Cyber Security Roadmap for Beginners: Skills, Labs and Certifications

Why cyber security is a good field to enter

Every organisation that uses software needs people who protect it. Roles range from defending systems to testing them by attacking them with permission. The field rewards curiosity and patience, and it welcomes people from different backgrounds, though you need solid fundamentals first.

The main career paths

• SOC analyst (blue team): monitors alerts, investigates incidents and responds. A common entry point.
• Penetration tester / ethical hacker (red team): tests applications and networks for weaknesses.
• Application security engineer: reviews code and builds security into development.
• Cloud security engineer: secures cloud accounts, identities and workloads.
• GRC (governance, risk, compliance): policies, audits and standards such as ISO 27001. Less technical, still important.
• Digital forensics and incident response: investigates breaches and recovers evidence.

You do not need to choose on day one. Most people begin with fundamentals and a SOC or security-support role.

Stage 1: IT fundamentals (weeks 1–8)

You cannot defend what you do not understand.

• Networking: OSI and TCP/IP models, IP addressing and subnets, DNS, HTTP/HTTPS, TLS, firewalls, VPNs. Use Wireshark to look at real traffic.
• Linux and Windows: command line, users and permissions, processes, logs, services
• Basic scripting: Bash and Python for automation (Python guide)
• How web applications work: requests, cookies, sessions, APIs (backend roadmap)

Stage 2: security core concepts (weeks 6–16)

• The CIA triad (confidentiality, integrity, availability), threats, vulnerabilities and risk
• Cryptography basics: hashing, symmetric and asymmetric encryption, certificates, password storage
• Authentication and authorisation, multi-factor authentication, single sign-on
• Common attacks: phishing, malware, ransomware, SQL injection, cross-site scripting, brute force, privilege escalation
• The OWASP Top 10 for web application risks
• Frameworks and standards: MITRE ATT&CK, NIST, ISO 27001

Stage 3: hands-on practice (weeks 10–30)

Theory is not enough. Use legal, safe labs only.

• TryHackMe and Hack The Box for guided learning paths and challenges
• OWASP Juice Shop and DVWA for practising web vulnerabilities on your own machine
• Build a home lab with virtual machines (VirtualBox or VMware)
• Blue team: set up a SIEM such as Splunk Free or Elastic, collect logs and write detection rules
• Red team: learn Nmap, Burp Suite, Metasploit basics and a methodical testing process

Important: only test systems you own or have written permission to test. Unauthorised testing is illegal, even with good intentions.

Stage 4: certifications that employers recognise

Certificates help recruiters filter, especially when you have no experience. Common choices:

Level	Examples
Entry	CompTIA Security+, Google Cybersecurity Certificate
SOC / blue team	CompTIA CySA+, Splunk or Microsoft security certifications
Penetration testing	eJPT, PNPT, then OSCP (advanced)
Cloud security	AWS Security Specialty, Azure SC-200
Management	CISSP (after several years of experience)

Choose certificates to match your target role, and pair each with hands-on proof.

Build a portfolio

• Write blog posts or notes explaining labs you completed (without leaking spoilers for live competitions)
• Publish scripts or detection rules on GitHub
• Participate in CTF (capture-the-flag) events
• Report valid vulnerabilities through legitimate bug bounty programmes once you are skilled, following their rules

Interview topics

• Explain the difference between symmetric and asymmetric encryption
• What happens in an HTTPS handshake
• How would you investigate a suspicious login alert?
• Explain XSS, CSRF and SQL injection and how to prevent them
• Walk through an incident response process
• Scenario questions about phishing, ransomware or a leaked credential

Strengthen your general preparation with the technical interview checklist.

Next steps

Pair security knowledge with DevOps and cloud skills for high-demand cloud security roles. Look at fresher and internship openings in security operations to find your first role.