Resume help

[jeromedawg]

Hey guys,

So I think I need to revamp my resume. It's a technical resume as I've held positions both in QA and info sec, and lately sort of a 'blend' between the two. I've been in my current position for a little over a year now but have no idea what to fill the space with - in comparison to everything I've held and written descriptions for the past 10-12 years, the info I have for the current position looks quite entry-level... admittedly, the current position I hold isn't very exciting at all, but it's good-paying and 100% WFH (there's one awful coworker who ruins it for most everyone though and often makes work miserable). That said, it's still quite slow and when I think about what I'm doing (mostly functional and regression testing), I can't seem to place in words what I'm doing beyond a couple of sentences... it looks/sounds pretty bad. I know there are 'creative strategies' to get around this and a lot of it is about wording, but resume-writing is one thing I'm horrible at.

Any suggestions?

[beardedone]

Hi, jplee3! I work in software engineering so hopefully this advice is helpful.

I would recommend reading www.kalzumeus.com/2011/10/28/dont-call-yourself-a-programmer/. It's for "programmers," but much of it is applicable to any "knowledge" worker. For that matter, read anything by Patrick McKenzie! For your specific situation, I would recommend learning more about the rest of the business, if you haven't yet. Then you can write not about what you did, but what you accomplished for the business.

For example, have the regression tests that you have written prevented an engineer from deploying a massive mistake costing thousands of dollars? Does the QA team allow the company to advertise their products to bigger companies, or does it work in an industry where stability is essential? Are you in charge of a particular area of the product? If so, are there any reliability/bug metrics that have improved over the year you've been at the company? You can take ownership of that.

Does it seem like none of these apply? If so, I think you might be missing part of the picture: unless the company is really badly run (which is completely possible but unlikely to be the case for long), it wouldn't pay >100k (after payroll taxes) a year for someone that doesn't, in Patrick's words, increase revenue or reduce costs.

[mxt0133]

QA with information security seems like penetration (PEN) testing to me.  We pay a third party companies a lot to preform a PEN test audits for our on premise and cloud based products.  You might want to look at some sample resumes or job descriptions with that requirement.

[jeromedawg]

QA with information security seems like penetration (PEN) testing to me.  We pay a third party companies a lot to preform a PEN test audits for our on premise and cloud based products.  You might want to look at some sample resumes or job descriptions with that requirement.

Yea, I think it does to a lot of recruiters as well, in general. The problem is I haven't really done any *formal* pen tests... and I don't feel confident in accomplishing one beginning to end either. I've gotten some SANS certs like GPEN and GWAPT but none of those mean anything without real-world experience. So FWIW, I'd consider myself a complete noob at pen-testing. I could probably tell you the various parts of pen-testing and all the hypotheticals, etc but when it gets down to exploiting vulnerabilities, that's a whole different ballgame...

[jeromedawg]

Hi, jplee3! I work in software engineering so hopefully this advice is helpful.

I would recommend reading www.kalzumeus.com/2011/10/28/dont-call-yourself-a-programmer/. It's for "programmers," but much of it is applicable to any "knowledge" worker. For that matter, read anything by Patrick McKenzie! For your specific situation, I would recommend learning more about the rest of the business, if you haven't yet. Then you can write not about what you did, but what you accomplished for the business.

For example, have the regression tests that you have written prevented an engineer from deploying a massive mistake costing thousands of dollars? Does the QA team allow the company to advertise their products to bigger companies, or does it work in an industry where stability is essential? Are you in charge of a particular area of the product? If so, are there any reliability/bug metrics that have improved over the year you've been at the company? You can take ownership of that.

Does it seem like none of these apply? If so, I think you might be missing part of the picture: unless the company is really badly run (which is completely possible but unlikely to be the case for long), it wouldn't pay >100k (after payroll taxes) a year for someone that doesn't, in Patrick's words, increase revenue or reduce costs.

Thanks, will check it out. I was looking at a couple other resumes and think I get what you mean in the bigger picture. Most of the things you asked I don't think I can answer...at least off the top of my head. The app I work on is very basic and our QA group is newly established - they formed us reactively in response to not having true QA-folk involved from the beginning. Basically, they dropped us into the middle of a really messy app (that should be pretty simple) and hoped things would improve. I think things have improved slightly, but it's hard to identify and quantify exactly what... I'll probably need to go through my performance appraisal again to get a better idea. I'm really not actively engaged, at least currently, in thinking about how what we're doing in our group impacts the company at a larger scale. Part of it has to do with my cohorts and I really not wanting to work with this one 'lead' dev who makes working here somewhat of a living hell. But yea, I would say we've saved his skin multiple times but only by constantly warning our manager about risky dev behavior and attempting to push things into prod that aren't ready to be pushed into prod. Otherwise, this guy tends to have a knack of putting the app (and our group) into jeopardy (not knowing how to properly write an FSD OR BRD, making code changes on the fly to PROD without going through the proper channels - this has resulted in negative impacts in how people in rest of the org view our group, etc).

On that note: I found a couple of security vulns (nothing *major*) in the app and reported them as defects. The same dev closed them as being "out of scope" of our testing and that we don't "pen test" LOL - in short, he is part of the reason why everyone else in the group lacks in greater productivity. But there are politics, which is why he's still around...

I don't necessarily want to get out (given the WFH benefit), but if another opportunity presents itself I want to be ready (especially if I don't want to potentially jeopardize my 'career path')