshine into my life.
• What's in your head is just that: in your head.
  • Everything that's not directly in front of you, in this very moment that you're experiencing now, is just something you're thinking about. Nothing more. It's really easy to convince ourselves of things. We're not good enough. We're not successful enough. We're not trying hard enough. Says who? It's your life. You set the bar. Want to get better at recognizing the nature of your mind and thoughts? I like the 30 day mindfulness course on Sam Harris's app. I've done it twice. The first time I failed miserably. How do you fail at a mindfulness app? Good question for a future post...
• No one is 100% confident at all times that they’re on the right path for their life.
  • Read that again, slower. Take a deep breath and read it once more. It's the most true thing I've ever written. But a lot of students and young professionals don't believe it. Yet. The sooner you recognize the truth there, the sooner you're out of the trap.

It's never just you

Last year, I took students out to dinner and witnessed a beautiful moment between two roommates. One of them opened up about his fears. They were similar to the ones covered in this post. The other roommate was stunned. He saw his friend as the model student: super involved in clubs, great grades, a whiz at time management, gunning for highly selective jobs, etc. He saw himself as confused, uncertain, anxious, lazy. He couldn't believe his friend was scared too. He had been comparing himself to his friend, assuming the other guy had it all figured out. They had been sleeping within mere feet of each other for months, but never were open about their feelings.

At the moment of truth, they almost cried. (Everyone wanted them to, but you can only ask so much of young men. Sigh.)

Bravery isn't the absence of fear. It's recognizing the fear and not letting it stop you.

Afraid to jump? Jump afraid.

Decrypt Cyber's rocket fuel for cyber students has helped hundreds finesse their resume, ace their interviews, and network like pros. But even rocket fuel has a secret ingredient: you.

We need your help to spread the word and take Decrypt Cyber to the moon. We're looking for ambitious students on campuses around the world to introduce their peers to the Decrypt Cyber fam.

The next few months have a TON of new content to look forward to, including:

• The Only Guide to the Cyber Industry You'll Ever Need
• The Path to the 2%, or why some students graduate unemployed while you'll graduate with a 98th percentile income
• An interview with a kid who has 16 certifications (and how he feels about them)

Join us, won't you? I'll buy the first Ambassador to get 100 sign ups a pair of AirPods Pro (or something similar if you hate Apple stuff or already have 'em). I'm dead serious. 💀 Apply today!

Who should you network with? "Everyone!" is ideal but not sustainable or efficient. To optimize your networking you need to understand the Power-Energy Continuum, a term I just made up describing a phenomenon I've witnessed for years.

The term refers to the spectrum representing the people you reach out to. The more senior the person's role, the less time they have to support you. They'll be well connected, have lots of authority, and unmatched wisdom. But all of the authority comes with responsibility, stress, and an overflowing calendar. They'll have more power, but less energy.

Junior folks are the opposite. They won't have the same level of insight, wisdom, or experience, but they'll be much easier to get on the phone. They have more energy to help you, but less power to connect you with others or get you hired.

The trick is being comfortable with both and knowing when to utilize each side of the spectrum

Many people want to shoot straight for the top. They'll confidently reach out to the hiring manager, or the VP, or even the CEO. This approach can work wonders, but it overlooks the likelihood that someone lower in the organization may actually be able to help you more. What about the intern from last year? Or the most recent hire in the division you're trying to get into? Those folks are likely to be a fountain of information. It'll be easier to reach them, they'll be more responsive, and they'll have more time to talk.

On the other hand, many others are terrified of networking with powerful people. The reality is, powerful people are people too. Candor and willingness to learn goes a long way in these conversations. You just need to be extra diligent about how you interact with them. Being punctual and having thoughtful questions are table stakes. The more senior, the more likely they are to ignore your messages or not get back to you. They simply don't have the time. This is why it's important to follow the Three Rules of Reaching out to Strangers to maximize your chances of landing a conversation.

Ultimately the goal is to have people in your network at every level: junior, senior, and executive. But you have limited time and should focus on making connections with the people who are going to help you the most. Getting on the phone with an executive can be invaluable, but it also often takes weeks to get on the calendar, and it's common to get cancelled/rescheduled last minute.

Here are three categories of people who can make excellent mentors and sources of info, despite being lower in the org chart:

• Recruiters: they interact with more candidates and hiring managers than anyone else in the organization. Don't underestimate their knowledge.
• The interns from last year: This is my favorite from the left side of the Continuum because they're the most overlooked experts. The people who got the job you're looking for immediately before you are the world's foremost authority on what it takes to get that job. They'll know the application, interview process, and experience on the job inside and out. Talk to them.
• Young alumni from your school or a previous job: Like the interns from the previous example, these folks too are especially qualified to guide you because they're directly ahead of you on the journey. And they're more likely to lend a hand because of the connections you share.

The key takeaway of the Power-Energy Continuum when efficiently allocating your networking effort is to take a step back and evaluate all the potential sources of the information you're looking for. If you can get on the phone with an executive, awesome, otherwise the recent grad is likely to help you more, faster.

Sully Vickers is (was?) terrified of public speaking. So he applied for and spoke at a cyber conference. A master of diving into challenge, Sully has turned his youth into an asset, even landing a job before the company could legally hire him.

The first episode of the Decrypt Cyber podcast features Sully's strategies for facing his fears and getting people to take him seriously even when he's the youngest in the room.

We discuss:

• How to turn cybersecurity executives into personal mentors
• What it means when people ignore your emails
• How he found out what he wants to do in his career (hint: he hates Wireshark)

Before starting college Sully, has spoken at conferences, been sponsored to travel nationwide for cyber events, and built a powerful contact list of cyber execs he considers friends. Listen now on Spotify or Apple Podcasts!

The National Cyber Scholarship Foundation gives out over $14 million in training each year. To get your slice of the pie you need to become a Scholar ($3k of free training) or a Scholar with Honors ($5k of free training).

What the free training includes:

• Scholars:
  • SANS Foundations course
  • GIAC GFACT exam attempt
• Scholars with Honors:
  • All the above and:
    • $500 cash
    • Additional SANS training
    • GIAC GSEC or GCLD exam attempt

GIAC is a globally-recognized, industry-trusted certification organization with dozens of certs ranging across each infosec domain.

The GFACT is a foundational certification, meaning it's for people relatively new to cybersecurity. It's not extremely challenging, yet it is an incredible way to signal your skill, passion, and commitment to recruiters. I've even had recruiters outside of cybersecurity be impressed to see it on my resume.

There are many ways to qualify as a Scholar. As a college student, I qualified through Cyber FastTrack. There is separate program for high schoolers.

To get the Scholar designation you need to score high enough in the gamified CTF challenges (the threshold changes year to year).

To get the Scholar with Honors designation you need to pass a higher score threshold and have passed the GIAC GFACT exam.

Because becoming Scholar with Honors requires you already have the certification, it typically takes two years in the program to qualify. However, you can qualify in just one year if you score in top 50% of Scholars who passed the GFACT exam.

The most important part is to start early

The challenges can be tough! There are NO skill or technical requirements to start, but by the time you reach the difficult levels each problem takes some effort. The trick is to make sure you're staying diligent and progressing regularly.

Don't sweat it. They provide everything you need. The training is more than enough to pass the certification exam and they provide the cloud infrastructure required to solve each challenge.

Did I mention all the exams are open book and SANS mails you the training content automatically?

It's surprisingly powerful to be one of a few college students with multiple industry-recognized certifications. Between the raw skills I've acquired, and the confidence I've gained in presenting myself as a young infosec professional, I'd recommend the program to anyone interested in a career in cyber. I'm amazed it isn't more popular! Good luck.

[This is a guest post by Alex Wang, a rockstar college student in Los Angeles. Follow along Alex's journey at his bonkers personal site alexwang.net.]

Talks and workshops include:

• a breakdown of the cyber industry illuminating the pathways available
• proven strategies for breaking into and exceling in the field
• and the famous Resume Roast.™

Check out the Wall of Love for 15 video testimonials of students who landed jobs, got promotions, and negotiated higher salaries with Decrypt Cyber.

All talks and workshops are free and can be done virtually or in-person! Email hello@decryptcyber.fyi to get on the waitlist.

As seen in: