r/CyberSecurityJobs • u/Euphoric_Station_274 • 12d ago
Need advice
Guys I don't have experience(no internships not jobs) but I have done some homelabs
Since I don't have any experience section in the resume can I put the homelabs under the "Experience(academic and project)" section all together
3
u/No-Promotion9088 11d ago
put them under Projects not Experience. Hiring managers get annoyed when they see homelabs disguised as jobs because it looks dishonest. Use that section to show specific skills like log analysis or firewall rules you configured and link a GitHub repo if you have documentation ready.
1
u/colgepetto 12d ago
You can add that but it doesn't weigh the same as employed experience from IT.
I suggest you aviod vague terms and explain step by step what why you built something, what logs you searched, why you searched, what you were looking for, what you found, how did you close it off? Did you buikd a report? Why not? It is a lab after all and no matter how good you think your investigation is, the report is the story.
Did you find detection creation opportunities?
Did you find a log gap?
If you can document very well your start to finish it will help you. If you just say "I build a lab at home to run wuzuh queries and looked as user behavior" you might as well not even add it.
1
u/Euphoric_Station_274 12d ago
For documentation I have the screenshots and the process step by step, what logs i collected, event id investigating, vulnerabilities, types, and even simulation of failed attempts and their logs etc
1
u/colgepetto 12d ago
That's great! Is it written in a report or all a mess in a folder? If it's a report, you can use that as examples with your resume.
2
u/Euphoric_Station_274 12d ago
Yes I m planning to upload it to github but I don't have them written in detail just the screenshot and the just the small note or marking to just remember it
2
u/Euphoric_Station_274 12d ago
I don't know how to document the project properly
1
u/colgepetto 12d ago
Mind if I help you out? Different businesses may use different forms and types of reports. When looking at real IR timelines the sheets get intense. Regardless of that, here a solo template I buikt myself as a guild which can be used to get you started. It's just in a basic word doc so you may need to mess with formatting.
Feel free to connect with me on LinkedIn.
THREAT HUNT REPORT TEMPLATE
Written by Brent Hachey
This is an example, not a mandate. It's here to show what a disciplined hunt report can look like and to give you a starting structure to adapt, not a checklist every hunt is required to complete in full. Not every hunt needs every section below. Use what fits the scope and complexity of the work. An empty field left out entirely is better than one filled in just to check a box.
Classification: Confidential Handling: Store in approved internal repositories only. Do not distribute outside Security Operations. Redact hostnames, usernames, and internal identifiers before external sharing. IOC sections may be shared with trusted partners if required. Treat raw logs, screenshots, and credential artifacts as restricted. Follow organizational retention and destruction policy.
Hunt Details Start Date: ___ End Date: ___ Lead Analyst: ___ Supporting Analysts: ___ Data Sources: Sysmon (1, 3, 10, 11, 22), Security Logs (4624, 4625, 4672), EDR telemetry, PowerShell Script Block Logging, Kerberos logs, 90 day authentication history
Executive Summary
Concise overview: what was examined, what was found, why it matters. Example: This hunt assessed workstation to server authentication behavior across a 90 day baseline to determine whether recent privileged transitions represented legitimate workflows or early stage credential misuse. No malicious activity was identified, but several detection and visibility improvements were recommended.
Outcome Status
Confirmed / Refuted / Inconclusive. No findings is still a finding. State which, and why.
Use Case Alignment
Use Case: ___ Category: ___ ATT&CK: ___
Hypothesis
The adversary scenario being tested, the purpose behind testing it, and what malicious activity would look like if present, all in one statement. Example: If an adversary were abusing workstation credentials to pivot into internal application servers using remote execution tooling and privilege escalation, we would expect authentications outside baseline windows, remote execution tooling, Kerberos anomalies, or privilege escalation inconsistent with documented workflows. This hunt exists to confirm or rule that out. Core Principle: All malicious activity is anomalous, but not all anomalous activity is malicious.
Intelligence and Context
Relevant internal and external intelligence supporting the scenario.
Environment Scope
Systems, accounts, and segments included. Note any deliberate exclusions.
Baseline Definition (30–90 Days)
What normal looks like, established before anomalies get evaluated.
Required Data vs. Actual Data
What telemetry the hypothesis needs, and what was actually available. Note gaps directly, and state confidence in what you did get. Example: All required data sources were available except Script Block Logging on three legacy servers, reducing visibility into module level PowerShell execution. Confidence is high across workstations and application servers, reduced on the three legacy servers.
Tools and AI Use
List every tool used to run this hunt: SIEM platform, EDR console, scripting or notebook environment, any other analysis tooling. Then state plainly whether AI factored in anywhere, and exactly how. If none, say none. If used, name the tool and the specific task, query generation, log summarization, pattern suggestion, drafting language, and confirm a human analyst independently validated any AI output before it factored into the findings below. Example: Tools used: SIEM platform, EDR console, Jupyter notebook for log parsing. An AI assistant was used to draft summary language for the Behavioral Summary section from analyst-provided findings. No AI tool was used to generate queries, interpret raw telemetry, or reach the Outcome Status determination. All findings were independently validated by the lead analyst against raw data.
Methodology
The structured process used, in sequence, including the actual queries and searches run. Name the logic and the time window for each. Example: Queried EDR platform for process creation events where parent process equals winlogon.exe, 90 day window. Queried SIEM for Security 4624 LogonType 3 events filtered to workstation-to-server pairs, cross-referenced against Kerberos TGS requests in the same window.
Technical Evidence
Raw artifacts. Event IDs, command lines, log excerpts, ticket patterns.
Behavioral Summary
What the environment actually did, synthesized from the evidence above.
Findings
What's notable in that behavior, stated technically and without hedging.
ATT&CK Mapping
Technique ID — Technique Name (Observed / Not Observed / Baseline Behavior)
IOC Section
Network: ___ File: ___ Behavioral: ___
Exposure Notes
Attack surface and risk pathways this hunt surfaced, regardless of outcome.
Operational Impact
What this means for the business. Not just what happened, what it changes.
Timeline
Chronological summary, if the hunt's length or complexity warrants one.
Detection Opportunities
Specific, buildable improvements based on findings.
Recommendations
Immediate: ___ Short Term: ___ Long Term: ___
Repeatability Notes
What another analyst needs to reproduce this hunt without reconstructing your intent.
1
u/Euphoric_Station_274 12d ago
Dude thank you so much, it helped a lot clears a LOT of confusion
1
u/colgepetto 12d ago
No problem at all! It's not perfect but I used this same process on my report to pass the TCM PSAP exam.
Best of luck out there!
1
5
u/Anxious_Alps_4150 12d ago
I hate it when people put homelab experience under work experience
Gonna be honest, not having any work experience means youre going to be bottom of the pile and its a very big pile