Security starts with understanding how networks work. Learn TCP/IP, OSI model, DNS, HTTP/S, subnets, and how data flows across the internet.
By the end, you'll be able to
Mini-project
Capture and analyze network traffic with Wireshark for 1 hour. Identify all protocols, DNS queries, and any unencrypted data. Write a report.
Most servers run Linux. Master the command line, file permissions, services, firewall configuration, and system hardening.
By the end, you'll be able to
Mini-project
Set up a Linux VM, harden it (disable root login, configure firewall, set up fail2ban, audit permissions), and document your hardening checklist.
Learn core security concepts: CIA triad, authentication, encryption, risk assessment, and frameworks like NIST, OWASP, and ISO 27001.
By the end, you'll be able to
Mini-project
Conduct a security assessment of a small website: check for OWASP Top 10 vulnerabilities, SSL configuration, and security headers. Write a report.
Think like an attacker to defend like a pro. Learn reconnaissance, scanning, exploitation, and how to write professional penetration test reports.
By the end, you'll be able to
Mini-project
Complete 10 rooms on TryHackMe or 5 boxes on HackTheBox. Document your methodology for each one.
Web apps are the #1 attack surface. Master SQL injection, XSS, CSRF, SSRF, authentication bypasses, and how to prevent them.
By the end, you'll be able to
Mini-project
Practice on OWASP WebGoat or DVWA: exploit every vulnerability, then patch each one. Document the attack and fix for each.
Learn how SOCs operate. Set up SIEM tools, write detection rules, and practice incident response: identification, containment, eradication, recovery.
By the end, you'll be able to
Mini-project
Set up a basic SIEM (ELK or Splunk Free) and create detection rules for 5 common attack patterns. Practice investigating sample incidents.
Cloud is where everything runs now. Learn AWS/Azure security: IAM, security groups, encryption, compliance, and cloud-specific threats.
By the end, you'll be able to
Mini-project
Audit a sample AWS environment: check IAM policies, security groups, S3 bucket permissions, and encryption. Write a findings report.
Cybersecurity values certifications more than most fields. Prepare for CompTIA Security+, CEH, or similar while building a portfolio of security projects.
By the end, you'll be able to
Mini-project
Set up a home security lab (VMs, vulnerable apps, monitoring). Complete 20 CTF challenges and write detailed walkthroughs for your portfolio.
Recommended Resources
Security interviews test: networking fundamentals, attack scenarios, incident response, and hands-on skills. Many include a practical lab test.
By the end, you'll be able to
Mini-project
Practice 30 security interview questions, do 2 mock interviews, and prepare 3-minute summaries of your best security projects.
Not sure if this is the right roadmap? Browse all our career paths and find the one that matches your goals.