Security Confidential S10 E2 David Meece

Manoj Tandon:: Welcome to another episode of Dark Rhino Security Confidential. Today, we are honored to have David Meece join us. David is a SOC analyst, a cyber mentor, an educator, and the founder and creator of CyberTechDave. He holds a Master’s degree in Information Systems and has a wide range of skills ranging from teaching to virus removal and everything in between. He’s a really solid person with a lot of experience in cybersecurity. He is passionate about cybersecurity and enjoys using his platform to teach people how to protect themselves and stay safe online. Welcome to the show, Dave.

David Meece: Thank you for having me.

Manoj Tandon:: It’s great to get a real practitioner on and talk about a few things. Now, you’re a real passionate guy; we know that. And there was a topic that you had brought up that I think it would be great to kick this off with: how to use LinkedIn to break into cybersecurity. Now, that’s something you don’t hear all the time. Give us some guidance here.

David Meece: [Laughter] Yeah. What I suggest to people is what I did. I would get on LinkedIn probably for 15 minutes at a time, maybe three times a day. Let’s say, just get on and comment on other people’s posts. You know, provide value and feedback.

Then I would also post. In the beginning, I was just posting maybe once every week because, of course, like everyone starting out, you’re afraid to post. But once you realize it’s not that bad—you know, a lot of people get imposter syndrome and they’re afraid to post because they’re afraid of what people might think or what level you’re at.

For instance, even if you post—I tell people—even if you post about fundamentals, like A+, Network+, or Security+ stuff, as long as you’re teaching someone, it doesn’t matter what level you’re at. I realized that pretty early on, so I started posting. I got up to three times per week. The main thing, I believe, is just staying consistent.

Manoj Tandon:: Was that an optimal number, by the way? Just out of curiosity, is three times the magic number, or what’s your—

David Meece: I would say between three to five times. There are really no hard facts, of course, but I would say I’m up to five times a week now. I’m sorry, per week.

You’re a busy guy, but I can tell you this: if you post—I’m in Eastern Time—so 10 o’clock in the morning, between 10:00 and 11:00, is that sweet spot. Because you get your content out there, it hits the algorithm more, and you get it in front of more people that way. So you always want to post between 10:00 and 11:00. Of course, that’s Eastern for me.

And I would say my best days to post would be Tuesday, Wednesday, and Thursday. I’ve had the most success on those days. I would like to let people know that, too.

As far as targeting a role—like if you’re trying to get a position—I know you had mentioned leveraging LinkedIn to find a job. What I did was, I picked three to five companies that I wanted to work for, and then I would target those companies and just focus.

For me, I was wanting to become a SOC analyst, so what I did was I reached out to as many SOC analysts and blue teamers as I could. That way, I could reach out and say, “Could I get a 15-minute coffee chat with you to maybe talk about your role?” You’d be surprised how many people are willing to help you.

I just tell people, don’t be afraid to reach out to people because the worst they can say is “no” or just not respond at all. And if you wanted to become a penetration tester, you’d want to reach out to pentesters or people on the Red Team. Maybe ask what their day-to-day tasks are or what their interview process was.

I would also reach out on LinkedIn to recruiters and hiring managers. Find out who the decision-makers are in the company, but really get to know people and get to know what the role is about. Just put your name out there and just keep networking.

Manoj Tandon:: So when you did this, how was the response? As an example, if you contacted 10 people, did three respond, eight respond, or what was it?

David Meece: I would say at least between two to four.

Manoj Tandon:: Wow, that’s a really good response rate.

David Meece: Yeah, it actually is.

If you send a genuine note when you connect with someone—instead of just hitting the connect button—I recommend telling them a little bit. Actually dig into their profile and see what they’re about. Maybe watch some of their content videos and say something that you liked about their content or something you have in common.

You’d be surprised how many people will reach out to you, but you’ve just got to stay at it.

Manoj Tandon:: How do you fight the fake IDs on LinkedIn? Because there’s a lot of that going on where people have created imposter profiles. How do I know I’m talking to a real person and not a bot or some fake profile?

David Meece: You just have to be extremely careful. A lot of times, if I’m unsure about someone’s profile, I’ll reach out to a bunch of other people in my network and say, “Are you familiar with this person?” or “Does this person exist?” Most of the time I’ll get, “Yeah, we know this person.” That’s a good way to know.

Manoj Tandon:: Another thing, David—I don’t know if you’ve run into this—but I’ve seen it a couple of times where people have reached out to me and when I go to their profile, it really isn’t meaningfully populated. There’s nothing in it. It just says, “John Doe, Caregiver” or something like that. This doesn’t tell me anything; it doesn’t inspire a lot of confidence. When you were starting your search, did you have a very complete profile up there?

David Meece: Yeah. Once I really started networking, I did. In the beginning, I didn’t, and then I realized pretty quickly that I needed to fill everything out and have a five-star or ten-star profile. The more keywords you can put in your profile, the more recruiters will hit you in the system, and you’ll get more profile views.

Something else I’ve learned is that if you live in a smaller city, you would want to list a bigger city for your location to get more profile views. For Chicago, for example, you wouldn’t want to put a small town because you won’t get as much traffic that way.

Manoj Tandon:: You’ve really dove under the covers on the LinkedIn algorithms.

David Meece: [Laughter]

Manoj Tandon:: I say that a little bit tongue-in-cheek, but there’s a reality that you are marketing to an algorithm if you want to get the views.

David Meece: Yes.

Something else about these algorithms: once you post, they call it the “golden hour” or hour and a half. You never want to leave your post; you want to comment for at least the first hour. The more comments and likes you get, the more people will see it.

When you post, usually only one to two percent of people in your network actually see it. But the more people comment within that first hour—the golden hour—it expands it out to even more people. So you really want to focus; you don’t want to comment and then go to lunch or go do something else. You want to try to stay there with it the best you can.

Another tip: you never want to edit your posts right away. If you misspell something, wait just a few minutes before you edit it. If you do it within the first 15 minutes, it kills the algorithm.

Manoj Tandon:: Oh, wow. I didn’t know that.

David Meece: That’s interesting.

Manoj Tandon:: Is there anything else? This is fascinating.

David Meece: Yeah, something else. You never want to put a link inside of your post. I know sometimes I do, but a lot of times, if you put a link inside your post, it’ll kill the algorithm, too. You want to say, “My link is included in the comments below,” and then wait a few minutes and post your link in the comments. That also keeps the algorithm from slowing down.

Manoj Tandon:: That’s very interesting and good information. For anyone looking to break into cyber: reach out to the positions you’re looking for and ask about their roles and interview process. Post regularly, preferably between 10:00 and 11:00, maybe three times a week on Tuesdays, Wednesdays, and Thursdays. Don’t edit your post immediately, and try to get comments up in the first hour of posting to get noticed.

David Meece: That’s what I’ve learned from my experience.

Manoj Tandon:: Fantastic. Now, let me ask you: when you started out, what certifications did you find useful in your journey to becoming a SOC analyst?

David Meece: Personally, I went for the CompTIA Security+ right away. I also studied networking, and I have a help desk and system administration background, so I’ve done a little bit of networking anyway. I skipped the Network+ and went straight to Security+. The first time, I actually failed the exam, but I just kept studying, went back, and passed it.

I would recommend Security+. I had very good luck with it. Ian Neil has a Security+ book that he has written through Packt Publishing. It’s for Security+ 601. The book is fantastic; that’s what I used personally. He has a free website; we could put the link in the show notes. If someone types in “Ian Neil Security+,” they’ll find it. It’s completely free. He has all kinds of labs, flash cards, and all kinds of Security+ questions. It’s really nice the way he’s got it set up.

Manoj Tandon:: I was going to ask you how you do this on a budget, because there are a lot of schools that are not cheap, and not everyone has the money.

David Meece: Definitely. I recommend Professor Messer; you’re probably familiar with him.

Manoj Tandon:: Of course. Yes.

David Meece: He has a lot of really good stuff out there, and it’s all free unless you buy his practice exams. I actually bought one of his practice exams and it really helped me prepare for the test. It was only about $15 or $20. Very affordable.

I’m not affiliated with TryHackMe or Let’sDefend, but for Red Teaming, I would say do the free rooms on TryHackMe and the free rooms on the Let’sDefend platform. RangeForce is also good; they have a lot of good free stuff.

Manoj Tandon:: Those are great resources, and we’ll try to get them into the show notes. There’s this perception that you have to go through a collegiate program or formal training, and that can be daunting depending on where you’re at in life. What you’re describing are resources that are available for people to get their hands on. I hope our listeners take heed and check out some of these free resources. You’re saying this from personal experience, right?

I wanted to ask—and it circles back to LinkedIn—about your hashtag: #CyberTechDave100DaysOfCyberChallenge. That’s a heck of a hashtag. Two questions there: one, do you have advice on how to use hashtags, and second, what is your 100 Days of Cyber challenge?

David Meece: About 10 months ago, I decided that I wanted to create some kind of community challenge. I’ve seen a lot of cybersecurity challenges out there and I wanted to put my own spin on it. I know it’s a long hashtag, and I usually recommend people keep it short, but I thought CyberTechDave would help with personal branding.

But the main reason I made it is to help people. So many people have reached out to me and thanked me for the challenge. They said it’s really helped them stay consistent in their studies. That’s what I hear the most from people trying to break in.

I kept the challenge pretty simple. Step one: post on LinkedIn every single day for 100 days. Step two: no matter what level you are, you can write about anything, whether that be labs you’re working on or what you’re learning about in school.

When I was doing Security+ for instance, I would document my journey every day. It’s been really fun watching everybody’s journey. If you click on the hashtag, there are like 1,500 followers already. It’s a lot of fun to go back and read everything because you’re not only helping them, but you’re helping the entire community and learning stuff that you might not know.

I usually post once a week, typically on Saturday or Sunday. I’ll say, “Hey, for everyone in the network that doesn’t know about the challenge, come and join.”

Manoj Tandon:: That’s so cool. It takes a lot of discipline to post every day for 100 days.

David Meece: Yes.

Manoj Tandon:: You have to put some thought into it, but it also creates a structure to your day.

David Meece: Oh yeah. It’s a lot of stuff. People have actually written a few reviews on my page. It’s completely free to the community.

Manoj Tandon:: Is there a set of topics that you’ve seen written about more often than others?

David Meece: That’s a great question. I would say probably Red Teaming, because people find Red Teaming more “sexy,” I guess you could say.

Manoj Tandon:: Yeah, there’s a romance to pentesting.

David Meece: The defenders don’t get as much love, but I personally love the defensive side. I love defending people. It’s good to learn a little bit of the Red side, too, so you know what you’re up against. It’s good to study both sides as a practitioner.

Manoj Tandon:: That’s very true. How should people cross-train?

David Meece: Exactly.

Manoj Tandon:: I think it’s a fantastic idea to have SOC analysts go on the Red Team, and vice versa.

David Meece: Oh yeah. I’ve had Red Teamers reach out to me and say that they’ve never done any SOC analyst work. In my current company, whenever we get a chance—everyone stays so busy—I’m trying to shadow some of the Red Team. That way, I can see everything in action, talk to them, and see exactly what I’m defending.

I think in some aspects, defending is a much more difficult exercise because you don’t know what the other guy is thinking.

Manoj Tandon:: One other topic you brought up was that you’re writing a book about women in cybersecurity to encourage more women in the field. How did that start off?

David Meece: It’s actually not out yet. We’ve been talking to some publishing companies. I can’t really say a whole lot about that right now because I’m not sure on the title.

But the idea came because I’ve always wanted to give a scholarship to women in cybersecurity. I was thinking about different ways to make that happen, and I thought: why couldn’t we have women and male allies in the community come together and write a few paragraphs on how they broke into cybersecurity and give some tips?

We address how women struggle in the industry and other industry-specific questions. We’ve actually got over 20 people who have already submitted their papers. We’re going to have to go back and edit it and add more content.

The main reason I’m writing it is to encourage more women to get into IT and cyber. My co-writer is Megan Jasko. If anyone has questions about the book or wants to contribute, we’re still looking for people. They don’t have to be seasoned professionals; they can be students.

Manoj Tandon:: This is a profession that has had a skewed balance between supply and demand of talent. It’s ripe for diversity—for women, minorities, everyone.

David Meece: One hundred percent of the money—we’re talking to Women in Cyber Security foundation—is going to go specifically to scholarships.

Manoj Tandon:: That’s a fantastic idea.

David Meece: The possibilities are endless.

Manoj Tandon:: I want to transition a little bit to work as a SOC analyst. SOC fatigue is a real thing. What is it, and how do you deal with it?

David Meece: I feel like SOC fatigue is the amount of alert fatigue you get. You might have 500 alerts in one day. You’re constantly scanning files, URLs, suspicious processes—it’s constant “eyes on glass.”

I try to exercise and stretch. I also recommend asking your manager if you can do other tasks. Instead of doing alerts all day, maybe spend time looking at threat intelligence or writing documentation.

Around the fifth or sixth month, I started feeling that fatigue. Now I try to dig deeper into alerts and learn more. Threat intelligence is a passion of mine—tracking threat actors and thinking ahead like a chess game.

Manoj Tandon:: What role does automation play in reducing that fatigue?

David Meece: Automation really helps. It picks up the low-hanging fruit so you can focus on other tasks. I’m a big fan of automation, though I wish I knew more Python scripting.

Manoj Tandon:: Do you think automation could replace SOC analysts?

David Meece: Personally, no. Some tasks require human interaction—talking to customers, validating events. I don’t think it will fully replace humans.

Manoj Tandon:: From a client perspective, what gaps do you see in cybersecurity programs?

David Meece: The biggest gap is not doing enough risk assessments. Risk assessments are key. They tell you what assets you have and what vulnerabilities to prioritize. If you don’t know what you have, you can’t protect it.

Manoj Tandon:: Who should lead that?

David Meece: It’s more of a business function, but it overlaps with IT and cybersecurity.

Manoj Tandon:: Are you familiar with OWASP?

David Meece: Yes, somewhat. I also recommend NIST for controls and compliance.

Manoj Tandon:: David, we’re at the hour. Anything you want to share?

David Meece: I’m working on the book and still looking for contributors. Also continuing the cybersecurity challenge. I’m working on a second book about cybersecurity awareness—how to protect yourself and your family.

Manoj Tandon:: When it’s out, let us know.

David Meece: I appreciate that.

Manoj Tandon:: I don’t know how you find the time to do all this. Do you sleep?

David Meece: I drink a lot of coffee. I pretty much swim in coffee.

Since I work remote, I use my time efficiently—lunch breaks, early mornings. I usually get up around 4:00 AM.

Manoj Tandon:: Fantastic. David, it’s been a pleasure having you on the show.

David Meece: It’s been an honor. Thank you for having me.

Manoj Tandon: You’re welcome back anytime.