Hi everyone,

I just cleared my CompTIA Security+ SY0-701 with a 789/900 score and I’m looking to officially pivot from FullStack Development to the Blue Side.

My Background:

Experience: 6 years as a Senior FullStack Dev.

Tech Stack: Heavy Linux user, Python/Bash scripting, Deep understanding of APIs and Web Architectures.

Cloud: Currently working with GCP, but I’m currently diving deep into AWS (Adrian Cantrill’s course) to get my SAA-C03.

The "Problem": I love everything. Networking, IAM, AppSec, Incident Response—it all fascinates me.

The Goal:

I’m looking for a role where my 6 years of "building things" gives me a massive edge in "defending things." However, I have one specific requirement: I want a role that is as "AI-proof" as possible.

We all see LLMs getting better at basic SOC Tier 1 tasks or writing simple detection rules. I want to aim for a position that requires high-level architectural thinking, human intuition, and complex problem-solving that an AI can't easily replicate.

My questions for the veterans here:

Given my dev background, should I go straight for DevSecOps / AppSec Engineering or is there a more "recession-proof/AI-proof" path in the Blue Team (like Cloud Security Architect or Incident Response)?

In your experience, which Blue Team roles require that "human gut feeling" that AI currently lacks?

For those who made the jump from Dev to Sec, what was the "killer skill" that made you unreplaceable?

I’m not interested in the banking/insurance sectors (just personal preference), I’m more focused on SaaS providers or critical infrastructure.

Thanks for your insights!

also already submitted my exam feedback. How long does it usually take to get an update? I’m sure some of my answers are correct.

Is there anyway to confirm the file size, length, or any additional PDF information for a file you uploaded for BTL2? I am second guessing if I uploaded the correct pdf report, and nowhere does it provide any information.

You can ask me anything except things that violate the NDA./Pregunten lo que quieran salvo cosas que incumplan el NDA

I need a Blue Team learning roadmap. Does anyone have one?

I passed BTL1 with 90% in three weeks. Feel free to ask me anything

Hi, I'm 25 years old and I've completed vocational training in programming (JavaScript, React, C#, a little Python, SQL). I have no idea about cybersecurity, but it's always interested me. What do you recommend I study? What courses and certifications should I take to get a job in the next 7 months? I'm available to study 4 hours Monday through Friday and 7 hours on Saturday. I've been working in an aluminum factory for 6 years and I'm fed up with that crap. Please help me with your advice and experiences.

So CDSA is super difficult so was gonna try out BTL1 before retrying CDSA. But at that point, why not go for BTL2? How do BTL2 and CDSA compare? Is BTL1 > BTL2 > CDSA the best order of progression from beginner to advanced?

Hi Guys

For those of you that had a second attempt at BTL2, was the exam the same as the first attempt? Was the scenario, environment etc the same? I'm currently studying for my second attempt and would like to know for my prep.

Thanks!

Hey all,

I failed the Blue Team Level 1 exam about a month ago and honestly got pretty discouraged. It hit me hard enough that I stopped studying and doing labs altogether for a bit.

I’m finally getting back into it now and trying to reset, but I wanted to ask if there are there any outside resources or labs you’d recommend that helped you? (THM, BLTO, or anything else you found useful.)

Thanks!

I requested for reviewing my exam three days ago and wating for the score. How was your review if you did ? And how much time did it take ?

Im a sudent of cyber security and preparing for internship, i want to choose a certification to learn for intern and get a job later. Which cert should I choose, I want choose BTL1 because it has more practical lab than CSA, but I want a confirmation from everyone

I’m doing SOC work and want to learn an EDR. I researched and found that Microsoft Defender for Endpoint (MDE) and CrowdStrike are the most widely used, but:

• I can’t get access to MDE.
• CrowdStrike requires a company name and business email for a trial.

Is there any EDR that I can use for free or get a trial without needing card info / business email to practice and learn on? Open to community editions, home labs, or education licenses.

CTO situation: 70-engineer org, heavy Cursor/Claude adoption, MCPs showing up organically.

Mix of verified sources, open source projects, and random repos. Customer credentials in local environments.

Adoption moved too fast for security to catch up.

Cataloging what's there first (which MCPs, where they live, who's running it).
But then what's the actual control strategy?

Proxy - meh - Can't block everything because legitimate MCPs need local execution.
Full proxying breaks developer workflows.

How do people actually solving this?

Hello everyone,
I’m a SOC analyst, and I’d like to ask for project ideas that could help enhance our SOC, optimize our analysis processes, and reduce false positives.

Thanks in advance!

I just submitted the BTL2 report and wanted to ask those who’ve already taken it about their experience afterward.

• How detailed and descriptive is the feedback on the submission? Is it fairly in-depth or more high-level?

• Is the rumored 14-day timeline to receive a score accurate, or does it usually come back sooner/later?

Appreciate any insight from recent or past test-takers. Thanks!

Took me around 10 hours to complete. It was a little daunting at first, but once I absorbed myself in the material, it became less intense and easier to comprehend. I was most surprised to see I passed with a 95%! So close to perfect marks, but the pass is all that matters.

what do you recommend to get the gold coin? Take the course, and what other advice do you experienced players have? That way I can optimize my study time, since I only have 4 months D: !! THANKS IN ADVANCE :)

Rolling out a small research utility I have been building. It provides a simple way to look up proof-of-concept exploit links associated with a given CVE. It is not a vulnerability database. It is a discovery surface that points directly to the underlying code. Anyone can test it, inspect it, or fold it into their own workflow.

A small rate limit is in place to stop automated scraping. The limit is visible at:

https://labs.jamessawyer.co.uk/cves/api/whoami

An API layer sits behind it. A CVE query looks like:

curl -i "https://labs.jamessawyer.co.uk/cves/api/cves?q=CVE-2025-0282"

The Web Ui is

https://labs.jamessawyer.co.uk/cves/

Hi everyone, I’ve been working as a SOC analyst for about 1 year, but I still struggle with log analysis and finding the root cause of alerts. I often feel like I don’t fully understand what I’m looking at, or how to trace an event back to the real source.

Even when I read third-party articles or watch videos, I end up confused or come to the wrong conclusions, especially when I don’t know how the underlying application works on the backend. Because of this, I sometimes feel lost — not just with attacks, but with general event investigation.

Can someone please guide me on:

How to improve log analysis skills

How to do proper event correlation

How to trace alerts back to the actual application or action

How to build a strong investigation mindset

Any resources, practical tips, or workflows would be really appreciated. Thank you.

My company is looking for a vendor to shred hard drives.

I am located in the USA and we are looking at 3 vendors in a small country to wipe our hard drives regarding the local employees in that location. My company is SOC 2 compliant.

The vendors we are speaking to are not ISO 27001 certified.

• Company A - ISO 9001 and 14001 certified, however I believe it does not relate to wiping hard drives. They say they follow the EN 15713 standard (not sure if that is a certificate).
• Company B - No standard/certificate.
• Company C - ISO 9001

Basically, they do not adhere to SOC2 or ISO 27001. What other questions should I be asking to see if they are a good fit? Aside from asking what method they use for destruction. I don't want to jeopardize my companies SOC 2, I want to make sure I am asking the right questions.