SANS work-study: What to expect?
I may have been selected to facilitate one of my dream courses 
What is expected of me as a facilitator?
How does this work?
Any pro tip from those SANS veterans??
Also, do you create your index at the end of the day?
So excited
What is expected of me as a facilitator?
How does this work?
Any pro tip from those SANS veterans??
Also, do you create your index at the end of the day?
So excited
Certs: GSTRT, GPEN, GCFA, CISM, CRISC, RHCE
Check out my YouTube channel: https://youtu.be/ug_ruisDUXc
Comments
Make sure you ask the instructor if its Ok for you to chime in, if you want.
Make sure the room is locked/unlocked if people are leaving their items there.
I wouldn't bother trying to make an index on while you're seeing the material for the first time. Plus you have access to the audio and slides online which in class participants DONT have access to (unless they paid for them).
Thats about it.
nope. Maybe help with vmware setup to the other students
Reading: SANS SEC560
Upcoming Exam: GPEN
Well, thats the gamble. If a projector goes out or something falls over/requires attention outside of the classroom, that'll be you. More than likely nothing will happen. But SANS is using you to make sure the instructor can do their job
Currently Working On: Python, OSCP Prep
Next Up: OSCP
Studying: Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
Before the start of each day check in and collect any handouts for the class and notes for the instructor.
The first day of the actual conference is going to be the longest since you have to get there earlier than normal to be ready for registration. You might miss the very beginning of class but usually that's just administrivia stuff so not a big deal (and you get OnDemand anyways).
During class, if the instructor needs anything such as drinks, or finding support staff for technical issues. Just check in on breaks...usually they probably won't need much but you are expected to help if they do. Also watch their equipment on breaks but this might vary depending on the conference...the one I went to the rooms were open and I didn't really have to watch anything.
End of class each day there are evaluations that you hand out and collect, then enter into the computer...pretty quick maybe 10-15 minutes because it's just the scores.
Every night there is usually a talk of some sort that they need people to facilitate so you can sign up for these as well...or just show up to see the talk no signup required.
At the end if they need help with teardown then you can help as well but when I was there they knocked it out well before we were done.
It's honestly pretty easy and doesn't add a ton of extra time to your conference...well worth the discount. As somebody said, you are a student in the class and aren't expected to be the go to person...that's the instructor and TA if they have one.
This seems to be a very common question? Why is everyone in such a hurry to create an index? Your not taking a course from McSans, were you have have it your way in a few days. Unless your some kind of genius, studying and passing for a SANS exam takes at least a month of preparation. An index not something you work on during class or at the end of the each day of classes. There will be time enough to study and work on your index AFTER taking the course.
No I'm not familiar with the material at all, so its a difficult course for me. I'll need plenty of time and dedication. Not sure how to tackle this the best way.
I think so far everyone agrees that doing the Labs is a great strategy.
https://www.sans.org/media/security-training/Work-Study-Program-Facilitator-Guidelines-Manual.pdf
This. At the larger events it seems they may be more strict, also it depends on the coordinator. I know in Virginia Beach 2015 (can't believe its been that long since I've facilitated) the coordinator was super chill and didn't care about jeans and sneakers.
I recommend since on the setup day (Sunday) you can wear whatever you want, that you talk to the coordinator in charge what they require for dress (which means pack slacks/khaki pants and button ups or polos and jeans) and go from there.
Currently Working On: Python, OSCP Prep
Next Up: OSCP
Studying: Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
That being said, dress professionally to be absolutely safe - you can always dress down if the environment permits - but dressing better than everyone else (and I don't say that with any sort of superiority/snobbery) makes you stand out as a facilitator and gives you what I think is a little bit of an "edge" in the eyes of the SANS staff. My Dad always told me to dress like a professional and people will treat you like one. SANS is very much about their reputation and industry perception. Dressing professionally fits right in with their values.
Without revealing too many secrets, what you've heard previously is about right. The first day is jeans and the grunt work of setting up materials and venue. The first day of registration/classes is long, typically starting as early as 6:00 am and not ending until after 6:00 pm in many cases. It's been my observation, although I can't confirm this, that it seems like a lot of the newer facilitators end up with the toughest schedules, that is, the boot camp classes that often run 12 hours a day like 301 and 401. I suspect it's either because they're new and signed up for them or it's a way of testing their mettle to see if they're fit for future facilitator assignments.
Make yourself indispensable to your instructor. Mine have been very laid back and required little on my part, but both had specific criteria for how they wanted certain things done in the classroom. My first interaction with my instructors has always been an introduction and then "What can I do to make your class run as smoothly as possible?" or something to that effect. Once you know what their expectations are you're in good shape.
I think a lot of the success of a facilitator when it comes to be invited back is their willingness to pitch in. I more or less mentored a couple of first time facilitators as well as spent my spare time before and after class volunteering for the person who supervised the facilitators. It takes a lot of work to pull these big events off successfully, so being available to help out when needed goes a long way to establishing your Facilitator "cred", I believe.
Most importantly, be flexible. If you're OCD/a*nal/super structured, you won't do well. You have to be able to go with the flow and deal with things as they pop up without panicking. Stuff will happen, but when it does, be calm, know who your resources are, and move forward as best you can.
Good luck in your facilitating. It's been a really great experience for me and I hope I can continue to participate - your ability to return is based on your performance and the ratings of your instructor and the facilitator's supervisor. There's a lot of intrinsic value in facilitating well beyond just getting a deal on the registration fee and resources. I look at it as an investment I'm making in SANS so they'll be better for me and others in our industry.
Do you sign a confidentiality agreement?
I'm taking my third company paid SANS course In July, I'm wondering if they give preference to facilitators that attended / hold more certifications? I know that an instructor recommendation is golden, but all things being equal, does product loyalty pay off?
There is an NDA that is part of the work study agreement.
I don't think the presence or number of certs necessarily affects your eligibility or likelihood of being chosen - my first time around I had no GIAC certifications at the time. I believe that your willingness to work hard and do a good job carries a great deal of weight once you've had a chance to facilitate.
That's my personal observation, at least.
Yeah I figured it will be exhausting because it's all day. There is also events in the evening, do you guys attend those as well? They seem valuable!
You typically have to work two events for the week. There is a lot of swapping of responsibilities, as facilitators will swap events with each other for things they want to see or participate in. NetWars and DFIR competitions require additional people, so those are often easy ones to do and fun to watch. If you're volunteering as "extra" help at one of these you might even get a drink ticket and munchies as part of the deal if you're living right.