 Okay. Hey, so this is Kathleen, we're back at the career hacking village. And I'm so excited to invite my friend Chris rise to talk about resumes because Chris and I have done resume reviewing for the last six or seven years at several of the Las Vegas cons and we can tell you that resumes really are one very important to finding your next job. But two, they can be really screwed up if you don't do them right. And three, people will tell you to pay someone to do your resume when they really shouldn't. So I'm going to turn it over to my friend Chris rides, and he's going to talk to you about doing your resume, Chris, take it away. Thank you so much, Kathleen. So I'm still getting used to presenting over video. It's kind of one of those I prefer talks in person because I like a little bit of an audience interaction and that way I can usually see if my terrible jokes are like getting a laugh or like normal, you know, just falling a bit flat. It's a good reminder of why I ended up in recruitment and not in comedy. So let's talk about my, my talk is going to be called owning your resume. I'll tell you a little bit about me first of all. So I've been for a bloody long time now in tech recruitment. And the last eight years have been dedicated specifically to cyber security recruitment. Eight years ago, I co-founded Tyro security, which is a cyber security staff in a professional services company based out of Los Angeles and covering really the whole of the US. I also co-founded a company called commute.io, which we were looking to launch probably Q2 this year. Much like jokes are all about timing, start ups often are as well, commute was focused on retaining your staff and doing that by looking at the horrible commutes that people had and how that affected their happiness. Clearly while we're in this time where we're in the crazy experiment of COVID where everybody's working from home and we're kind of figuring that out, commutes aren't much of an issue right now. So who knows what's going to happen with that one. Now I'm also founding board member and president of the cloud security alliance, Southern California chapter and I'm an advisory board member for the national cyber security training and education center. And just a little bit about me. I absolutely love diving with sharks, don't get to do it much any, any more. I've got a little daughter, wife thinks it's too dangerous. Yep, this is one of my pictures and I was hanging out, I wasn't a cage, don't worry, but I was actually hanging out of the cage with my camera like this. So I guess there's an element of danger there's probably why I enjoy doing it. But anyway, I'm on a band now, wife says I can't do this anymore, but I am allowed to go to cyber security conferences. The great thing about that is there must be some cyber security people that are scuba divers, right? So if you are, you need to connect with me on LinkedIn and we need to organize a conference that's on a scuba diving boat because I'm sure I can get the approval for that. So let's combine the two. I'm totally up for that. Right. So what am I talking about? So I'm going to be talking about writing the actual best resume for you. Going to look at avoiding common mistakes. We're also going to look at what most hiring managers want to read. And I say most because every person is different. We've got to work for the majority and we've got to put together a resume that works for the majority. And that's where my experience comes in. And hopefully this is what's going to come out of this. And then it's going to be talking about getting your resume in front of the right person. It's no good having an amazing resume unless you're actually having the right person read it. What the talk's not about resumes. Are they outdated? Well, probably, we must be able to come up with something better than a piece of paper with this information on, but we haven't got anything yet. Nothing that at least is accepted globally and can do everything that these documents do while also minimizing any potential bias. So we're still figuring that out, LinkedIn and things like that. Who knows, maybe they will end up taking over from resumes. But right now, resumes are what we got. We need to make the most of them. And the other thing we're not going to cover is something I call keyword tricks. Keyword tricks are things like hidden words, huge skills, main tricks is. You know, when you write these things all out in white font or in tiny fonts that aren't really readable by a person, but are aimed to be picked up by systems, you only need these things if you're planning to send those resumes into those systems. And that shouldn't be your goal. And I don't want that to be what comes out of this talk. I'm a firm believer you want to get your resume in front of the right person, not into the right system. So we're not going to be covering this. So my goals by the end of this talk, the plan is that you will understand why resumes are still very, very important. You're going to understand what the common mistakes are, how we go about avoiding them. Also the relationship between your social media and your resume and the actual job search you're doing. And then the final part, since we're going to come up with an amazing resume for you, we're going to want to make sure we maximize what we do with that and maximize the opportunities that we can get. So CV or resume can probably be tabbed by the accent. I'm not originally from the US. And the great thing about DEFCON is when I've been for the last few years, meet so many people from all over the world. I am originally from London. I spent half my career in recruitment actually recruiting for Europe. And in Europe, we use curriculum VTI or CV, which is Latin for course of life. And that's how we refer to it there. Not of course of life, of course, we call it CV. And then the other half of my recruiting experience has been over here in the US, where we use resume, which is French to summarize. Now, there are a lot of articles that I've read on the web, and it talks about the differences between having a CV or having a resume. It talks about the length or maybe content. But it's the same thing. It's the same thing, right? It's a concise, written history of your work in life, and it's designed to get you an interview. It's not designed to get you a job. It's designed to get you that interview. Now, I've been hands off for a while now. I don't do a lot of hands-on recruiting, and I'm still seeing probably 10 resumes a day. When I was recruiting, 60 a day wouldn't be unheard of. And if I work back and think about how long I've been doing this for, even with half of it being in Europe, with, of course, the famous European vacation time we get, which I definitely made use of, I'd still estimate I saw over 200,000 resumes in my time within the recruitment industry. And almost all of that was the tech area. So I've seen a lot of resumes. And that's what I'm building this information on off of. So resumes are still very much important. You need to look at your resume. And some people get frustrated when they think about resumes. Oh, I've still got to do this. They can just look at my LinkedIn. Resumes are still very, very important. Just as communication skills are important in every job that you go for, they will expect some one good communication skills. And your resume, you've got to think of your resume as a test, if anything. Your resume is there to show hiring management, recruiters, everybody in that process, how you would communicate in writing. So you've got to bear that in mind when you're doing this, when you're looking at resumes and you're putting them together, this is a test. You want to do your absolute best in this test. And hopefully, this presentation and talk is going to help you do some of this. And just remember, this document is there to get you the interview. And once it's got you the interview, it's going to form a major part of your actual interview process. So let's make sure you got it right. Let's make sure it's something that you know really well and then you can use. So owning your resume, your resume represents you. This is supposed to be you. You should be the one that is putting your resume together. It represents you. It represents your career history. You must write it. Can you take a look at others? Of course you can. Who else do you know in the industry? Let's have a look at their resume. Will they share them with you? Could you use other people's in a template? Of course you could. If you want to do that, great. No problem with that. Use a second set of eyes. You know people that are in the industry or recruiters or whoever it may be. Get them to take another look at your resume and give you feedback on it. You've got friends. You've got contacts. Do that. Just don't pay for somebody to do this. Please, please, please, please, please. Do not pay for something to do this. And I'm probably really annoying. A lot of people that maybe do resume writing as a career. I'm sorry. I'm sorry. I'm not really that sorry. Honestly, the professional resume writers, I think I know one professional resume writer that actually works within the cybersecurity industry and has cybersecurity experience. One, I think I know 15,000 contacts on LinkedIn, well over 15,000 now. I still only know one, right? And your resume is very, very much industry specific. Different resumes are needed for different industries. And so the cybersecurity industry has its own requirements. So having a generic resume written by somebody that writes resumes for every industry isn't going to be that good for you. And I've looked at a lot of these and I can tell you much of the time when we're asking for changes and we have somebody say, well, I pay somebody to do this. They still need changes in them because they're not set up for what a cybersecurity resume should look like. And so you could pay quite a lot of money for that to be done. So I'm just gonna say, save your money. Spend it on something that would help your career, whether that's expanding your knowledge or training course, whether that's buying a new tool that you can play with at home, or whether that's even getting a certification, just don't pay a resume, somebody else to write your resume. Don't do that, please. Sorry, resume reviewers, but don't do it, don't do it with resume writers. Anyway, right. Dress for the occasion is what I call this. You want your resume to fit the occasion. And so you're gonna have multiple resumes. What we're gonna mainly focus on is your generic resume. So your generic resume is the one that you're going to base your specific resumes from. So you've got to get this one right, first of all. If you're one of those people who like to take a printed copy to job fairs, and I gather there are still people that like to do that, especially because people don't want to send documents that could, especially within cybersecurity, sending documents to different people or letting people loose on your computer. You might understand that. So if you're somebody who wants to take a printed copy with you, this is the one you're gonna use. This one is gonna be more tailored towards the type of job that you're most likely to be applying for. This one's gonna talk about projects, experience that you've got that's brought. It's not gonna go into so much the specifics. It's gonna give people a general understanding of who you are and the experience that you've got. And you're gonna use that for certain things. You will use that for the specific resume is the one that you're gonna actually use and write for job description, specific job descriptions. You know, you've got the job description there. You're gonna take your generic resume. You're gonna really, really read that job description or even better if you know somebody that works there or you even may know that the hiring manager, speak to them, get more information now of what they're truly looking for and then make sure that's in your specific resume. I did this at my last position and I know you're looking to do the same project. Make sure that's in there. You've gotta make sure that that relevant experience relates to the job you're applying for. The most relevant skills are in there. The most relevant tools are in there. Your most relevant projects are in there. They're all ready for that particular job and you're gonna wanna detail that in your specific resume. So you might end up with quite a few specific resumes. That's totally normal. It's important, it does take time but this resume is the one that will get you the job and it's the one that will create the conversation during your interview. So take time, it's worth it. All right, common mistakes. Oh boy. Let's start off with the resume length. Now I am talking very much about, and I said this earlier on in the presentation, we're talking about generically what most managers want to see. Some managers out there may well like to see a long detailed resume but on the whole, most do not. And so we're gonna work for the most. We're gonna put together a generic resume that works for the most. And so talking about resume length, your resume is a clear, concise example of your written communication skills. So unless you just graduated and have very little work experience, I can't see how you will get it to one page and the ones that I have seen that are one page resumes, they're usually missing key information and they're usually written in a really small font that just makes it awkward to read. It's not good, it's not what you would do in a report that you would be writing. So skip the one page one unless you've just graduated. Ideal resume length, two to three pages. Once you get to four pages, you're kind of pushing it and anything more than that, you're gonna lose your audience. I'll tell you a story and I wrote a blog about this but I had a resume sent across to us and I opened it up, it's 55 pages. 55 page resume, wow. Yeah, I don't know whether they were writing a resume or a novel, it was insane. So I actually spoke to the person and you have to be pretty tactile because this is somebody's experience and they obviously feel passionate about the experience they've got and they feel passionate enough to write a 55 page resume. So I did save the person, if you've got another resume that you also use because some people have a couple of generic resumes, some people will have a two or three page generic resume and then they might have something a longer one in case they get asked if you've got something that goes into more detail. So I asked that question, got an email back, excitedly opened up the resume, that's an amazing experience. Open up the resume, 70 pages. Yep, turns out the 55 page resume was their short one. So look, I know you're passionate about your experience, I know you wanna work for companies that are also passionate about your experience but you need to be able to write clear and concise documents for most jobs that you go for. And so if you can't get it down to that and we're talking a bit about how that you might be able to do that but if you can't get it down to that length, you've got to look at your ability and what kind of information you're putting in there. So look, work on it, get your resume down, two or three pages is ideal. So the other thing we're gonna talk about is formatting errors. Choose your font and stick to it. Same font throughout the whole document. Don't do multiple fonts. Be careful when you cut and paste things, maybe from one resume to another or from your LinkedIn. You might find that you actually end up putting in a different font, you didn't know that. So regularly check that you've got the same font throughout the whole lot. Generally, probably the same, the same size font as well. You might have titles in a slightly bigger font, I suppose, but you gotta keep whatever you do the format for the same right way through. So if you have a description of where you worked, how long you worked there, your job title, and then underneath you've got bullet points of the things you did. Every job should be done the same way, not bullet points on one and no bullet points on another or square bullet points on one and round bullet points on another. You wanna make sure that you've got all of these things laid out so that the format reads and there's nothing distracting them basically. And be really careful about where you use your bolding. Some places like if you bold every company you've worked for and then the date isn't bold, if it's the same all the way through and it's used sparingly, it can look good. If you're bolding lots of words and you're sending them to different jobs and sometimes those skills don't apply to those jobs, it's gonna look a mess. First off, and it's often not gonna apply and somebody's gonna be looking and saying, why are they even bolding those words? They don't apply to this job. So just be really careful and use it sparingly. Spelling and grammar mistakes, I always get a bit, but why are they still happening? We have tools, you know, Microsoft has tools for you if you're using the Microsoft suite. It picks up your spellings. You get a little red squiggly line underneath. It tells you that. It picks up your grammar mistakes. It tells you to check them. And this page had quite a lot of squiggly lines on it, I can tell you. Use those, read through them, and that should be your first point. And then you'd be so surprised, probably three quarters of the, three quarters I would say of the resumes we see if still got spelling and grammar mistakes in them. And so it's such an easy one to avoid. So make sure you're using the word process systems or whatever software you've got to pick up on that. And I get that not everybody's great with spelling and grammar. I may well be from England, but actually I'm pretty sure it's not a skill of mine. And so I ask friends, I ask other people to read over. In fact, even this presentation, I asked one of my colleagues to have a look through it and point out stuff. And I made some formatting mistakes. Thankfully the spelling and grammar mistakes were only the ones I meant to make. But I did make some mistakes in it. So look, get somebody else to look at it. Now these next couple of things that kind of do merge a little bit in together. So missing specific employment dates, we will see resumes that are sent to us that will say 2018 to 2019. I mean, when? I mean, is that a two month job? Did you start in December and finish in January? Or is that a two year job? Did you start in January and finish in December? You need to be specific with your employment dates. And I'll talk about why, because as we roll into sort of leaving employment gaps, everybody at some point may well have an employment gap. Maybe you were out of work and you were looking. Maybe you were doing, you took the time off to do some certifications. Maybe you traveled, maybe you looked after a loved one. Maybe you had a baby. Who knows, you know, people have good reasons for having gaps in their employment. And you should embrace that, that gap in your employment, put what you were doing. Put it down there on your resume. And the reason why I say that is because you will want to cause, when people are reading your resume, you don't want them having doubts. You don't want them making lists of, okay, I must ask them about those employment dates. I must ask them what they would do in between that time and that time. You don't want them asking you that. You don't want them, you know, because if you have more doubts than the resume next to them, you might just never get a chance to talk to them about it. Maybe they'll take these resumes and they'll never get to that pile of resumes. So get rid of the doubts. Make sure that they can focus just on what your resume has in it, the information and stuff that's applicable. That's why this is so important. And then the relevant information, I'll give you a few examples. This is gonna really help you with your resume length. So nobody, at least nobody I know, wants to know lots of detail about a three month job that you had 15 years ago. Just probably not applicable, right? It's just not applicable. So anything you've done even 10 years ago, and some people I've seen even go up to sort of seven, eight years, but certainly 10 years ago. If it's 10 years ago, it doesn't need to have any detail. I think if it's 10 years ago, you need to have the company you work for, the specific employment dates you work for them, and the job title, and that's it. Few of you now are looking at your really long resumes and thinking, wow, you can just get rid of half of it. That's perfect, thank you, Chris. So that's what you're gonna look to do. If they wanna find out more information about those jobs, they'll ask during the interview. They're not gonna, that's not gonna stop you from getting an interview. It's gonna be something they'll ask you about, especially if it's very applicable to the job, or at least the job title is applicable. So just bear that in mind. Likewise, and this is kind of a little bit of a bugbear of mine. Under certifications, a lot of people will have not only certifications they've got, certifications that they've let run out so they no longer have them, and then also certifications that they haven't even got yet. CISSP-studying, I've seen it so many times, and that's a bugbear for me because you forget we have old resumes of people when they apply for jobs. I can see that for two years, you've been studying for your CISSP, because on your last resume, the last time you were looking, it says it. So honestly, it's bullshit. I'm gonna mince my words, right? It's bullshit. You're not still studying for it. So take it off. Or if you're truly about to do the test, right? If you know September, I've got my test book. September 2020, I've got my test book, then put it. CISSP, test book for September 2020, put the year, right? But other than that, take it off. People will ask you, like when you've got stuff on there, people will ask you about it and then, you know, you've got an Aminar and you might have to, you know, blur the truth a little bit, and they can tell, they can tell their stuff. So don't put it on there. Other thing is we don't need a load of information about what you studied your degree in if it was 10 years ago. And don't bother if you can put graduation dates, right? You don't want anybody to date you or to age you. You don't need to put dates of education in there. You can put what you studied, you can put what your major is, you can put your GPA, that's it. Don't go into detail. Now, there's a caveat to that, and the caveat is that if you're a recent graduate and you don't have a lot of experience, then you may want to put into a little bit more detail as to what you did as part of that study. But that's the only reason you should do that. And then the last thing about your resume is, this is going to be read by multiple people in a company. Some of those people are going to be technical and some of those are going to be non-technical. And they're going to judge your written communication on this resume. And if you do really, really well, this is probably going to be in front of management directors, maybe even execs, depending on the position you're bound for. And you've got to write a resume that speaks to all of those different people. In my experience, if you're going for a technical job, you will end up having some kind of technical test. So you don't need to worry too much about making it overly technical. As long as they've got an idea of what you did, what projects that you've done, they're going to ask you about it. Make it something that works for all different levels of people. Cause if you're writing a pen test report or a risk assessment, they want somebody that's able to write something that speaks to different people, different levels of people. And so let's not make it overly technical. You don't want a non-technical person to get lost in it and just put it down, right? Reminder, they will check your technical skills. I'm going to leave this one up here. Dishonesty, let me take a drink of water while you just look at this slide. Don't be dishonest. Please, it always comes out. I've seen it come out during interview. I've seen it just during people sending their resumes. I've seen it during the interview process. It's really awkward. I've seen it come out after people have been off the jobs and I've seen jobs retracted. I've seen it come out after people have got jobs and I've seen people fired. I just don't do it. There's no reason. This should be your honest career experience. Be proud of what you have done. Don't make up things you haven't done. It will come up and it will bite you in the arse. So social media, you guys generally are pretty savvy. And I put a big buck here because for eight years, I've been doing this and I still see cybersecurity people not thinking about how their social media impacts their job search. I've seen public tweets, old public tweets that people probably don't feel that way anymore. Come and stop people getting jobs. Certainly stop people getting interviews. And so I've got, there's two ways to work it. Keep it private and I think a lot of cybersecurity people would probably understand that. You can have a couple of different social media. If you wanna have a private and a public one and have it separated like that, you can absolutely do that. Or of course, you can be at the point of love, I don't give a shit, this is me. If you're gonna hire me, this is what I feel. And I see a lot of people do that and that's great for them. And there are a lot of people in high demand in our industry. And so, absolutely, you can go ahead and do that. But you make that decision. Just do it with a clear head, I guess. Do it and understanding what you're doing. Because the last thing you wanna do and I guess, we should be pretty good at assessing risk, right? And you can decide how risky it is whether you wanna manage that issue or whether you don't wanna manage it. Up to you, just make sure you're thinking about it. Because it can stop you and it will stop you getting jobs and it could stop you getting your dream job. It could stop you getting the thing that you most wanna do. And you don't really want it to do that. So, moving on to LinkedIn accounts. I've seen a couple of people with a couple of different LinkedIn accounts. That always looks a bit strange, especially as most of them are not private and they often say different things. Don't do that. Have one LinkedIn account. Make sure the information matches what's in your actual resume. So, make sure the job title matches. Make sure the description matches. If you could probably have a couple of different job titles, you're welcome to have one on LinkedIn and then you could have that same one on your resume and then in brackets, the job title that you would put that as. Because I know that some businesses use very generic job titles. So, you can work within this, but make sure that there is a match there and it isn't gonna make somebody say, I love this resume, this person is great. Let me look at their LinkedIn. Oh, well, that's totally different. Why is it totally different? That's strange. And you don't wanna create that down because you don't know how many people you're up against when you're going for these jobs. And then think about the information that you share as well. Would your previous employer be happy about that information? Would your current employer be that happy with that amount of information you share? And would your future employer be happy about the amount of information you share on there? So, just be very, very careful around that. Maximize an impact. Got a couple of slides on this. It's very important. You've got the best resume in the world. You put something together. You're very happy with it. How can we maximize impact? First off, we're gonna talk about cover letters and all cover sheets as an external recruitment company. We do not send out a resume unless it has a cover sheet or one page cover sheet right at the beginning. Absolutely every time. We do it because we believe it makes an impact on how long that hiring manager will take to look at your resume. And so it's a way for us to take out the very much the most relevant experience in those two or three pages and putting it right up from. We know Mr. Hiring Manager or Mrs. Hiring Manager that you're Miss Hiring Manager. Whatever pronoun you prefer. We know Hiring Manager that you are looking for these five skills. This person has this many years with this skill. They would be using it in their most recent role. We pull out that information. We make it so that the manager looks at it and is excited about your impact, right? So that's how we do it. As an individual, you might do it a little bit different. And what you might do, the first off you've got to make sure that they're specific and concise. The same way as you would do in your resume, you've got to do the same in your cover letters or cover sheets. Make sure they're specific to the job description. Don't send out generic cover letters. They're horrible. They really are. Don't send a cover letter. If you're going to send a generic one, just don't bother sending one at all. And make sure they're specific to the job you're applying for. Make sure they're concise. Take your relevant experience and actually look at the job description or the job specification and read through it and think about it being a question and answer. They are looking for this. What experience do I have with this? They are looking for this. What experience do I have with this? And think about pulling that kind of information out. The other things you should put on cover letters or cover sheets, oh, why do you really want the position? You know, what's exciting you about it? And then that folds onto why you want to work for that company. What excites you about that company? If they feel that you're excited about the job, you're excited about working for them. You've done a little bit of background on them. They're going to be excited to meet you. And then finally, if relevant, you may want to put why you're leaving your current position. It's really, really important. If you're doing this, you keep it very positive. And you should always be talking as positively as you can about why you're leaving your current position. Been wonderful working here, but they don't support going to conferences or they don't actually pay for people to do certifications. Something like that. They have a day's vacation time. I work really hard. I'm willing to work really long hours, but I would like to spend more time and see more of my family. Whatever it might be, if it is relevant, then you can put that in a cover letter. So going on to sort of other ways to maximize impact. These are the three ways that you're going to really do your search. So you've got to make sure you own it. Own your search. One way is going to be responding to adverts. The other way is going to be utilizing your network. And then finally, and these are the big three for me, is recruiters, working with internal recruiters and working with external recruiters. So we're going to talk about adverts first of all. Call that adverts a mess. Adverts are a funny thing, especially for our industry. So let's think about this for a second. I'm going to advertise to people that work in security and privacy. And I'm going to expect them to send their resume, which includes their personal data through an advert to get added on a database, multiple databases for who knows how long that's going to be sitting there for. And then you're going to get maybe standardized responses. You may or may not even be contacted. And when you do get contacted, there's a high chance that the first person contacting you or speaking to you may know nothing about our industry. And maybe even working off a checklist. Do you have this? Do you not have this? Check, check, check, check, check, check. Strangely enough, it doesn't work very well in the industry. It's broken. I should be there. I should smash a glass here if there are effects. That would be really good. It is broken. Advertising is broken. You should not rely on this, no matter how great your resume is. Don't rely on responding to adverts to be the major part of your job search. Am I saying you shouldn't do them? No. Saying you can still do that, but it shouldn't make up the major part of that. And we'll talk about the other things that you are going to do. As a recruitment company, you're probably saying, hey, Chris, I've seen Tyros security. I've seen them advertise their jobs. You've got a job page on your website. You advertise your jobs here. You advertise your jobs here. Yes, we absolutely do. And I can tell you, we don't get a lot of response from them. And a lot of the response we do get is from people that are hoping to work in cyber security. And so the thing with that is they haven't got any experience. And as a recruitment company, we get paid to find experienced people. So we don't have a lot we can help those people with. And actually, we've got to do a lot of delving through people that aren't qualified to get to the people that are. It's not really worth a whole lot of our time. We still do it because at the end of the day, we're putting out there and you're taking the time to respond to us and we want to take the time to respond to you. But really, we don't get a lot of benefit from advertising. The major benefit is probably from having companies come to us and say, oh, do you know what? I've seen you do a lot of adverts for the application security people or cloud security people or DevSecOps or whatever it may be. You're advertising a lot of jobs for that. So you probably got a lot of candidates. So I want to talk to you because you're a specialist in that area. And I'm looking for a DevSecOps person as well. So we actually probably get more benefit from the client side rather than the candidate side. Right? Your network, your network's gonna be absolutely key. The people you know, what companies, what companies are your friends? Do your neighbors work for? Are they recruiting for positions that you might be interested in? Are you networking? Are you using those? Think about the people you know in person. Then you think about your virtual network. LinkedIn is key for this. Who do you know? Who do they know? Connect with managers that you think may be hiring and take the time when you connect them to write a personal note. Are you involved with your local community? The funny thing about this is that we're not meeting up so much in person at the moment. But a lot of the communities are doing a lot of webinars and things like that. Certainly, my Cloud Security Alliance chapter is doing regular webinars. So think about getting involved with that either just as a member or even as a volunteer. It's a great way to build your network and be involved. And it'll be amazing to see who you might meet. And you've got people like the Cloud Security Alliance, OWAS, ISACA, ISSA, you've got other local groups as well that may just have meetups or webinars. So take a look at meetup.com. That might help you. If you're part of an underrepresented group, CyberJutsu, the Y-Sys people, the Women in Security and Privacy, ICMCP, the Blacks in Cyber Security, join a group that you feel you will fit in well to. And that can be a great networking opportunity for you. And you can give back as well at the same time. The other thing conference is, welcome to DEF CON, right? You're attending the conference right now. Conferences are an amazing way to meet people that may well hire you or may be able to even help you. Most companies nowadays have referral schemes. They're very, very common. So even if you're not meeting a hiring manager, you could still be meeting somebody that could refer you internally. And a referral internally can help you skip a lot of the process. You'd be surprised. I know companies that guarantee that if you refer somebody, if somebody internally refers you, they will call you. You'll definitely get a call. Now, whether you'll get a full official interview or not, but you'll get at least a phone call. So you will hear back. They get back to their referrals in ways that they sometimes don't get back to their advert responses. So bear that in mind. The other thing to think about is speakers. I always say failing to plan is planning to fail. It's one of my favorite quotes. If you're gonna go to a conference, if you're gonna attend a conference, make sure you're seeing in advance who you wanna see talk. Could they help you in the process of you looking for a role? Do you wanna work for that company? If it's an in-person one, be that person hanging around the stage afterwards and actually meet the person. If it's virtual, hopefully, like me, they'll be in a Discord chat and you can talk to them in there. Or you can reach out to them and say to them, I listened to your speech here and it was great. It was a really great presentation. I'd love to connect with you or talk to you if you're gonna connect with Violington. And then the last thing is research and presentations. This is gonna help your credibility hugely. It's gonna be really good for your personal branding. It's a great, great, great way to network and it's experienced that will help you in your career and it'll really improve your resume. So get involved in doing research, presenting research, network and volunteer and help. These are all great ways to really maximize what you're gonna be able to do with your resume. Right, this one, 72% of cybersecurity professionals do not believe that their HR department understands they're hiring needs, ouch. Wow, that sounds really, really terrible. I should state here, I know some amazing internal recruiters. In fact, I'm gonna be on a recruitment happy hour panel within DEF CON and some of them I've got so much respect for. This isn't always actually an internal recruiters issue. Internal recruiters have spread at many companies in very, very thinly, very thinly. And they can't get enough just cybersecurity, job JDs, job descriptions to actually just work in that area to specialize in that area. Very tough, it's tough ask, how can you ask somebody that one day it could be recruited for a cybersecurity person and the next day it could be recruiting for an accountant or even recruiting for the same person on the same day. Really tough ask to expect them to know and understand cybersecurity to sort of recognize what's on a resume and recognize the relationships between certain skills or certain tools. And so it can and it does result in people that have applied actually not getting through to the next stage and being overlooked despite them being really good. It's very tough ask for internal recruiters. So I just say don't give them too hard of a time even if you've had a bad experience internal and external recruiters please don't give any of us a bad time. We try our best, right? Now I will say this, there are, your first protocol really should be technical hiring people when you're trying to get your resume in front of them but there are some great internal recruiters if you're working for a very, very large company as an internal recruiter, certain ones have people that specialize just in cybersecurity. So they do know what they're doing and if they work for a cybersecurity company or a company majority of what they do is in the cybersecurity business there's a good chance they're gonna know and understand your resume. So just bear that in mind. That stat by the way is from the ISRC as state of cybersecurity. And it is tough and I think it's tough because a lot of these roles stay open for a very long time and people lose faith in their internal people because of that. So just bear in mind that don't be rude to people don't be rude to anybody, anybody you speak to. I've got a rule, it's funny I, when I used to interview people to come and work for me one of the first people I would speak to at the end of an interview would actually be the person that worked on the reception desk. I'd asked what their first impression was how was the person to them? So anybody that's involved in the process don't be rude to them, don't talk down to people no need to do that and you'll be surprised how much of a say somebody that you may think may not have could have. So don't do that and don't ignore companies process. If somebody tells you this is the process we go through, don't ignore it. Right, so external recruiters, us guys, when you're looking at external recruiters you really wanna build relationships with ones that specialize in cybersecurity. Great way of doing that. You can look at their LinkedIn, of course you can see what they write, how they describe what they do. Another way you could be looking at the company they work for are they advertising just cybersecurity positions? Or are they saying they're specialists because there's an awful lot of specialists in cybersecurity that aren't actually specialists, they're generic people and they work on whatever roles that their clients give them, right? So you wanna work with specialists and there's an easy way of doing that. They have credibility in their industry. They can put you in front of hiring management and they can also talk to the hiring management and maybe even explain in a little bit more detail and get a little bit technical as to why you are somebody that should get an interview. And that credibility certainly we see our resumes go to the top of the pile when maybe some generic recruiters might have to go through a slightly different process. So part of that credibility and stuff will really help you. Good way to identify them as well is are they involved in the community? Are they going out and building a network? Do they go to these conferences? Do they go to the meetups? Do they volunteer at these places? Are regularly attending these, you're giving up your personal time to regularly attend them. Chances are they are dedicated to the industry. So that's a good way to find them. They wouldn't be that hard to search for, I'm sure. They're the recruiters you build your relationships with, you connect with them, they'll have a network and they'll also give you free cybersecurity resume advice. They'll be able to tell you on there what you should maybe change. They'll be able to use that industry experience to help you during the interview process and they're gonna be able to really guide you through that process and give you a much better chance of probably getting the job you want. So it's better than mine. So coming towards the end of the talk now, hopefully I'm not too sure and not too long. Looking at my watch here, hopefully I'm doing all right. So the takeaways from this, let's make sure you understand and hopefully you do at this stage, you understand why resumes are still so, so important and why they're worth taking the time to make sure that we get them right. Hopefully you also understand the common mistakes that we see and you can avoid at least those ones. Also, understanding that relationship of how social media fits into your resume, owning the risk you're gonna take, understanding what you're doing when you post things on social media publicly and what the benefits might be to keeping that private. And then finally, how to get this most amazing resume that you're gonna be able to put together, how you're gonna actually be able to maximize it and put it out there and get it in front of the people that will make the decisions. So hopefully this has been useful for you. This is the end of the presentation. You can follow me on Twitter. Actually not on Twitter an awful lot. A lot of the stuff that I post on LinkedIn, I will also post on Twitter. LinkedIn really is, I'm a pretty big user. Anybody that's connected with me probably knows that already. I'm a big user of LinkedIn. So absolutely connect with me. Please, I get a lot of connections and I'm probably turned down maybe 80% of what I get. So generally if you work in the cybersecurity industry I'm gonna accept you. Please, if you can, if you wouldn't mind just taking the time to write a little note in that section and tell me if you wanted to connect with me to tell me how terrible my talk was at DEF CON. That's fine, I'll still connect with you. We all need some constructive criticism. If we can keep it constructive that will be amazing. So yeah, connect with me on LinkedIn and mention DEF CON if you did see it then. So look, thank you very, very much. Thank you, Kathleen, for the opportunity to speak. Hopefully I did okay. And those people that I've maybe sent to sleep they can wake up now. At least they got a good nap. Thank you. Chris, thank you so much. You brought up some really great points. One thing I wanted to point out that a lot of people, a lot of the technical resumes that I've been reviewing in the community a lot of people use templates. They believe that the templates are going to make their resumes look pretty. But when you use the template it doesn't have the spell check or the formatting check. So primarily the spell check. So a lot of people have been using templates to make it look design pretty. Please just keep it simple. Keep it something straightforward for everyone to be able to read. Love the advice about social media. Sort of keep in an eye that it stays out there. There's online reputation reports that say that HR managers and recruiters will check your social media before they call you in for an interview. And you might not like what they view as far as your social media. So be very careful about that. Also great recommendations on connecting with recruiters connecting with them in various different places socially, online, through conferences always great to be expanding your network. Chris's team is going to be part of our resume review team. So be sure you, be sure you're signing up for resume review and get some really good advice on that. Chris, as always, great to have you part of this. Thank you for being part of DEFCON Hacking Career Village. Thank you so much. Thank you for asking me. It's been great.