people
Edmund Hughes (@its_rad_io)
Why you should want to interview me: an open cover letter.
The Certified Defensive Security Analyst (CDSA) exam has been the most interesting and engaging challenge I’ve encountered in my educational journey so far. Though the exam was only a week long, it was enough to give me a taste of what it will be like to work in a SOC. The exam consists of a 7-day-long simulated incident response. The candidate must investigate and report on two separate, unrelated security incidents within time limit. I loved it–the data, the puzzle, the tension of knowing I had to find answers even though I didn’t know how I would find answers, then sifting through the data, slowly and surely finding answers. The feeling of resolving that tension is hard to beat.
The exam has a quality that is not found in any CTFs or other forensics challenges: Ambiguity. Sure, most forensics CTFs involve some ambiguity, but their mere inclusion of questions focuses the direction of the investigation and the ability to submit flags confirms whether an answer is right or wrong. Find all the flags, get all the points, you’re finished. The CDSA exam lacks these guardrails for one of the two simulated incidents, necessitating a completely self-directed investigation and reporting process. I understand why not all CTFs can function like this (the grading would be far too inefficient), but the ambiguity added a level of responsibility and pressure that were, on their own, well worth the price tag of the exam. If Hack The Box offered a second version of the exam with different data and prompts, I would genuinely pay to take it again for the experience.
As I apply for jobs, I am adding skills and expanding my knowledge base by working toward another certification from Hack The Box (HTB), their Certified Bug Bounty Hunter (CBBH) cert, solving their retired forensics challenges, and creating technical write-ups. This training regiment is good, but it is no substitute for what I could be learning an a roll as a SOC Analyst. I chose HTB’s CDSA because of its focus on practical, hands-on learning and testing. I made the right choice. Hack The Box delivered in spades, and so did I. I proved my skills in a simulated environment. It’s time for me to prove myself in the real world.
I have the skills. I have the knowledge. I have the drive. All I need is a steady stream of alerts to investigate and reports to write. If you employ SOC Analysts or incident responders, I want to investigate your alerts and incidents and write reports about them. I can’t share my report from the CDSA exam for TOS reasons, but check out some of my write-ups for samples of my work. If you think your team could use someone like me, drop an email to edmund@itsrad.io or a DM to me on X.
In 2017, I graduated from Virginia Tech with a degree in Mechanical Engineering. Throughout the next 7 years, I gained experience in mechanical, electrical, and civil engineering. Around 2022, I discovered the world of cybersecurity when I began reading about crypto heists, nation-state threats, and the crimes committed by various “coms”. Andy Greenberg’s books Sandworm and Tracers In The Dark were especially formative for me in making the decision to pursue cybersecurity. As I became more familiar with the field from an outside perspective, I couldn’t help but feel the desire to become an insider. Every time I read a book about information security, watched a DefCon talk on YouTube, or read an article about some new ransomware strain, I felt a palpable desire to be a part of that world. Then, one day I ran across Jack Rhysider’s The Art Of Solving Novel Problems in IT Security. He describes how in IT security, you’re not just solving problems, but solving novel problems, and that as an information security practitioner, that’s the skill that you’re really trying to hone: being able to solve problems that you–and maybe no one–has ever seen before. I knew right then, that’s what I wanted to do with my life.
After a good deal of planning and learning about IT and security alongside my full-time engineering job, I decided to take the plunge and go back to school. I quit my job and started a master’s program at Southern Utah University, which was conveniently located in the town I was living in at the time (though I have since moved out of the state). I graduated with a Masters degree in Cybersecurity in fall 2024, and since then I have been job hunting and figuring out what to do now that I have made this monumental shift.
The degree program was a great official introduction to the world of infosec on the theoretical side, but fairly light on any technical training. I had already self-taught some technical skills, but I wanted to be sure I’d measure up in the industry. Because of that I decided to get a technical certification.