Why You Need Digital Portfolio - Part 2

The Content

Content is the key to your digital portfolio. Content could be source code repositories with software or scripts you have written, documentation on their usage, lessons learned throughout the week, or even your take on a latest exploit or light bulbs through the engineering process. Whether you know it or not, there is some form of content you are distributing into the inter-webs. I will dive into this part in further sections.?

The Strategy

This strategy is composed of 5 parts.

1. Choosing your Content Medium

2. Creating an Online Content Profile

3. Identifying a Potential Project

4. Leveraging Social Media Platform

5. Content Creation?

The following will guide you through the strategy with generic details on how you could transition to the next career position. Adapt the information shared to your own area of interest and current life.?

Each strategic phase relates the material to a security professional or a software engineer. I recommend the audience perform both parts to get a full understanding of the development of software and the potential attack vectors for such common architecture in the software industry.?

A security-conscious developer is at higher value than a developer that needs training in security; While a security professional can better assess the threat landscape by understanding the engineering ecosystem and how it truly functions.

Technology and tools are exponentially changing in this fast-paced world. Therefore, I leave the technical details out and provide guidance on next steps. If I were looking to transition or start fresh in the software industry as an engineer and security professional, I’d follow these steps with an example project toward my field of interest.

This hopefully gets the gears turning in your head.

The Steps

1. Choosing your Content Medium

With today’s technology, there are various ways of producing and consuming content, from audio-books, vlogs, source code, whitepapers, or posts. I recommend to start with one and then expand to other mediums that align with the goals for the project. If others assist you on the journey, different types of mediums can be tag-team to expand the exposure and knowledge for the project.?

For the purpose of this article, I will focus on web development and choose source code and documentation as a medium. The development of software is the first step to this project as my objective is to demonstrate the skills needed to create and maintain a website in the first place. Documentation can serve as a method to write user guides, troubleshoot common issues, perform threat models, document security tooling findings, weekly learning, and much more.

The goal is to have a content medium type that you can build, document, and share with others.?

1. Create a Profile

Based on your content type, find an online profile that suits your goals. For today, I will choose LinkedIn, Medium, and GitHub.

LinkedIn will be used to share the knowledge I have achieved and anything I’d want to share, such as Medium articles, bug fixes, questions (i.e., “help me fix this bug”), or articles of interest. When sharing information, ensure that it is insightful, from a valid source, and you provide your personal takeaways in the post. There is a whole section on LinkedIn in this article and a future article, so I'd save it for then.

Medium or LinkedIn is an option for writing articles or documentation.

While there may be other source code management (SCM) or online profiles that could be used, for the purpose of this article, I would mainly focus on GitHub. GitLab is another fine example, however, I’m limited on the feature comparison with GitHub. I’m not affiliated with GitHub. I really enjoy their features and the free capabilities available to the open source community.?

GitHub Pages is an excellent way to provide graphic design of the source code documentation or a cost efficient front end. This is also a method for both source code, website, and documentation in a single location. Using the free version on a public repository, GitHub also provides security monitoring and controls that can be enabled on your project.

Granted, a published website can be your digital profile which then links to a GitHub account, LinkedIn and hosts the articles.?

The goal is to have a central location for your digital portfolio and link off to other creations or content.?

1. Choose a project of your choice

In the upcoming months, project idea guides will be released, starting with designing a website and DevSecOps in GitHub. There is no need to follow step for step, but these are project outlines I’ve shared with my men-tees and have helped provide them the foundation and confidence to start searching for a job in the new field.?

A few disclaimers to note.

• Depending on the direction of your software career, depends on the type of project you’d choose. These are ideas to help you innovate and find your path.
• For the security professionals, ask for permission to perform any network or public security testing with the owners. Do your research and due diligence with local and federal regulations before testing security outside of a local environment. Ensure any sensitive reports are secure and safe from the public eye to limit potential security disclosure.?
• It takes 20 hours to learn a new skill, so be patient with yourself, schedule and then re-schedule every couple of weeks. Plan accordingly and with your daily activities. Remember that 15-30minutes a day is easier to do than 1 hour every couple of days, so break up the activities in a project plan.

Examples for project ideas are:

• As a software engineer, I’d build the website.
• As a quality assurance engineer, I'd test the website.
• As a release engineer, I’d deploy to a cloud provider.
• As a purple team security professional, I’d configure controls to protect the website.
• As a blue team security professional, I’d alert on indicators of compromises (IoC) or threats.
• As a red team security professional, I'd exploit it.

As an aspiring security professional, you may think that building a website will take too much time away from your original goal. The beauty of open source projects is that you do not need to recreate the wheel.?

If the path is quality engineering, find a website or application type that’s interesting and use tools and methodologies to test it. The same goes for security professionals, find an open source website project and perform the security fields tools and techniques (with respects to the disclaimers and owners).

The goal is to have a project that you can work to accomplish that provides:

• A method for growth and confidence in that field.
• Acquiring knowledge and expertise in a field of choice.
• Sharing the knowledge and demonstrating subject matter expertise.
• Design a project with industry best practices, standards, and regulations.
• Topics to discuss during interviews or networking.
• “Doing the job, before you get the job.”

1. LinkedIn Profile

As mentioned previously, LinkedIn profile is an article subject on its own. The short and sweet version is that LinkedIn is a network you can lean on for growth and exploration of next opportunities. This is an important tool in your career hunting belt.?

The LinkedIn Profile has replaced resumes these days. Keywords, SEO, and algorithms are plugging into your profile to essentially guide recruiters, job postings, and networking opportunities to your feed. Do your due diligence to the LinkedIn algorithm and take advantage of the features your account provides, such as headliner, banner, “talks about”, About me, featured, and others. Take a moment and explore the LinkedIn options in the profile section to see which meets the needs of your personal branding.

To help guide the direction of designing your profile, I recommend using the Job functionality to find your top next positions and your top next company. If you’re lucky, you might find your dream position at your dream company. This is the goal, but it might take a few steps. Once you determine your next career moves, I suggest the following.

Side note, you do not need 100% of the requirements in a job description, nor do you need to have 80% or 50%. If you get excited about an opportunity, establish your brand around the career and reach out to connect with folks that could help you.

From the Job postings,

• Review each job description (JB)
• Highlight technology, concepts, and methodologies (TCM) in the JB?
• Any that you are unfamiliar with, add the TCMs to your project and study plans
• Any that you are familiar with, use these TCM in the description of the work you’ve previously done
• If your work is unrelated to the tech industry, heavily highlight any soft skills mentioned and leverage your project to focus on the TCM you’re unfamiliar with.

For the dream companies,

• Locate them in the search bar and start following their content
• Search for recruiters at the company and begin to establish relationships with them.?
• For the introverted reader, you can send a connection request with an elevator pitch stating you are interested in moving to position X and you want to connect and see the best ways to enter the company, whether it’s through internship, outreach program, training, etc.
• At minimum, you should connect with the recruiter and build to big relationships, keeping an eye out for positions you are interested in.
• By following recruiters and the company, you may find useful opportunities to establish relationships with members in the company such as hiring fairs, outreach events, or simplifying being active and respectful on their posts.

If you are itching with anticipation to get started and want further guidelines, I highly recommend the Cyber Security Personal Branding course from CyberLife School. While the course was designed for cybersecurity professionals, its return on investment comes from the tips and tricks on how to design your LinkedIn profile via your brand and leverage tools, such as Canva, to create your profile photo and profile banner.

On a privacy and security note, take a moment to review the settings for your LinkedIn account. Besides the recommended security controls, such as MFA and recovery, LinkedIn has features that allow you to have a public profile while remaining anonymous, and restrict visibility, permissions, and interaction with your account. Many of my men-tees are shocked to see the level of control permitted on the public profile settings.?

The goal is to create a personal profile on LinkedIn that reflects your brand, your next career goal, and yourself. It’s a great tool to connect with people and companies and help iron out the details?

1. Share your knowledge as you learn?

This section is all about creating your content to share. The content can be in whichever medium you choose, such as commits to your projects with details on the new enhancements or patch, a retrospective of what you learned, user guide, or a demo video showing the feature in action.?

If you’re studying for an exam or certification – or even those TCM you are unfamiliar with – you can take notes during your research and share it. You’d be surprised how helpful this could be. I’ve had moments in which an issue I needed to solve was found through a LinkedIn post.?

The goal is to use your digital portfolio to share your knowledge and know-how, even if you do not have any professional experience with it.

The Closure

As a software engineer or cybersecurity professional, the details you share on your learning can fill the gaps for the technical skills you may not have acquired yet. It takes 20 hours to learn a new skill, so be patient with yourself, schedule and then re-schedule every couple of weeks. Plan accordingly and with your daily activities. Remember that 15-30minutes a day is easier to do than 1 hour every week, so break up the activities and project plans.?

A digital portfolio can assist any individual looking to transition to a software engineer or cyber security profession. It can tell a technically skilled person and a subject matter expert before an interview is scheduled with you. The digital portfolio can reflect your career goals, branding, and personal values you hold dear to connect you with companies and individuals to network with.

As for content for your digital portfolio, remember that focusing your attention on a project to fulfill and learn the skills you’d need for the next position helps prepare you for the interview and the job itself.?

?Examples of project ideas is:

• As a software engineer, I’d build a website.
• As a quality assurance engineer, I'd test the website.
• As a release engineer, I’d deploy my website to a cloud provider.
• As a purple team security professional, I’d configure controls to protect the website.
• As a blue team security professional, I’d alert on indicators of compromises (IoC) or threats.
• As a red team security professional, I'd exploit it.

For your next piece of content, I employ you to share this article on your LinkedIn page with your top 3 takeaways for your network to see. You never know who might be looking for the answers in this article.

Still need help? Not sure where to start?

Can’t think of a project or need assistance? Check out the Latinas In Cyber (LAIC) Volunteer page to see how you can give back. If you’re interested in joining a mentoring cohort, sign up at www.latinasincyber.com to hear the latest news on the upcoming cohort mentoring program.?

For exclusive one-on-one career coaching, check out Career Coaching under Products in www.cyberjiujiteira.com.