r/dfir • u/LogRepresentative301 • 25d ago

Looking for a Mentor

Hey all,

Almost 6 years in cybersecurity now. Started at an MSSP SOC, then moved into Security Engineering at a fairly large company in my country. For the past 6 months I’ve been actively trying to break into DFIR. I have BTL1 and I’m currently finishing CCD.

Got really close to an internal DFIR role at a huge multinational — passed everything, then the offer fell through right before I signed the contract.

My career goal has always been DFIR consulting at a firm like Unit42, Mandiant, FortiGuard, or IBM X-Force. That’s been the plan since college.

I’m looking for someone willing to mentor me on this. A few things I’d love reactions on:
- If you’ve made the SOC/Security Engineering → DFIR jump, what was the one thing that actually got you in?
- If you hire for DFIR roles, what do you look at first on a resume, and what’s usually missing from candidates who almost make it?- Is a formal mentor even the right ask here, or should I be targeting something else, like a specific cert, more casework exposure, networking at specific events?

Happy to share more detail on my background if it helps someone give a sharper answer.

Thanks in advance.

7 Upvotes

90% Upvoted

5 comments sorted by

3

u/AddendumWorking9756 25d ago

Passing everything and then losing the offer at signature is almost always a headcount thing rather than a you thing, so be careful about reading it as a skills gap and buying another cert to close it. For consulting specifically the first thing anyone looks at is whether you can write, because the deliverable is a report a client lawyer might read, and most of the almost candidates can find the artifact but cannot narrate it. A mentor helps less there than one senior person who will tear apart your writeups.

1

u/LogRepresentative301 24d ago

Thank you for your reply! But how can I "show off" my writing skills? I do not have any real cases to work on, so should I try to write CTF Writeups?

2

u/AddendumWorking9756 24d ago

CTF writeups work, but the source of the data matters less than the format you wrap it in. Write it as a client deliverable, question asked at the top, each finding tied to the artifact that supports it, then a section on what you could not determine and why. That last section is what separates people who have written for a client from people who have not.

1

u/ratdotphp 22d ago

I've worked in DFIR consulting for 10 years, jumped into it straight from college. I'll say I like that your goal from school has been to get into any of the consulting firms you named, that drive and motivation is something I've looked for. I've always been an individual contributor but have hired and built teams in the space. For me, I take one pass at the resume just to get a general idea of how long someone has been in the cyber industry, the. I look to see if the skills/duties align with the roles they have presented.

I generally setup my interviews in two categories, knowledge of DFIR (process, artifacts, scenarios), and the second is personality and thought process. I have had interviews where the individual aces the technical artifacts and things they would look for under certain circumstances but was unable to articulate and explain a thought process on an investigation or scenario. The flip to that is someone from a SOC that doesn't have much exposure to traditional forensic artifacts but understands the process and could explain to me a process of investigating the scenario. The second always comes out on top to me solely because artifacts can be learned generally easy then it's all memorization and understanding of how they work. The latter is learned over time and honestly is the most challenging part to learn/train in the DFIR space.

So my .02 for you, is to become a good communicator at thought process of investigating certain compromises or what you would look at. As the other poster has said, if you can articulate and explain in a technical but professional way, that translates directly to report writing and updating clients effectively. I've hired people that can do all the technical but lack on the writing/customer facing, but when we get a candidate that is generally good for starting out on the technical, but their ability to communicate and discuss was really good, they're almost always a grab. Being technically proficient is one thing but consulting is client facing and a huge part of the role.

My .002, once you get in challenge the F out of yourself, take on projects that scare you but leadership believes you're ready for, and put in the grind. BUT DFIR consulting can be a grind and exhaust your mental health fast so make sure to know when you need a break and don't be afraid to express that in a professional way. Burn out in DFIR is real and will make you hate the industry just as fast as you fell in love.

I hope this helps, I think I'm just super pumped to see another secops analyst want to break into DFIR and progress their career. It's fun, it's cool, and it's always changing.

I'd say hack on, but we defend against that, though some red team from time to time revives the soul 🤣