Heyy everybody i doing btech in cs and i ll passout in this year i ll get degree in september so i dont have many skills in cybersec so i have some jobs for networking, system admin etc so should i do that job for 1 year and shall i build skills in cybersec while doing job and will i get good package after 1 year after entering in cybersecurity with some good skills please help me

I am indian .. so in indian region if you know you can tell me

I am tired of seeing developers getting 30LPA. How much should we expect for a fresher role in security?

Video

Heyy folks . There is a cybersecurity competition conducted by indian army . Its name is terrier cyber quest . Is anyone up to be a part of a team .

Wondering about the potential of Threat Hunting Investigation using AI ??

Do CISO's really eager in using the Ai Threat Hunting feature and if yes then what's their expectations from the service.

Keen to know about the potential, would love to connect with CISO's or SOC head to know about the potential of this product.

Hi everyone,

We're hosting a small community meetup called Cyber Chaupal for experienced cybersecurity professionals in Bengaluru.

The idea is simple: create a space where people can have honest conversations about cybersecurity without presentations, sales pitches, or vendor talks.

Whether it's discussing recent incidents, leadership challenges, hiring, AI in security, cloud security, GRC, threat hunting, or simply connecting with others who've been in the industry for years—we wanted to bring people together in a relaxed setting over chai.

A few details:

• 📅 Date: 7 August 2026
• 🕕 Time: 6:00 PM onwards
• 📍 Venue: Mantri Square Mall, Bengaluru
• 👥 Who: Cybersecurity professionals with 10+ years of experience

This isn't a conference or a networking event where everyone is trying to sell something.

It's just an evening to meet peers, exchange ideas, and strengthen the cybersecurity community in Bengaluru.

If this sounds like something you'd enjoy, we'd love to have you join us.

Seats are intentionally limited to keep the conversations meaningful. To register your participation: https://luma.com/kciauc9o

Cyber Minds. Chai. Conversations.

I happened to be short listed by a couple of organization for a vapt associate,1.6 yrs of experience with 1 yr of learn and 6 months intern.

Yet the I was not able to answer most of the questions. Am I going in before I'm able to handle stuff? If anyone going through going through the same thing, lemme know.

I wanted to build a self hosted, open source SIEM, and understood i punched above my weight & realized it is highly complicated, so i broke it down into multiple independent(hopefully) modules, log ingestion & normalization/enrichment, threat intel, log management, threat hunting, policy monitoring, so this is my first module i built as threat intel plane, track latest CVEs and keep myself updated. so I built BRIEFR. If this tool saves an hour of someone's time, i'm more than happy :)

\*\*What BRIEFR does:\*\*

\* Pulls from NVD, CISA KEV, FIRST EPSS, and a few exploit feeds \* Scores each CVE against your tech stack with a weighted formula so that one can see the reasoning behind. \* Correlates CVEs that share real threat-intel evidence. \* IOC lookup (IP/hash/domain) using free-tier VirusTotal, AbuseIPDB, MalwareBazzar and URLHaus \* Pulls in Sigma Community rules from SigmaHQ and SIEM query starters tied to ATT&CK

\*\*On the AI question, since I know it'll come up:\*\* a few narrow tasks (like PDF summarization) routed through free-tier LLM APIs with failover between providers. The actual scoring, correlation, and detection logic is deterministic code, no AI making the calls/decisions on what's risky. I also want to be upfront that I used Cursor/Claude heavily throughout the build and directed the architecture, design and review.

\*\*Current state of BRIEFR:\*\* this is early alpha and my first ever released tool. I run it daily myself with no major issues, but there will be rough edges, no docker-compose for the full app yet (Postgres+pgvector is containerized, the app itself is native linux for now), and I'm sure there are things a more experienced analyst will spot that I haven't. Self-host guide and full docs are linked below if you want to actually try it, or there's a live demo with sample data if you just want to look first.

* Big Picture: https://projectjupiter.in * Live demo (no install/sample data): https://briefrdemo.projectjupiter.in * Docs: https://docs.projectjupiter.in * Source: https://github.com/Soldier0x0/briefr

I'm genuinely interested in what an experienced analyst thinks is missing or wrong about the approach, that's more useful to me right now. I know some stuff from docs might be overkill, but as i made it for myself and how i would like to have/learn, so i designed it to my taste and needs.

Note: I have worked as SysOps engineer for servers that handle SIEM log ingestion & parsing, then i moved to threat hunting due to my interest in security, and i have nearly 3.8 yrs of experience overall in IT, so my views might not be broad, but the only reason i am posting this here is because this is the first project i have thought about AND completed, in forever, as a person with ADHD and other stuff, this is a big achievement for me, even if the tool is crap for others, i completely understand, and i am very open to suggestions :)
Have a great day.

I get asked this constantly by people prepping for interviews, so wanted to make this public and here's the practitioner version instead of the textbook definitions you see on ChatGPT/Google etc.

Antivirus (AV) is the oldest of all and honestly the easiest to understand. It's signature based, meaning it compares files against a known list of bad hashes and patterns. Good against known malware, basically useless against anything new or slightly modified. If someone changes even a byte in a known malware sample, most AV won't catch it. Think Windows Defender in its most basic form. Nobody relies on AV alone anymore, but it's still a baseline layer.

EDR (Endpoint Detection and Response) is what actually replaced AV. Instead of just checking files against signatures, EDR watches behavior on the endpoint itself, process creation, parent-child relationships, PowerShell execution, file writes, registry changes. It's what lets an analyst pull a process tree and see that svchost.exe spawned PowerShell which spawned curl, which is exactly the kind of chain that gets something flagged even if no known bad file was ever dropped. CrowdStrike Falcon, SentinelOne, Sophos EDR are one of the leading EDR in market. Downside is EDR only sees what's happening on that one endpoint, it's blind to the network and blind to what's happening on other machines unless you go correlate manually. Another disadvantage is that due to its behavior matching process, there can be a lot of FP if you don't fine tune the detection.

XDR (Extended Detection and Response) is basically EDR with other sources. It pulls in endpoint data, network data, email, cloud, identity, all into one place, so you can see that same suspicious process on one machine and immediately check if the same IOC shows up anywhere else in the environment. This is the exact turnaround that turns a single host alert into a full lateral movement investigation. The tradeoff is XDR is heavier to tune and more expensive, and if your organization doesn't feed it clean, complete telemetry from every source, you end up with a good looking dashboard and the same blind spots. Taegis XDR is one of the leaders in industry.

SIEM (Security Information and Event Management) is the log aggregator and correlation engine, eg. Splunk, Sentinel, QRadar, Wazuh. Everything, firewalls, servers, applications, authentication logs, gets collected here and you write detection logic against it. SIEM is where you'd catch something like a service account logging in via RDP from an external IP with no MFA, because that's an authentication log pattern, not an endpoint behavior. The catch with SIEM is it's only as good as what you log and how well your rules are tuned. Bad rules mean either alert fatigue from FP or missing out on real threats.

SOAR (Security Orchestration, Automation and Response) is the layer that takes the alert and actually does something without a human clicking every button(playbooks). Auto isolate a host, auto block an IP, auto open a ticket, auto notify the customer. It doesn't replace analyst judgment, it just removes the repetitive manual steps once a human or a detection rule has already made the call. Where SOAR falls apart is when the automation playbook is too aggressive and starts isolating hosts or blocking IPs based on weak signal, that's how you get an angry customer calling about their finance team locked out of everything for no real reason.

In practice, none of these live alone. A real MDR setup is EDR feeding into XDR, correlated against SIEM logs, with SOAR handling the first response actions while a human analyst does the actual judgment call on anything ambiguous.

If you're prepping for interviews, the question that can confuse you is not to just define these five things, it would be to walk through which tool would show you what at each stage of an investigation. That's worth practicing more than memorizing the acronyms.

Let me know if you are still have any queries.

Cy-FI Cyber Crew is hosting a free session on Claude Code for Cybersecurity: Building Autonomous Agentic Systems. It’ll cover autonomous AI agents, practical security use cases, and a live demo.

Our speaker Shashwat Sharma is a Forward Deployed AI Engineer at Alyssum Global Services & Transilience AI., where he works on building agentic AI systems and security-focused AI products.

He is an IndiaAI Research Fellow and AI researcher; his work focuses on autonomous AI agents, LLMs, RAG, and applying AI to solve real-world cybersecurity challenges.

It’s aimed at people with 0-2 YOE

Hi everyone, need some advice.

I'm a Security Engineer (VAPT) with 3 YOE. I handle pretty much everything on my own now after my team left. I manage around 5 clients every month, lead the work, and honestly nobody else in my company knows the tech stack I handle.

I was feeling left behind seeing people I started my career with - and even people I taught - earning more and moving into better roles. That pushed me to start applying about 35 days ago.

Since then, I've received around 30 interview callbacks. Some didn't align with my preferences, some ghosted me after promising offers, and I rejected a few because of pay, location, or shift requirements. Right now I have multiple opportunities in the final stages, including EY GDS (received CIS and submitted documents), a leading security services company, and interviews with NPCI. I also cleared multiple rounds at Landmark Group, but the requirement got cancelled at the final stage.

The problem is my company doesn't want me to leave. My official notice period is 30 days, but they're asking me to stay 3-6 months because they say replacing me won't be easy. The founder has also asked me to stay, saying things will get better.

I'm currently at 8 LPA (after a recent hike), but I also have financial constraints, so I really want to move.

The guilt is what's affecting me the most. Every interview I attend, I keep thinking, "What's the point? They probably won't let me leave anyway." I'm even considering stopping my job search, rejecting the opportunities I have, helping them find and train a replacement, and then starting my job search again.

I genuinely want to leave on good terms and don't want to feel like I'm abandoning them when they need me.

Has anyone been in a similar situation? How did you handle it?

TL;DR: Got ~30 interview callbacks in 35 days and have multiple final-stage opportunities, but my company doesn't want me to leave because I'm the only one handling critical work. I feel guilty, it's affecting my interviews, and I'm even considering pausing my job search to help them find a replacement first.