Cybersecurity Engineer & Developer Learn & Upskill in Cybersecurity ➡️ @defendtheorg Newsletter ➡️ https://teapaw.org/t.co/14KjycT4V7
Creating ➡️
Joined September 2023
- Tweets4.8K
- Following381
- Followers1.5K
- Likes1.5K
Pinned Tweet
The reason people spend thousands of hours playing video games isn't because they love playing the tutorial over and over - it's because the gameplay loop and progression system makes playing feel rewarding.
I think learning cybersecurity should be no different.
But most education platforms focus on mindless content, videos, courses, and certifications.
That's exactly what I'm trying to change with DefendTheOrg.
XP. Levels. Badges. Leaderboards. And soon, story-driven campaigns that combine multiple skills into realistic scenarios.
But not at the cost of quality cybersecurity labs, educational content, and structure to learning hands-on skills.
Because if you're going to spend hundreds of hours developing cybersecurity skills, it might as well be fun.
SQL is the way of the past and still the way of the future.
Sure, your agents can query your data lake via MCP or CLI.
But often when I need an answer quick, I still go query by hand.
Sure, you agents can write your detections.
But I still review and understand the query to make sure it meets my exact use case.
And sure, your agents can reason their way around investigating alerts.
But you know what’s still faster? Deterministic workflows where AI reasons on the collected data.
I still ideate, review, and edit this queries by hand.
SQL is here to stay.
Your SIEM is showing you thousands of events.
Now imagine your manager asks:
“Find every failed login from this IP in the last 24 hours.”
This is where knowing SQL becomes useful.
Cybersecurity generates a ridiculous amount of data. Knowing how to ask that data the right questions is a skill every aspiring SOC analyst should build.
@defendtheorg has a SQL Basics path where you can start practising this from the ground up.
Stop treating SQL as a “developer skill.”
It’s a data investigation skill too.
DTO uses the exact workflow you see on the job as a SOC Analyst.
Practice how you play 😤
Great overview of the SecOps Labs @Maskoff023 !
How do you actually solve a Security Operations lab?
I put together a quick walkthrough using a DefendTheOrg lab, from reading the alert to investigating logs, selecting the right evidence, and making the final triage decision.
If you're trying to build practical SOC skills, this is the kind of practice you should be doing.
Learn. Investigate. Make decisions. Build proof.
Try it yourself 👇
These are 2 things I wish I could have told my college self after working in tech/cybersecurity for nearly 7 years now…
1️⃣ Focus on the learning, not the grade.
Employers want signs you're ready to do the job. Do you have a solid foundation? Do you seem teachable and eager to learn? That's what they're looking for.
I've never put my GPA on my resume. No one has ever asked.
2️⃣ College is also for building your network.
Friends I made in college connected me to my first couple of jobs. That did more for me than my GPA ever did.
So talk to people. Make friends. Build those relationships now, while it's easy and everyone's in the same place. You'll thank yourself later.
This has by far been my best week on X since joining over 3 years ago.
So, if you're new to my profile - Hey 👋 I'm Ryan.
I've been a Cybersecurity Engineer for 7 years and share career advice for those looking to pivot into the industry, or upskill in their career.
I also build my products in public, with @defendtheorg currently and another product on the way 🤫
Follow along if you're a Cybersecurity Nerd, Tech Bro, or anything in between 🤓
A buddy of mine is preparing for a SecEng interview next week.
So naturally, he signed up for @defendtheorg to get prepared.
This kind of feedback on my platform is the reason I keep building it out 📈📈📈
➡️ DTO is LeetCode for Cybersecurity Professionals
Ryan G. Cox retweeted
I honestly wonder why most of you haven't started taking advantage of the real-world cybersecurity scenarios you can find on DTO.
You keep asking:
“What should I learn?”
“How do I get experience?”
“How do I become job-ready?”
But when you have a platform giving you structured paths, realistic scenarios, hands-on challenges and problems that actually make you think like a security analyst, many of you are still watching another 3-hour YouTube video.
At some point, you have to stop consuming and start practising.
DTO can help you build practical cybersecurity skills in months if you actually put in the work.
Not by magically making you job-ready, but by giving you a place to learn, practise, make mistakes, solve problems and build proof of what you can do.
If you're serious about getting into cybersecurity, what exactly are you waiting for?
Go explore it yourself:
defendtheorg.com/r/MASKOFF02…
Was so fun building this out. Give it a go now @defendtheorg
DTO just added its 10th skill: Purple Teaming.
And I think this is one of the features that makes the platform different.
So what exactly is Purple Teaming?
It’s about bringing the Red Team and Blue Team perspectives together.
The Red Team thinks like the attacker:
How would an attacker gain access?
What techniques would they use?
How would they move through the environment?
What would their attack chain look like?
The Blue Team looks at the other side:
Did we detect it?
What logs were generated?
Did our SIEM or detection rules catch it?
What did we miss?
How can we improve the detection?
Purple Teaming connects both sides.
You take an attack or adversary technique, see what the defensive controls catch, identify the gaps, tune your detections, map the activity to MITRE ATT&CK, and then test the attack again.
That creates a really useful learning loop:
Attack → Detect → Identify gaps → Improve → Test again.
For cybersecurity students, this helps connect the theory you're learning to what actually happens during an attack and how defenders respond.
For SOC analysts and Blue Teamers, it helps you think beyond simply responding to alerts. You start understanding why the attacker generated those alerts in the first place and how your detection could be improved.
For aspiring Detection Engineers and Threat Hunters, this is especially valuable because you're practising the process of turning attacker behaviour into meaningful detections.
And for Red Teamers, understanding how defenders detect your activity gives you a better understanding of the defensive side of the environment.
That's why I think Purple Teaming is such a valuable addition to DTO.
It's not just another collection of labs.
You're being encouraged to understand both sides of the fight and use that knowledge to improve security.
This is one of the reasons I consider DTO unique.
If you're learning cybersecurity, go explore the Purple Team section and see what they're building.
defendtheorg.com/r/MASKOFF02…
Purple teaming isn't about red team versus blue team.
It's about getting both sides working together to make the organization harder to compromise.
The real value isn't just identifying gaps in your defenses. It's fixing them, validating those fixes, and running the attack again to make sure everything works as expected.
And that's the part that matters most: don't just find weaknesses.
Engineer improvements and prove they work.
I love creating content because I enjoy hearing the impact it has on other people in their careers and lives.
But I absolutely hate the administrative parts of it:
- Editing Videos
- Reformating into different creatives
- Figuring out whats performing well
- Analyzing why content is working
- Staying up with the popular trends
- Posting to all platforms
So I've actually been working on a framework that's been saving me practically all of that time.
I speak my ideas and my system cranks out the content.
It's been amazing so far and made me love content creation even more.
I think I'm going to productize this framework since it's saving me about 5 hours a week at the moment.
Anyone else interested in a social media system that goes beyond just scheduling and turns your ideas into a fine oiled machine?
This exercise on @defendtheorg is a great one to try as a beginner 👏
Suspicious Login Pattern Hunt
Scenario:
A threat intelligence team discovers that employee credentials from a recent third-party breach may be circulating on the dark web.
The team wants to know:
Are any of those compromised credentials already being used to access the organisation?
As the analyst, you’re given VPN authentication logs and asked to investigate suspicious login activity.
The interesting part is the hypothesis:
An attacker may be using compromised employee credentials to access internal systems from an unusual geographic location.
There’s also an important piece of context:
HR confirmed that no employees are currently travelling internationally.
So now you have to investigate the login patterns, look for unusual locations and behaviour, and determine whether the activity could indicate credential abuse.
This is the kind of scenario I like seeing beginners practise because it puts you in the mindset of an actual analyst.
You’re not just learning what threat hunting means. You’re given a hypothesis, business context, logs and a security problem to investigate.
DTO has several hands-on exercises like this across different areas of cybersecurity.
If you're learning SOC/Blue Team, don't just watch videos.
Get your hands on some logs and start hunting.
defendtheorg.com/r/MASKOFF02…
Ryan G. Cox retweeted
I was less busy today, so I decided to visit DTO and honestly, I was impressed.
I realised how much the platform has grown over the past few months.
Looking at it now, I genuinely wish something like this existed when I started learning cybersecurity.
For beginners, having a structured place to learn, practise, follow challenges, and actually build hands-on experience can make the journey a lot less confusing.
If you’re currently learning cybersecurity and tired of jumping from one random resource to another, explore DTO yourself and see what I mean.
defendtheorg.com/r/MASKOFF02…
No new lab this Thursday……
🥲
But only because we dropped 6 yesterday in the new Purple Team skill.
I started in Cybersecurity 7 Years ago on a whim with zero experience.
Here I am 7 years later sharing my experiences, knowledge, and life as I continue to build a life of my own.
If I can do it, you can do it too.
Follow along for my journey through cybersecurity and building my own products.
Feel free to ask any questions along the way :)
Ryan G. Cox retweeted
🟦 ITS TIME TO UNDERSTAND BOTH SIDES 🟥
Purple Teaming is an exercise that brings the Red Team and the Blue Team together with a shared goal: Improve the Security Posture of the Org.
The 10th skill is live NOW - Give it a shot, at DefendTheOrg 🛡️
What does purple teaming actually look like when you move beyond the theory?
That's exactly what I wanted to bring to DefendTheOrg.
The new Purple Teaming experience puts you in the middle of an attack simulation where you have to analyze telemetry, identify detection gaps, engineer improvements, map coverage to MITRE ATT&CK, and validate your work by rerunning the attack.
Because the goal isn't just to write more detections. It's to understand where your defenses fall short and systematically make them better.
Purple Teaming is live on DefendTheOrg. Go put your skills to the test.
Dear Aspiring Security Engineer,
Detection & Response (DART) is one of the most hands-on areas of security you can work in.
Here are 5 things you need to know about it. ⬇️
-
1️⃣ Detection engineering builds the signals
This is the build side. You write detections, tune out noise, make sure the right data exists, and build the platform the detections run on.
Data → Detection Logic → Alert → Response
A detection is only as good as the response it enables.
2️⃣ Incident response acts on the signals
An alert fires. Now you have to figure out what actually happened.
Is it real or a false positive?
What's the scope?
Which systems and identities are involved?
How do you contain it?
What needs fixing so it doesn't happen again?
This is where your detections get tested.
3️⃣ You are your own customer
DART is a hybrid role. You build the tooling, then you use that same tooling when you respond.
Alert missing context? You feel it.
Slow query mid-investigation? You feel it.
Noisy detection? You feel it.
That feedback loop makes the work better over time.
4️⃣ On-call is part of the job
A lot of teams run a rotation. Every month or so you take a shift.
On-call, your job is strictly operational. You triage and respond. Engineering work waits.
The rest of the time you build detections, improve tooling, and fix what on-call taught you.
On-call shows you what to build next.
5️⃣ Hunting and intel feed the loop
They aren't in the name, but they support everything DART does.
Intel tells you what attackers are doing.
Hunting tells you if they're already in your environment.
Both turn into new detections.
Ask yourself:
What would this attack look like in our data?
Would we detect it today?
Could we respond quickly?
What did the last incident teach us?
Detect, respond, learn, build. Then do it again.
Cybersecurity hiring will go crazy in 2027 - and here's what I would do to take advantage of these opportunities to come 📈📈
