How can you demonstrate your passion for Information Security to an employer?

Portfolio is the summarisation of all your achievements and experience around information security which is relevant for any level of consultant in the field. Few key things can be mentioned in portfolio: - Technical capabilities achieved in projects or practical labs - Accreditations and certifications proves your possession of technical skills at a certain level - Complicated projects handled that shows your ability to deliver in particular situation - Your non technical skills mentioning about your strengths like logical reasoning, analytical thinking, dedication etc.

A portfolio is a dynamic, visual representation of your journey and growth in Information Security. It's not just about what you've done, but about what you've learned, how you've applied it, and the way you've grown in your knowledge, skills, and abilities. Each project in your portfolio is a story of a problem faced and solved. It's a tangible way to showcase your skills in penetration testing, security analysis, or whatever niche you specialize in. Additionally, it's important to clearly communicate the problems you addressed, the solutions you implemented, and the results you achieved. This not only shows your technical expertise but also your ability to think critically and convey complex information in an understandable way.

You have to be able to think outside the box…PERIOD. The most natural answer anyone will say is oh ask questions, get certs, be attentive etc and they are not wrong. However, when you show an employer that you are able to think outside the box and figure it out, then you have cracked that code.

I believe that obtaining certifications represents a personal journey of continuous learning and dedication to staying ahead. Currently, I am in the process of pursuing my Security+ certification. What makes this pursuit truly fulfilling is knowing that the knowledge gained doesn't just contribute to a certification but demonstrates my commitment to my career growth and staying current in my field.

One way to prove your passion for information security to an employer is through certification. Certification can be classified as vendor-specific and vendor-neutral. Achieving vendor-specific certification demonstrates your skills in the tools and technologies utilized by your employer. This reflects your commitment to align with employer’s technology strategy. However, vendor-neutral certification may need to be redone as employer‘s priorities change and therefore a change in the underlying technologies. Achieving vendor-neutral certification demonstrates your skills in information security standards, capabilities and best practices. In summary, both types along with solid hands-on experience advance your career in information security

Certifications are the easiest way to communicate your passion to employers as it emphasizes the rigour and discipline that you had to go through to study and pass a relevant exam.

Being an active member of Information Security communities illustrates your enthusiasm for staying connected and engaged with the field. Participate in forums, attend conferences, or join local or online groups focused on Information Security. For example, engaging in discussions on platforms like InfoSec Institute or attending events like DEF CON can provide networking opportunities and insights into current security trends.

I have join various communities related to information security in Linkedin, Facebook group and also Telegram group which I find is beneficial for me to get informed of trends, challenges faced by others, issues that people are discussing, future prediction, and so forth. It is also a way to get to know other experts and establish an arsenal of subject-matter experts which I can explore when a project calls for such expert. I guess when you are passionate in certain area, you will tend to get connected with such communities, likewise for Information security.

Showcase your passion for information security with continuous learning. Find some key blogs, websites, podcasts, conferences, and groups to keep learning every day. I always ask people what they like to read or listen to for new ideas and diving in deeper. If someone doesn’t have at least a few go-to sources they’re not keeping up. Information security moves at a rapid pace. You need to love it to be able to keep learning enough to be relevant.

Curiosity is key. Applicants for information security roles need to demonstrate a history of continually asking ’why?’ Getting to the root cause of a cyber issue is crucial and this can be demonstrated through a strong appetite for learning. Develop that hacker mindset and backing it up with broad deep technical knowledge will help you stand out and set you up for career success.

You could ask questions from the IT security team in your company and find out what their current challenges are and what you could do to possibly assist. That could be some research work, an admin task such as audit work, or creating content. This might have to be done outside of your standard working hours if you have other roles in the company but will showcase your interest, curiosity and dedication- all of which are traits that are highly sought after in security teams. Asking (respectfully) questions from experts in the field, either via forums or social media platforms like LinkedIn is another way to make yourself visible over time.

During interviews or meetings with potential employers, ask insightful questions about their security practices and challenges. This demonstrates not only your interest in their specific security environment but also your overall curiosity and commitment to the field. Questions could range from inquiring about their incident response strategies to how they handle specific security threats.

It also depends on which stage you're at in your career. While hiring for our high-performing team in my previous companies, we always valued and hired those fresh grads involved in security-related research, academic papers, personal projects, participated in hackathons and bug bounties, and free online courses. The focus is to see if they're passionate about the field they're considering investing precious years of their lives. Whereas for experienced professionals, I'd look for their mentoring and training involvement, writing blogs or papers, participating in industry conferences or forums, volunteering, etc. The focus is to see how much they have contributed to the community.

Log off, go home, do hobbies, spend time with friends, family, yourself. It's a job not a lifestyle. Any employer that demands 'passion' for the job will absolutely exploit that passion. The premise of this article is BS. You don't have to be a ninja/rockstar/unicorn. It's ok to log your 9-5 and turn off at the end of the day.

If you are a student o just starting a junior position, you can apply for an internship and get your chance to demostrate your passion and skills.