Hi everyone,

First post from a long-time lurker. Figured this would be a good opportunity to start contributing to the awesome EH forum. Note that the following is cross-posted at TechExams.net

-------

I was recently selected as a facilitator for a SANS conference through their Work-Study program. I was chosen as a room facilitator for SEC401 (GSEC), it will be my first SANS event, and this thread is intended to document my experience.

Program overview

Work-Study program page provides a decent overview. In a nutshell, it is a program that allows individuals attend a SANS conference and a specific course at a discounted rate (~20%, $850 as of now) in exchange for their assistance during the event. Other perks include complimentary OnDemand for the course, access to other talks at the conference, and complimentary GIAC exam attempt (conditions apply).

Application

The application process is easy, one needs to fill out a form on the SANS web site, choose a specific event and list classes in the order of personal preference. I applied 5 times, received no feedback for 2 of the applications, 2 rejection letters, and finally 1 acceptance letter. In the cases where I did receive feedback, it was 4-8 weeks before the event start date.

I was chosen for SEC401 (GSEC). This course was not my first choice, and I did hesitate for some time, but decided to take it, mainly to solidify chances of getting accepted to a 500-level course in the future. Besides, from what I gather, it is a very solid and broad course that will compliment my CISSP studies.

Registration

Again, a straightforward process. SANS sends a contract to sign, and requires the person to return it by a certain date. At this point I solicited my employer's approval and financial support to attend the conference, and once the training reimbursement paperwork has gone through the internal process, sent signed contract back to SANS and paid the fees. Once payment was processed, I received access to OnDemand materials as well as a detailed brochure on what to expect and plan for in this role. As I understand, GIAC attempt will be provided after the conference.

Conference

TBA

Resources

Reviews that helped me a lot in deciding whether I want to do it:

GIAC Certified Penetration Tester (GPEN)
SANS Workstudy, a day by day breakdown =)
SANS Canberra 2009 Wrap up

Yes, welcome. Great first post!

Work study is a great option if you're on a budget. I've been accepted to a couple before, but I've declined because they weren't the courses I had my sights set on.

I achieved 3 of my GIAC certs this way and just got back today from doing the new SEC575 Mobile Pentest course in VA Beach (no cert available yet). I'd be happy to provide any feedback on the process. By the way, I'll be posting a course review of SEC575 shortly. It was a great course and I have some thoughts on it and future mobile pentesting courses I'd like to share but don't want to derail this thread.

As far as selection, SANS STI students always get first dibs, even if they don't need the course for graduation. While I am currently in STI, I just started so that did not impact the 4 times I've been selected to facilitate.

The next thing they look at, is if you've facilitated before and what kind of reviews the instructor gave you. We have had some really bad facilitators that were not asked back a second time. It's hard work and SANS puts a lot of trust in the volunteers so laziness, evidence of untrustworthiness or general douchebaggery are good ways to ensure you don't get asked to return. I've seen facilitators do really stupid things for minimal gain that jeopardize what I think is the best deal for training on the market today.

They typically don't like to pair up 2 newbies if they can help it and for the larger classes will often pair a veteran with a first timer. If they can run with all veterans and have enough to fill the seats I'm sure they would but that generally does not happen. For instance in VA Beach week 1, we had 2 veterans, myself and a guy who's done it 8 or so times and 2 first timers. At big events like Orlando it seems more like 25% first timers. Typically veterans wind up in the newer more popular courses and first timers wind up in courses the veterans have all taken, 401 being a good example of that. That's not always the case, but is a common scenario.

They also look at things like if you are a community SANS instructor, a local mentor (SANS Mentor program), a GIAC cert holder, and several other areas. You can see what I mean when you fill out the application. A yes in most of those areas will certainly help your application but I'd suggest being honest there.

It's a ton of work at the big conferences, you will be working 14 to 16 hour days frequently. Smaller conferences you might have 1 or 2 12 to 14 hour days and the rest it's closer to 10. I don't mind the work and the value from meeting all the other facilitators and getting more facetime with the instructors is invaluable. It's a great networking opportunity in addition to being an amazing discount on training. A SEC560 course (Network Pentest) with GPEN certification attempt and 4 months of OnDemand would normally be over $5,000 but you are getting it for $850. That's insane. Personally, even if my employer wanted to pay the full amount I'd probably facilitate anyway. It's certainly a lot of fun. Good luck on your 401 course.

Arrive day before conference for setup which includes:

• Moving and unboxing books, shirts, merchandise. May be manual labor intensive. Don't be a wuss, I've seen 90 lb women handle this just fine.
• Creating registration kits (folder with materials) and putting name badges together
• Inventory courseware
• Putting course bags with books together
• Staffing registration desk
• Setting up table with marketing materials
• Signage

Day 1 of conference and beyond:

• Setting up and staffing bookstore
• Handing out evaluations for nighttime sessions
• Monitoring door to room to ensure all students are wearing their badge and are authorized to be in that class
• Providing general assistance for questions like "where are the bathrooms?" or "Where is my class?"
• Assisting instructor as needed - usually just entails bringing them their beverage of choice and handing out the eval forms, and extra course materials like handouts and CD's. Some instructors may ask for more, but you are NOT a teaching Assistant. I usually wind up helping people with VMware setups but some instructors may prefer you not to help at all.
• Entering evaluation scores into SANS laptop every night
• Other duties as assigned
• Have fun
• Profit
• Tear down conference and box up to be shipped - Usually leave around 6 PM on last day, sometimes slightly later

You can also apply for/from UK.

Thanks for welcomes and all the great feedback, nice to see that EH is so active!

dynamik, I know what you mean, I originally had no intention to take SEC401, but when the opportunity presented itself, it was too tempting to resist.

tturner, really appreciate your detailed posts. You mentioned volunteer pairing - is that two facilitators in one class? As a newbie, is it possible that I would be the only facilitator for the class? It's a smaller event.

Thank you much! The way I look at it - if my employer was willing to pay the full price for a single SANS course, I'd rather take that money and faciliate at several events to maximize the ROI.

At smaller events or for less popular classes you will most likely be facilitating the class by yourself. It's not too bad though, most of the work is done with a team before classes even start and there will be plenty of veterans there to answer any questions.

Looks like no GWAPT or even GPEN at my nearest conference this year, guess I won't have to try to be a volunteer until next year!