Hey guys,

I graduate soon and I am hoping to work in cloud engineering and or cloud security roles in the future. I know that is unrealistic out of school, I am hoping to work in a security role or even IAM role if possible. What would be the best path to go down to land a role that gets me closer to cloud sec? Certs? Projects?

Any advice is appreciated.

Resume: [

NAME REDACTED]

[Location Redacted] | [Email Redacted] | [Phone Redacted] | [LinkedIn] | [GitHub]

PROFESSIONAL EXPERIENCE

International Law Firm
Network Operations / Security Operations Intern
June 2026 – Present

• Monitored and investigated security alerts in IBM QRadar and CrowdStrike Falcon Next-Gen SIEM, using OTX/X-Force threat intelligence, OSINT, and log analysis to investigate large outbound transfers, malicious IPs, and impossible-travel events.
• Analyzed Duo MFA authentication logs to triage identity-related security alerts and investigate suspicious authentication activity.
• Investigated phishing and email threats using Proofpoint, Abnormal AI, and Proofpoint Threat Response; analyzed email headers, decoded suspicious URLs, evaluated links using OSINT, and blocked malicious senders.
• Provisioned Windows servers across four global sites and administered Active Directory, including OU placement, least-privilege security groups, and PowerShell-based user lifecycle management.
• Managed hybrid Exchange and Microsoft 365 mailbox access, remediated vulnerabilities identified through Qualys, and supported a VMware-to-Hyper-V migration.

Government Agency
Help Desk Technician Intern
September 2025 – June 2026

• Resolved 50+ weekly ServiceNow tickets supporting 250 users across Windows endpoints, operating systems, VPN connectivity, and network access; documented troubleshooting and remediation.
• Supported user onboarding and offboarding through Active Directory provisioning, MFA enrollment, access reviews, and standardized asset tracking.

Healthcare Organization
IT Security Intern
February 2025 – August 2025

• Triaged phishing incidents using Mimecast, investigated high-risk accounts using CrowdStrike Falcon and Zscaler, and documented indicators of compromise (IOCs) and incident findings incorporated into team playbooks.

PROJECTS

Hybrid Identity & Security Homelab
Proxmox, Microsoft Entra ID, Wazuh | 2026

• Built a private Proxmox homelab and separate Azure workload; automated Active Directory user management and AGDLP-secured SMB shares using PowerShell and provisioned infrastructure with Terraform.
• Scoped Entra Connect synchronization to lab identities and published an internal Nginx application through Microsoft Entra Application Proxy using group assignments, Conditional Access, and MFA without exposing inbound ports.
• Centralized security telemetry from five Windows and Linux agents in Wazuh; tested custom detections for Active Directory changes, ADSync service interruptions, repeated SMB authentication failures, and sudo activity. Isolated Kali testing on a no-route network bridge.

Infrastructure CI/CD Pipeline
Terraform, GitHub Actions, Azure | 2026

• Built GitHub Actions CI workflows for Azure and Proxmox Terraform configurations, automatically running formatting, backend-free initialization, and validation checks on pull requests and main-branch changes.
• Provisioned Azure infrastructure using Terraform, including a virtual network, network security group, public IP, Linux virtual machine, Key Vault, and Storage Account; configured managed identity and least-privilege Key Vault RBAC.

CERTIFICATIONS

• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Azure Fundamentals (AZ-900)
• CompTIA Security+
• CompTIA Network+

EDUCATION

[College Name Redacted]
Bachelor of Science in Information Technology
Expected Graduation: May 2027
GPA: 3.97 | Dean's List: 2024–2026

TECHNICAL SKILLS

Infrastructure & Automation: Terraform, Bicep, GitHub Actions, PowerShell, Bash, Python, Proxmox, VMware, Hyper-V

Identity & Cloud: Active Directory, Microsoft Entra ID, Entra Connect, Microsoft 365, Exchange, Azure RBAC, Azure Policy, Key Vault

Security & Operations: IBM QRadar, CrowdStrike Falcon Next-Gen SIEM, CrowdStrike Falcon, Microsoft Sentinel, Wazuh, Proofpoint, Proofpoint Threat Response, Abnormal AI, Mimecast, Qualys, Zscaler, Duo MFA, KQL, ServiceNow

Networking: DNS, DHCP, VPN, Azure VNets, VNet Peering, NSGs, UDRs, Network Virtual Appliances, Wireshark, Samba

So here is the situation I am in. I’m having surgery next week on my spine. And because of that I am out of work for at absolute minimum 3 months and then after that an absolute minimum of another 3 months of extreme light duty, that’s if they even clear me to return to my regular job, which is pretty physical in nature. So instead of sitting here doing nothing, I’ve decided to try to learn a new career field. I want to learn cybersecurity in all forms. I have one friend who is in the field and says I would be good at it and it allows me to use my brain instead of my back. She also says that self teaching is the best way to go and to get certifications on my own and keep learning. But I have 2 issues.

One: I have no PC at all, let alone a set up to run a basic cybersecurity programs. So if anyone has any information on how I can obtain an entry level gaming PC for free or donation. I know they are obscenely expensive. And I know this is a HUGE ask of anyone. But being on short term disability, my funds are extremely limited. I can’t lose employment and don’t want to sit around and wallow in self pity. I want to get out in front of things so I can provide for my kids.

Secondly: I would like not only the basic certifications, but specialized certifications that are needed for all fields of cybersecurity. Any directions or free resources for information would be fantastic.

Thank you for reading and any information that you can give.

I came to my senses before i gave them my banking info. What should I do now? They got my full name DOB address email ph# SIN number

I had my discord and claude session keys leaked. I discovered this because friends notified me of me sending them MRBeast Crypto Scams lol.

Malwarebytes found about 20 trojans.renpy which I now deleted. Currently malwarebytes (+rootkits), hitmanpro, and windows defender (+offline scan) detect nothing.

I also changed all my passwords and logged out of all devices on accounts and stuff I had connected to this laptop.

Do I also need to reinstall windows? I’m a bit scared something is still lingering around, but I also have a lot of documents for school which I don’t want to lose. I also don’t have a usb stick to back these up to so I would have to buy one so I could do it. For peace of mind I even might btw. But is it still recommended?

Dm if interested

Hi there,

I recently got my first tech/cyber role out of college in threat intel/vulnerability management. It took me 18 months to get a role but it pays well ($83k) starting out. Honestly I’m very proud of myself because I’m essentially self-taught, and was able to get through a pretty rigorous interview that went super in-depth on web-app vulnerabilities.

My main goal is to get into pentesting. So far I’ve been doing web security labs through PortSwigger, completed the CPTS path on HTB (taking the exam in December), and publish writeups on my solved boxes on Medium. I also go to local security meetups, though I haven’t turned that into any direct industry connections yet.

After CPTS I’m planning to go for CRTO/OSCP, and eventually GWAPT since web app testing is a smaller part of my current role and my employer covers the cost of GIAC certs.

I’m planning to stay in my current role for another year or two to build up more experience and finish CPTS/OSCP before I start applying — want a stronger resume and more runway before I make the jump. Does that timeline make sense, or should I be applying sooner/in parallel?

Any other advice is welcome. Thanks!

What’s up guys!

I was in a coffee shop just now on an unsecured network. I try to avoid those but I had to get some work done. I noticed in the corner the download button was going, and I clicked it to see what it was . It was a file called “proactive chat” or “protective chat.” Can’t remember which one but I have a screenshot if needed.

I quickly cancelled the download and cleared it, then I went to my Finder to see if there were any downloads I didn’t recognize. Switched to hot spot as well. Confirmed I didn’t see any, and then shut off my computer.

Should I be concerned? What else should I look for? Help!

Hi I just got a text message saying "Your OnePay verification code is: #$#$#$. Don not share you password, PIN or verification code with anyone." I didnt write the actual number here for obvious reasons. Is this just a bullshit warning or do I need to do something about this? I never heard of OnePay before and don't have an account with them.

I will try to be a short as possible. My daughter, 25, lives with her husband about 7 1/2 hours from us. All of our Apple devices are basically connected through the same Apple account. There is a woman about 2 to 3 years younger than my daughter that is INFATUATED with her. The other night my wife and I were sitting watching TV and my wife's Ipad lit up. It said that the girl in question would be notified when my daughter left her apartment complex. I got upset but wife said to keep my mouth shut as she did not want my daughter to know we see some of her messages and also some of her calls. Some not all. My question is how can I go about getting the tracker off her phone, if that is possible? Can I call Verizon and see if they have the ability to block it or remove it? My daughter told her mom just this weekend that this other girl scares her because she is overly possessive and infatuated with her and just plain comes out and makes her feel very uncomfortable. Any suggestions would be appreciated. I worked in IT and IT security and retired 11 years ago so I am really not up on phone security. Thanks

Hi I'm new to cyber, picked hackthebox and started some labs and challenges.

Yesterday i tried a challenge of small web app which i had to exploit.

Even after providing a solution i found in bash script, i asked claude just to convert it to js script it refused. same with gemini.

Are there any dedicated ai tools for those tasks?

What’s up guys!

I was in a coffee shop just now on an unsecured network. I try to avoid those but I had to get some work done. I noticed in the corner the download button was going, and I clicked it to see what it was . It was a file called “proactive chat” or “protective chat.” Can’t remember which one but I have a screenshot if needed.

I quickly cancelled the download and cleared it, then I went to my Finder to see if there were any downloads I didn’t recognize. Switched to hot spot as well. Confirmed I didn’t see any, and then shut off my computer.

Should I be concerned? What else should I look for? Help!

Please please help me out 🙏

Just wanted to ask the more experienced web app pentesters here for some advice.

I've studied web app pentesting through courses like CWES and others, so I'm familiar with different vulnerabilities and exploitation techniques, but I know studying them and actually testing real-world applications are two different things.

I have a few questions:

1. What are the most important things to keep in mind when doing a web app pentest? What are some things you wish you knew when you were starting out? Any common mistakes beginners tend to make?
2. How do you guys actually approach a web app pentest? Do you start by manually exploring the application and checking requests in Burp, or do you use automated tools early on? Just curious about your usual workflow.
3. When do you actually use Burp's active scan? Do you run it after manually testing everything, or do you use it throughout the engagement? I know it can help find vulnerabilities, but I'm curious how much you guys rely on it.
4. Is it safe to run active scans against production applications? This is something I'm a bit unsure about. Since active scans send payloads to test for vulnerabilities, couldn't they potentially modify or delete data or even affect the application? Do you guys run them on production, or do you usually avoid them unless specifically approved by the client?
5. What about Burp's passive scanning and audit features? Are there any features or settings you avoid using on production environments? I'm still trying to understand which tools are safe to use during normal testing and which ones require more caution.
6. What separates a good web app pentester from someone who just knows how to find common vulnerabilities? Is it mostly experience, understanding business logic, testing access controls, or something else entirely?

Would appreciate any advice from people who've been doing this for a while! Just want to get a better idea of how things work in actual engagements instead of relying too much on what I've learned from courses. Thanks!

quick note: the grammar and everything was enhanced by AI, I asked it to do it since my english probably isn't that great..

Our cyber renewal is in 9 weeks and the questionnaire came back with a request for supporting evidence against most of the answers. Last year we ticked boxes and signed it but I guess this year that doesn't do the job anymore (understandably so), we need to provide exports, screenshots, etc, and that tangible proof is a prerequisite to the premium quote.

I'm filling the form slowly, they first asked for a list of privileged accounts with proof of MFA enforcement. Our shared and admin credentials sit in a Passwork vault, so I pulled a per-user access export showing who holds what and when they last used it which was easy enough. Then, they asked for MFA coverage across every system, as a percentage. Entra gave me a decent MFA report. Our ERP has its own MFA that reports nothing useful, the warehouse system logs it in a format I can’t export, and 2 smaller SaaS tools show enrolment per user with no aggregate view. TL;DR, I have 4 sources that don’t reconcile.

We run nightly backups and the jobs succeed, and nobody has done a documented full restore test in about 11 months. From what I’ve read untested backups get treated as nonexistent at underwriting, so that’s yet another gap I need to close.Should I build a manual evidence pack this cycle and fix the reporting properly afterwards? Or push the renewal date back and do it once? 9 weeks feels tight for a restore test plus reconciling MFA across four systems. Any guidance is appreciated!

I need help where to flag stuff like this

i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it.

my app is aiming to be fully client-side. things like javascript seem like it would relatively easy for an AI to chew-up, my latest project is in rust, which would make it harder for a person, but AI can digest binaries.

i created a fairly unique p2p messaging app. a Rust-based frontend with a Git-server backend, which can be used to establish a P2P connection. while this version remains close-source, i have aimed to create the most comprehensive documentation (formal-verification and security audits too (all ai generated under my guidance)).

1. https://glitr.io
2. https://app.glitr.io

a core detail to my project is the focus on local-first and client-side cryptography and storage. id wanted to learn how vulnerable this project is to decompilation. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend... i dont think it even slowed it down.

i dont know much about decompiling, but i think the TUI would be the easiest for it to decompile and given its largly one codebase, it can be used to trace and see whats going on the build for the other platforms.

it might be that all close source is obselete. i tried asking here, and the responses there are polar opposites, so i decided to get some first-hand experience.

im using using cursor composer 2.5 (far from the frontier models available). i used https://github.com/morluto/rea and gave it a few binaries of my project (tui, apk, web) and pointed it to the documentation on the website.

after a few prompts, it seems to have done a decent job decompiling the project here: https://github.com/positive-intentions/glitr-decompiled (note: this is basically AI-slop). like with many projects, i see AI lacks taste in architecture. it consolidates a lot of complexity into one repo, when in my project it's split into multiple repos. it also seems to lack a bunch of bells and whistles i added for my own benefit like formal verification and rigorous unit-tests (having done it myself before, i dont think that is a large gap to fill for somone who knows what they are doing). i think the overhead to keep up with new changes may become trivial if you can automate the process. i kinda offer the base in the repo above (maybe it saves you a few tokens?), but its for my own research and i dont plan to maintain it given it undermines the actual project.

in general, im impressed. it seems this may push forward my timeline for when i open source my project, i wasnt expecting close-source being so easy to undemine. while the project can be decompiled, in a project like this, its important to consider the countless nuances there are in cybersecurity. the code is only a part of the project.

(note: feel free to try decompile this yourself or offer tips on how i can improve. id be keen to see what can be done. feel free to reach out for clarity about how it works within the limitation of the original source code not being used)