Cyber Security Roadmap
Cyber Security Analyst
A security analyst finds weaknesses before an attacker does and responds when one gets through. The sequence is networking and operating systems first — you cannot defend a system you do not understand — then security fundamentals and cryptography, then web and application attacks, then the defensive side: monitoring, incident response and compliance.
By the end: Spot, investigate and respond to a real intrusion, and harden what let it in.
The Cyber Security Analyst Roadmap
Systems and Networks~1 month
You cannot defend what you do not understand. This stage is not skippable.
Networking fundamentals
The OSI model, TCP/IP, routing and DNS. Every attack and every detection lives on this layer.
Ports and protocols
What should be listening, so that what should not be is obvious.
Linux
Permissions, processes, logs and users — the system half of most investigations.
Windows and Active Directory
Where most corporate estates live, and where most real intrusions actually happen.
Scripting
Python and shell to automate triage. An analyst limited to a tool's UI is limited full stop.
Security Fundamentals~1 month
The vocabulary and the principles the whole field is built on.
CIA triad and threat modelling
Confidentiality, integrity, availability — then who wants to break which, and how.
Cryptography basics
Hashing, symmetric and asymmetric encryption, and signatures. Use them, never invent them.
PKI and TLS
Certificates, chains of trust and what an expired certificate actually breaks.
Authentication and access control
MFA, least privilege and the identity layer that most attacks now target first.
Password security
Hashing, salting, rotation myths and why length beats complexity rules.
Social engineering
The most successful attack vector there is, and the one no firewall stops.
Application and Web Security~1 month
Where most exploitable bugs are, because that is where most new code is.
The OWASP Top 10
The vulnerability classes actually exploited in the wild, with the fix for each.
Injection
SQL injection and its relatives. Parameterise queries; string concatenation is the bug.
XSS and CSRF
Two browser-side attacks with two different fixes that people routinely confuse.
Security headers
CSP, HSTS and the rest — cheap, high-value hardening that most sites still lack.
API security
Authentication, rate limits and object-level authorisation — the modern attack surface.
Secure coding
Read code with an attacker's eye. You will review more than you write.
Offensive Basics~1 month
Enough attacker technique to understand what your alerts are describing.
Reconnaissance and scanning
Nmap and service discovery — what an attacker sees before touching anything.
Traffic analysis
Wireshark and packet reading. The ground truth when logs disagree.
Web proxies
Burp Suite to intercept and modify requests — how web testing is actually done.
Penetration testing basics
Methodology, scope and rules of engagement. Authorisation in writing, always.
Practise legally
Your own lab and sanctioned platforms only. Scanning something you do not own is a crime, not a portfolio piece.
Defensive Operations~1 month
Where the overwhelming majority of security jobs actually are.
Logging and SIEM
Collect, normalise and correlate. Detection is a data problem before it is a security one.
Detection and triage
Turn an alert into a verdict quickly, and tune out the noise that causes fatigue.
Incident response
Contain, eradicate, recover, then write the postmortem that prevents the repeat.
Hardening
Firewalls, baselines and patching — unglamorous work that prevents most incidents.
Malware and ransomware
Recognise the behaviour, and know that backups you have never restored are not backups.
Cloud and container security
Misconfigured IAM and public storage cause more breaches now than exploits do.
Compliance and Career~1 month
Prove it to an employer.
Governance and compliance
ISO 27001, SOC 2 and GDPR. A large slice of the day job in any regulated organisation.
DevSecOps
Shift security into the pipeline — scanning and policy as code rather than a gate at the end.
Certification
Security+ first for the filter, then a defensive or offensive specialisation.
Build a home lab
Virtual machines, a SIEM and deliberately broken targets. The portfolio for this field is a lab.
Resume and applications
Name the tools and the incident types you have handled — recruiters filter on both.
Frequently Asked Questions
Do I need to learn to code for cyber security?
Enough to read and script. Python for automation, shell for everyday work, and enough JavaScript and SQL to recognise an injection when you see one. You are not writing applications, but an analyst who cannot script is limited to whatever a tool's UI exposes.
Which certification should I start with?
CompTIA Security+ is the usual entry point and clears a lot of HR filters. After that it splits by direction: defensive roles look for CySA+ or a SOC-focused certificate, offensive roles for OSCP, which is a hands-on exam and considerably harder.
Is ethical hacking the same as cyber security?
No — it is one part. Penetration testing is a small, competitive slice of the field. The great majority of jobs are defensive: monitoring, incident response, identity, compliance and hardening. Most people who chase the offensive route end up hired defensively.
Can I get a security job with no IT experience?
It is hard, because security is applied knowledge of systems you have not administered yet. The common route is one or two years in help desk, networking or system administration first — that background is what turns an alert into an investigation instead of a guess.