SANS work-study: What to expect?

UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNAPosts: 3,959Mod Mod
I may have been selected to facilitate one of my dream courses icon_cheers.gificon_cheers.gificon_cheers.gif

What is expected of me as a facilitator?

How does this work?

Any pro tip from those SANS veterans??


Also, do you create your index at the end of the day?


So excited icon_lol.gificon_lol.gificon_lol.gif
Goal: MBA, March 2021

Comments

  • jelevatedjelevated Posts: 139Member
    Show up the day before or maybe a few hours before to meet up with the instructor. Open a million boxes and put books into Bags. Assemble the rooms.

    Make sure you ask the instructor if its Ok for you to chime in, if you want.

    Make sure the room is locked/unlocked if people are leaving their items there.

    I wouldn't bother trying to make an index on while you're seeing the material for the first time. Plus you have access to the audio and slides online which in class participants DONT have access to (unless they paid for them).

    Thats about it.
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    So during the class I just get to attend and do the labs like every other student? nothing else is required?
    Goal: MBA, March 2021
  • xxxkaliboyxxxxxxkaliboyxxx Posts: 466Member
    UnixGuy wrote: »
    So during the class I just get to attend and do the labs like every other student? nothing else is required?

    nope. Maybe help with vmware setup to the other students
    Studying: GPEN
    Reading
    : SANS SEC560
    Upcoming Exam: GPEN
  • jelevatedjelevated Posts: 139Member
    UnixGuy wrote: »
    So during the class I just get to attend and do the labs like every other student? nothing else is required?

    Well, thats the gamble. If a projector goes out or something falls over/requires attention outside of the classroom, that'll be you. More than likely nothing will happen. But SANS is using you to make sure the instructor can do their job
  • cyberguyprcyberguypr Senior Member Posts: 6,751Mod Mod
    Keep in mind that you are there to assist the instructor, not the students. In one of the five work study sessions I've done multiple students kept coming to me asking for Windows CDs, troubleshooting, and all kinds of crap. It was extremely disruptive. I tried helping the first one and that's when I realized that I was quickly falling behind. No more. The rest were referred to the instructor or SANS support personnel.
  • JoJoCal19JoJoCal19 California Kid Posts: 2,772Mod Mod
    In the two that I facilitated in, for Mike Poor and Dr Cole, aside from the initial setup as mentioned, I was basically a Red Bull go getter, protector of their laptop when they had to go on break, badge checker when students came into the classroom (THIS is a huge emphasis of SANS and they have been known to test facilitators on this), other than that I was a student like everyone else. Oh yea, your other MAIN job is doing evals at the end of the day.
    Have: CISSP, CISM, CISA, CRISC, eJPT, GCIA, GSEC, CCSP, CCSK, AWS CSAA, AWS CCP, CEHv8, CHFIv8, ITIL-F, MS Cyber Security - USF, BSBA - UF, MSISA - WGU
    Currently Working On: Python, OSCP Prep
    Next Up:​ OSCP
    Studying:​ Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
  • TechGuru80TechGuru80 Posts: 1,539Member ■■■■■□□□□□
    The day before the conference starts as already said...you setup the rooms, and organize the bags with the books for the courses. If you finish yours early, help others because the faster everybody finishes the faster you get to leave. It won't be a full day and you probably will be done by like 3pm.

    Before the start of each day check in and collect any handouts for the class and notes for the instructor.

    The first day of the actual conference is going to be the longest since you have to get there earlier than normal to be ready for registration. You might miss the very beginning of class but usually that's just administrivia stuff so not a big deal (and you get OnDemand anyways).

    During class, if the instructor needs anything such as drinks, or finding support staff for technical issues. Just check in on breaks...usually they probably won't need much but you are expected to help if they do. Also watch their equipment on breaks but this might vary depending on the conference...the one I went to the rooms were open and I didn't really have to watch anything.

    End of class each day there are evaluations that you hand out and collect, then enter into the computer...pretty quick maybe 10-15 minutes because it's just the scores.

    Every night there is usually a talk of some sort that they need people to facilitate so you can sign up for these as well...or just show up to see the talk no signup required.

    At the end if they need help with teardown then you can help as well but when I was there they knocked it out well before we were done.

    It's honestly pretty easy and doesn't add a ton of extra time to your conference...well worth the discount. As somebody said, you are a student in the class and aren't expected to be the go to person...that's the instructor and TA if they have one.
  • TechGromitTechGromit A+, N+, GSEC, GCIH, GREM, Ontario, NY Posts: 1,888Member ■■■■■■■□□□
    UnixGuy wrote: »
    Also, do you create your index at the end of the day?

    This seems to be a very common question? Why is everyone in such a hurry to create an index? Your not taking a course from McSans, were you have have it your way in a few days. Unless your some kind of genius, studying and passing for a SANS exam takes at least a month of preparation. An index not something you work on during class or at the end of the each day of classes. There will be time enough to study and work on your index AFTER taking the course.
    Still searching for the corner in a round room.
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    Thanks everyone!

    No I'm not familiar with the material at all, so its a difficult course for me. I'll need plenty of time and dedication. Not sure how to tackle this the best way.

    I think so far everyone agrees that doing the Labs is a great strategy.
    Goal: MBA, March 2021
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    Silly question but...Dress code?? I imagine casual should do???
    Goal: MBA, March 2021
  • SteveLavoieSteveLavoie Posts: 644Member ■■■■□□□□□□
    it is covered in the Work Study guideline PDF

    https://www.sans.org/media/security-training/Work-Study-Program-Facilitator-Guidelines-Manual.pdf

    Dress Code

    Attire



    Recommended


    Black, grey or tan pants/slacks

    Polo or dress

    shirts/blouses with a collar


    Solid color


    Tucked in (with a belt if necessary)

    Pressed (if it is not knit)

    Dark or black shoes


    A lightweight black or tan jacket



    Hair should be combed

    Facial hair should either be shaved or groomed
    You may wear comfortable
    clothing on set
    -
    up day, as we will be unpacking many boxes and
    preparing book bags with courseware materials.

    A SANS conference shirt or any solid colored shirt or blouse with a collar may be worn. Black,
    grey, or tan colored slacks or pants are required
    on all class day.
    Wear comfortable shoes at conference and be prepared to walk several miles every day.

    Pack a light jacket/sweater as the rooms are air
    -
    conditioned
    Not recommended

    Graphic T
    -
    shirts

    Denim Jeans are not acceptable facilitator attire on class days, but acceptable ONLY on
    set

    -
    up day.



    White shoes

    Sweatshirts or hoodies
  • cyberguyprcyberguypr Senior Member Posts: 6,751Mod Mod
    Beware of the dress code. In the events I've been to (US) some coordinators have allowed facilitators to wear jeans, so YMMV. On the other hand, I remember one guy here saying that he facilitated an EMEA event and did something that violated the dress code and the coordinator penalized him by not giving him the MP3s, OnDemand access, or something else.
  • JoJoCal19JoJoCal19 California Kid Posts: 2,772Mod Mod
    cyberguypr wrote: »
    Beware of the dress code. In the events I've been to (US) some coordinators have allowed facilitators to wear jeans, so YMMV. On the other hand, I remember one guy here saying that he facilitated an EMEA event and did something that violated the dress code and the coordinator penalized him by not giving him the MP3s, OnDemand access, or something else.

    This. At the larger events it seems they may be more strict, also it depends on the coordinator. I know in Virginia Beach 2015 (can't believe its been that long since I've facilitated) the coordinator was super chill and didn't care about jeans and sneakers.

    I recommend since on the setup day (Sunday) you can wear whatever you want, that you talk to the coordinator in charge what they require for dress (which means pack slacks/khaki pants and button ups or polos and jeans) and go from there.
    Have: CISSP, CISM, CISA, CRISC, eJPT, GCIA, GSEC, CCSP, CCSK, AWS CSAA, AWS CCP, CEHv8, CHFIv8, ITIL-F, MS Cyber Security - USF, BSBA - UF, MSISA - WGU
    Currently Working On: Python, OSCP Prep
    Next Up:​ OSCP
    Studying:​ Code Academy (Python), Bash Scripting, Virtual Hacking Lab Coursework
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    whoa glad I asked!!!
    Goal: MBA, March 2021
  • LWB250LWB250 Posts: 59Member ■■■□□□□□□□
    Just came off facilitating for the second time at SANS Orlando. It was another great experience, however, I was wiped out by the time it was over. Facilitating takes a lot out of you more for the long hours than anything else.

    That being said, dress professionally to be absolutely safe - you can always dress down if the environment permits - but dressing better than everyone else (and I don't say that with any sort of superiority/snobbery) makes you stand out as a facilitator and gives you what I think is a little bit of an "edge" in the eyes of the SANS staff. My Dad always told me to dress like a professional and people will treat you like one. SANS is very much about their reputation and industry perception. Dressing professionally fits right in with their values.

    Without revealing too many secrets, what you've heard previously is about right. The first day is jeans and the grunt work of setting up materials and venue. The first day of registration/classes is long, typically starting as early as 6:00 am and not ending until after 6:00 pm in many cases. It's been my observation, although I can't confirm this, that it seems like a lot of the newer facilitators end up with the toughest schedules, that is, the boot camp classes that often run 12 hours a day like 301 and 401. I suspect it's either because they're new and signed up for them or it's a way of testing their mettle to see if they're fit for future facilitator assignments.

    Make yourself indispensable to your instructor. Mine have been very laid back and required little on my part, but both had specific criteria for how they wanted certain things done in the classroom. My first interaction with my instructors has always been an introduction and then "What can I do to make your class run as smoothly as possible?" or something to that effect. Once you know what their expectations are you're in good shape.

    I think a lot of the success of a facilitator when it comes to be invited back is their willingness to pitch in. I more or less mentored a couple of first time facilitators as well as spent my spare time before and after class volunteering for the person who supervised the facilitators. It takes a lot of work to pull these big events off successfully, so being available to help out when needed goes a long way to establishing your Facilitator "cred", I believe.

    Most importantly, be flexible. If you're OCD/a*nal/super structured, you won't do well. You have to be able to go with the flow and deal with things as they pop up without panicking. Stuff will happen, but when it does, be calm, know who your resources are, and move forward as best you can.

    Good luck in your facilitating. It's been a really great experience for me and I hope I can continue to participate - your ability to return is based on your performance and the ratings of your instructor and the facilitator's supervisor. There's a lot of intrinsic value in facilitating well beyond just getting a deal on the registration fee and resources. I look at it as an investment I'm making in SANS so they'll be better for me and others in our industry.
  • TechGromitTechGromit A+, N+, GSEC, GCIH, GREM, Ontario, NY Posts: 1,888Member ■■■■■■■□□□
    LWB250 wrote: »
    Without revealing too many secrets ...

    Do you sign a confidentiality agreement?

    I'm taking my third company paid SANS course In July, I'm wondering if they give preference to facilitators that attended / hold more certifications? I know that an instructor recommendation is golden, but all things being equal, does product loyalty pay off? :)
    Still searching for the corner in a round room.
  • LWB250LWB250 Posts: 59Member ■■■□□□□□□□
    TechGromit wrote: »
    Do you sign a confidentiality agreement?

    I'm taking my third company paid SANS course In July, I'm wondering if they give preference to facilitators that attended / hold more certifications? I know that an instructor recommendation is golden, but all things being equal, does product loyalty pay off? :)

    There is an NDA that is part of the work study agreement.

    I don't think the presence or number of certs necessarily affects your eligibility or likelihood of being chosen - my first time around I had no GIAC certifications at the time. I believe that your willingness to work hard and do a good job carries a great deal of weight once you've had a chance to facilitate.

    That's my personal observation, at least.
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    Fantastic information thanks guys!

    Yeah I figured it will be exhausting because it's all day. There is also events in the evening, do you guys attend those as well? They seem valuable!
    Goal: MBA, March 2021
  • LWB250LWB250 Posts: 59Member ■■■□□□□□□□
    UnixGuy wrote: »
    Fantastic information thanks guys!

    Yeah I figured it will be exhausting because it's all day. There is also events in the evening, do you guys attend those as well? They seem valuable!

    You typically have to work two events for the week. There is a lot of swapping of responsibilities, as facilitators will swap events with each other for things they want to see or participate in. NetWars and DFIR competitions require additional people, so those are often easy ones to do and fun to watch. If you're volunteering as "extra" help at one of these you might even get a drink ticket and munchies as part of the deal if you're living right.
  • UnixGuyUnixGuy SABSA, GCFA, GPEN, CISM, RHCE, Security+, Server+, CCNA Posts: 3,959Mod Mod
    The event is happening in my city and fairly close to where I live
    Goal: MBA, March 2021
Sign In or Register to comment.