Age 27. I work in cyber security. Always been in a type of role that was like responding to security incidents / issues. New role is a bit more specialized for investigations for insider threats.

1-3 years ago I thought I wouldn't break $100k base pay by 30, srs. Then inflation got crazy, rent's going up 20% this month, and I decided going up 3-5% per year from the company's typical annual bump is NOT acceptable. I got inspired to get out of the comfort zone and get into theDANGER ZONEafter watching Top Gun: Maverick.

Old Job:

- $85k base, paid hourly, 10% annual bonus, 10% extra for working evening hours
- 5x8 schedule, shift rotates every 2-3 months
- Worked a chit load of overtime, including every corporate holiday, cuz I wanted to get as close to $120k gross as possible
- 95% remote, went into office once a month

New Job:

- $110k base, paid hourly, 10% annual bonus, 10% extra for working evening hours
- 4x10 schedule, no shift rotations. Still working out which days though, if I can work Sundays then I'll get a ~30% premium that day of every week, on top of the other bonuses/differentials.
- Overtime eligible, I suspect less overtime opportunities in general though
- 100% remote

After 401k + taxes, my take home is going up by like $1600/mo because of this movement.

congrats wagie! now go out this weekend and celebrate!

Negged

Congrats...it sounds like a good move. I'm glad that you're glad.

Congratulations and the best of luck to you!

Just out of interest and comparison to my country's tax rates and comparable salaries, what is thegrossincome you receive weekly/monthly after tax?

Dasitmane

I accept you.

Grats boyo! I somehow made it over 100k before I turned 30 without a degree. IT is where it's at if you have a brain and are good at troubleshooting SRS

How would you spot encoded malware on an endpoint?

My last paycheck, which had a tiny bit of overtime and was from "old job" as mentioned in OP, is $3722 gross and $2650 net. This includes 6% going into 401k. I live in USA, in a state that doesn't have any state income taxes.Haha I'll give you the interview answers. IDK how well I'd execute it in practice though.

- View running processes. If there's a process I'm unsure of, that's in itself a potential indicator. Outside of that, malware typically masquerades as other expected processes, so check that nothing is running from a weird file path. Lastly on this topic, if there's heavy resource utilization corresponding to a weird process, that's a sign too. Then you'd check file hashes of anything that's weird against OSINT sources to make sure it's truly the process it's claiming to be. Note that you can also use powershell / wmic to get the commandline and parent files associated with a running process.

- Check scheduled tasks / chron jobs. Threat actors like to put malware executables set to either a trigger, timer, or something else like on startup, as a scheduled task in the OS. Easier to identify if you have logging of scheduled task modifications to spot anomalies, otherwise just check what the current scheduled tasks are if you're suspicious about a host.

- Registry modifications. This one can be underrated. All it takes is changing a single value in a register to do things such as, completely disable antivirus software, change the DNS server or proxy to be a threat actor's DNS/proxy, store credentials in memory, and many many more scary things.

- Command history. In linux you can check what's called the bash_history file to see previous bash commands. THIS is where you'd actually find the "encoded" commands associated with malware. I believe Mac also has the same "bash_history" file. Can't remember what Windows has. This is where you'd see attempts to do things like recon, download and install files, exfiltrate data, setup connectivity to external servers, etc. Threat actors tend to clear corresponding audit files so the command history isn't known. This in itself is its own huge warning sign if it was cleared, you should have alerts to detect when users delete their command history in general.

- Endpoint security software and alerting. This is the ultimate answer to your question. Just get good anti-malware, log everything, create alerts, have security devices such as IPS/IDS, firewalls, etc.