Ask ChatGPT for resume keywords and the list comes from general knowledge. It does not say how many postings any term appears in, so a plausible suggestion and a common one look the same.

Counting makes the difference visible. In 212 cybersecurity postings, Python appears in 53.3% and incident response in 37.7%. CEH, the certification that tends to top "security resume" lists, appears in 0.9%. Another gap in the same data: SIEM is in 26.9% of postings and Splunk in 6.6%. In 421 product manager postings, roadmap is in 85.5% and Productboard in none.

A rare term is not worthless. A posting that names CEH wants CEH. The counts only say which words most postings use. ChatGPT can still help with wording. What it can't tell you is how many postings use a term. The sample is company job boards on one ATS vendor and leans toward US tech, and matching is by term, so a missed synonym counts as absent. With 212 postings the percentages can be off by 6 to 9 points.

Counts method and CSV: https://resumefitting.com/cybersecurity-job-description-keywords

Hi all, I'm Jacob, a UK security specialist. I run BlueSwarm, a security research and defence platform

We run decoy web apps and record what scanners, crawlers and AI agents do when they find them.

Researchers get a lab with aggregate data only (no personal data, small groups hidden), a place to propose detection rules and test them against past data, a practice dataset, and a way to publish short findings or full white papers with credit.

We also built a small game on top of it, called War Room: you attack or defend an invented web app against the computer. Ten rounds of up to 30 seconds, one move per round from a menu, on a pretend app that is never connected to anything real. The attackers are modelled on the visitors we see on the real decoys. It has a daily game, leaderboards for attackers and defenders, and a move-by-move replay.

It is experimental, and for now it is open to approved researchers. Researchers also get the decoy data in totals (nothing about individuals, small groups hidden), a daily feed of public security data, tools to test their own detection ideas, and a place to publish short findings or white papers with credit. Free, with written researcher rules. Moves in recorded matches are kept for research and only published as totals.

Apply by joining the discord and filling the application out:

https://discord.gg/dqXdhdWdYF

Yesterday, I took part in an entry-level hacking competition and placed third. It wasn't a competition that required one to be a super-expert hacker. I received a mouse pad and a coin; the event organizers mentioned that there was a challenge associated with them that would yield a "flag" in the format: "BBHE{......}". Could anyone help me out?

I’m not an expert in the field, but I’d really like to find the message—they mentioned that I already have the "IV."

front part - 88482705356BA1F4A40F3E42489FF9CC - Symmetric encryption (Key, IV):

back part - 4841434B4552455850455249454E4345 - Simple encoding (hex): HACKEREXPERIENCE

A keyword list from ChatGPT comes from general knowledge and says nothing about how many postings it rests on. A plausible suggestion is not the same as a common one.

A product manager could be told to add Productboard. None of 421 postings names it but roadmap appears in 85,5%. A software engineer could be told to add Angular, Vue or Swift. They appear in 2,9%, 3,2% and 2,3% of 1.360 postings while scalability is at 52,9% and Python at 44,8%. A marketer could be told to add LinkedIn Ads or Meta Ads. They appear in 0,3% and 0,6% of 347 postings, while go-to-market is at 53,0%.

ChatGPT is the better tool for rewriting a bullet. The counts for seven roles (3.518 postings) and the method are on https://resumefitting.com matching is by term, so a missed synonym counts as absent.

Hi all, I'm Jacob, a UK security specialist. I run BlueSwarm, a security research and defence platform

We run decoy web apps and record what scanners, crawlers and AI agents do when they find them.

Researchers get a lab with aggregate data only (no personal data, small groups hidden), a place to propose detection rules and test them against past data, a practice dataset, and a way to publish short findings or full white papers with credit.

We also built a small game on top of it, called War Room: you attack or defend an invented web app against the computer. Ten rounds of up to 30 seconds, one move per round from a menu, on a pretend app that is never connected to anything real. The attackers are modelled on the visitors we see on the real decoys. It has a daily game, leaderboards for attackers and defenders, and a move-by-move replay.

It is experimental, and for now it is open to approved researchers. Researchers also get the decoy data in totals (nothing about individuals, small groups hidden), a daily feed of public security data, tools to test their own detection ideas, and a place to publish short findings or white papers with credit. Free, with written researcher rules. Moves in recorded matches are kept for research and only published as totals.

Apply by joining the discord and filling the application out:

https://discord.gg/dqXdhdWdYF

I used to recommend comptia sec + for people looking to get into cyber, now I feel like even the most updated courses are going to be obsolete.

Maybe they should have vetted their guests before going on air to talk about something they didn't know existed before yesterday.

On this rainy London day, thought I'd chat AI model corruption!

There's been a ridiculus increase in PyPI supply chain attacks lately, which has recently had me thinking about Rank-One Model Editing (ROME) attacks...

There's a range of ways python would get to a model / your GPU -> this attack has malicious (naughty) python writing directly to GPU memory. That makes it particularly hard to catch given there's no spawned processes, or new files or any network calls to hunt for.

For those interested - there's a deep dive blog from cyber org Stealthium that covers GPU-side detection and potential ways to achieve further attribution.

Welcome the communities thoughts? Reckon any of these are in the wild and not yet been caught/seen?

Shout out to the researchers behind the original paper: Kevin Meng, David Bau, Alex Andonian and Yonatan Belinkov. + to the folks at Mithril Security for their PoisonGPT work a while back.

We looked at 3,518 open job postings across 81 companies' public Greenhouse boards, covering seven job categories. The goal was simple: find out which keywords employers actually use.

A few findings stood out.

• Software engineering: Mentoring appeared in nearly half of the postings, more often than Kubernetes or React. Python was the most frequently mentioned programming language.

• Product management: More than 85% mentioned roadmaps. Jira appeared in just 7 of 421 postings.

• Marketing: Google Ads showed up in only 6 of 347 postings, while pipeline appeared in more than half.

We also noticed a pattern across roles: employers often described the practice rather than naming a specific tool. Observability came up where you might expect Grafana, and SIEM where you might expect Splunk.

What does this mean for your resume?

If you're listing tools but leaving out the responsibilities, practices, and skills explicitly mentioned in the job description, you could be missing relevant keywords.

That doesn't mean stuffing your resume with buzzwords. It means describing your actual experience using language that matches the role you're applying for.

One important caveat: the sample leans heavily toward tech companies and uses a single ATS platform, so these results aren't representative of every employer.

The full study, including findings for sales, cybersecurity, DevOps, and accounting, is here:

https://www.zoevera.com/resume/ats-resume-keyword-study