how to organize training for 1 thousand people

While the information security industry is talking about a shortage of trained specialists, we at Solar Group have identified an effective recipe for training personnel, thanks to which we have significantly increased the number of employees in our team – and decided to share this recipe. Our series of articles will consist of several parts. In this article, we will tell you step by step how we managed to organize an internship at the Solar JSOC cyber attack counter center for 1.1 thousand people.

In total, Solar JSOC employs more than 750 employees – while in 2023, almost 1,500 people completed internships, and at least 100 of them became employees of the company after training.

We started conducting internships in 2016. I myself was included in the very first recruitment, and went from an intern engineer in Nizhny Novgorod to an engineer in the technical competence development group. It all started with meetings with experts in a cozy classroom the size of a kitchen in a Khrushchev-era building, but they did not last long – the company was actively expanding, offices appeared in Samara and Khabarovsk, where they recruited a team remotely through online internships. By this time, I was already conducting internships and training for customers, and then went on business trips, where I taught novice specialists how to work according to our work flow.

Over the years, it became more and more difficult to recruit interns – their salary expectations grew, while competitors appeared who also entered universities with their own internships and pulled some of the potential employees over. It was impossible to carry out the process in the old way – it was necessary to create a new training program, prepare the necessary materials, go on cross-business trips with new employees, walk to the bar for team building activities. But we all started with advertising.

Stage 1. Advertising

To get an internship, an intern must first find out about it. To do this, for example, we launched contextual targeted advertising on social networks, but it did not have the desired effect. But the most effective tool turned out to be word of mouth – as it turned out, people believe the company’s advertisements, even from former employees, much more than advertisements on the Internet.

We also have a landing page: https://rt-solar.ru/start/. In case of JSOC – Solar Cyber ​​Dive. Next, those interested are invited to pass the qualifying test. If you complete it successfully, you will receive links with an invitation to a closed Telegram chat and a channel for trainees.

Stage 2. Avoid boring lectures

Like many, it all started with the COVID-19 pandemic. It only strengthened our movement towards remote internships and the development of distance learning materials. Then we introduced an LMS (Learning Management System – a platform for online learning) into the internship process.

In the LMS, which is also known to interns as the “intern portal,” we use a news feed, longreads, and quizzes. We realized that it is more interesting to study theoretical lectures in the longread format – they are available 24/7 and do not require a single gathering of people around one teacher, after whose speech you sometimes remember no more than 5-10% of the entire material. That is why we translate all the accumulated knowledge that will not lose its relevance into a clear and readable text. You can work with it autonomously from anywhere on the planet, and if questions arise, you can always re-read the module and ask the mentor a question.

The test, in turn, consolidates the knowledge gained after studying the longread. In addition, we conduct laboratory work and give the trainee feedback on each of them.

Stage 3. Feedback and community creation

Another equally important part of the internship is to enable interns to receive quick responses from mentors, keep abreast of all the news and communicate with each other in a free format.

For prompt communication, we use the news feed in the LMS, Telegram channel and chat.

We link the chat to a channel and divide it into topics corresponding to the directions. In them we try to form a community that is able to support itself – we participate in conversations, give advice and answer a number of questions, and also warn about the imminent start of classes and arrange quizzes and surveys.

Not without moderation. We have introduced a bot into the chat that answers the most popular questions, manages the karma of participants, filters spam and messages using obscenities, issues warnings and bans “rebels”. With a large flow of students, this is vitally important, since it is unrealistic to maintain such a register manually. It feels like this automation saves 6-10 hours per month with ~1.1 thousand participants entering one internship. We reward trainees who are often thanked in the chat with an achievement on the trainee portal.

As a result, a productive environment is formed where trainees help each other, talk about their experiences or post funny memes.

The LMS and Telegram channel contain the most important information for the intern – when the class will be, what work needs to be passed, in which cities and in what areas employment is expected, etc.

So that the trainee can try on the role of an employee, we conduct prof. orientation meetings, office tours and PGC (“What? Where? When?”). Working at JSOC and MSS are team sports, just like CHC. That is why intellectual games help to develop the skill of working in a team. Participants of the winning teams from different regions also receive an achievement on the trainee portal.

Photo 2. Excursion in October 2023 in Nizhny NovgorodStage 4. Webinars

When I taught my first classes without presentations, I realized: if there is nothing to tell, and there are still 40 minutes until the end of the lesson, then start drawing on the board. This process consumes a fantastic amount of time for both the teacher and the students. To save this time, we try to optimize this process as much as possible.

That is why, instead of webinars in the classical sense, we conduct workshops and show cases.

Our classes consist primarily of live systems demonstrations, teacher demonstrations, and interactivity. For the internship, we have a dedicated stand that simulates a real IT infrastructure: DC, terminal server, workstations with Windows and Linux OS, various information security systems (SIEM, NGFW, WAF, Proxy), bWAPP, there are separate segments for pentesting. We let you touch different pieces of hardware and consolidate practical skills. We provide access to the stand via VPN. For each participant we generate a personalized account with a minimum set of rights.

This is exactly what an intern who has no experience and no idea about the profession needs. It’s better to see work with the same computer networks once, look at traffic analysis and configure NGFW rules, talk with a teacher about his experience, than to hear about the abstract 7 layers of the OSI model for the hundredth time.

Stage 5. Strict selection

In the middle of the internship, we have an “equator” stage, during which we weed out completely inactive participants – alas, sometimes we come across such people. At the end we conduct an exam. For monitoring specialists, the exam involves investigating a complex incident using SIEM and writing an investigation report. We give future administrators a test on practical tasks + several tasks of medium complexity, for example, setting up a network in Cisco Packet Tracer, limiting the amount of memory allocated to processes, etc. Based on the results of testing, we invite the best trainees for interviews and make offers.

Thus, the combination of PR activities, LMS, chats and channels, methodological base, online and offline events make it possible to organize an internship, with which more than 1 thousand people at the entrance turn into 90-100 new employees.

Alexander Odoevsky, engineer of the technical competence development group at Solar Group of Companies