Cybersecurity Career Guide: Roles, Skills and Certifications

The role map, and which seats hire juniors

• ✓Two routes hire the most juniors: a SOC seat, and GRC work for people with a compliance, audit or process background.
• ✓IT support and system administration are legitimate and common on-ramps, because they build the operating system and network fluency security work needs.
• ✓Developers moving into application security have an advantage most career changers do not: they can read and reason about code.

The foundations you cannot skip

This is where most self-taught beginners go wrong: they start with security tools before understanding the systems those tools examine. A tool output you cannot interpret is worse than useless, because it produces confident wrong conclusions.

• ✓Networking - the layered model, TCP and UDP, IP addressing and subnetting, DNS, DHCP, NAT, HTTP and HTTPS, TLS, routing and switching, and firewalls. You must be able to read a packet capture and explain what a connection did.
• ✓Operating systems - Linux especially: the filesystem, permissions, processes, services, logs, and the command line. Then Windows: Active Directory, users and groups, event logs, and the registry.
• ✓Scripting - Python for automation and parsing, plus shell scripting. You will spend more time processing logs than using flashy tools.
• ✓How the web works - requests and responses, cookies and sessions, authentication, same-origin policy, and the common vulnerability classes.
• ✓Cryptography at a working level - symmetric versus asymmetric, hashing versus encryption, digital signatures, certificates and public key infrastructure. Enough to use it correctly and spot misuse; you do not need to design ciphers.
• ✓Basic system administration - you cannot defend infrastructure you have never had to run.

Security-specific knowledge

• ✓The core concepts - confidentiality, integrity and availability; authentication versus authorisation; least privilege; defence in depth; the difference between a vulnerability, a threat and a risk.
• ✓Common vulnerability classes and, more importantly, why each occurs: injection flaws, broken authentication and session handling, access control failures, misconfiguration, insecure deserialisation, and outdated components.
• ✓Attacker methodology as a framework - reconnaissance, initial access, privilege escalation, persistence, lateral movement, exfiltration. Understanding the sequence is what lets a defender interrupt it.
• ✓Defensive tooling and concepts - logging and monitoring, SIEM, endpoint detection, intrusion detection, vulnerability management, patching discipline, and backup and recovery.
• ✓Identity as the modern perimeter - multi-factor authentication, single sign-on, privileged access management, and why credential compromise is the most common route into an organisation.
• ✓Frameworks and compliance - the widely used control frameworks, and what a data protection regime requires. Unglamorous, and a large share of actual security work.

Certifications: which, and when

Security is one of the few areas of tech where certifications genuinely help, because employers use them as a screening baseline and many public-sector and regulated roles require them outright. But the order matters, and some are widely misunderstood.

• ✓Start with a foundational certification covering broad security concepts - this is the standard baseline for a first security job and is designed for entry level.
• ✓Networking and Linux certifications are worth considering first if your fundamentals are weak. They are not security certifications, but they fix the gap that actually blocks you.
• ✓Offensive, hands-on practical certifications carry real weight for testing roles, but they are demanding and are not a starting point. Attempt them once your fundamentals are genuinely solid.
• ✓Senior management-oriented certifications typically require several years of verified professional experience before you can be fully certified. Students sometimes target these first and lose a year discovering the requirement.
• ✓Cloud security certifications are valuable if you already have cloud experience, and largely wasted if you do not.
• ✓Check the current requirements and syllabus on the certifying body's own site before paying for anything. Names, versions and prerequisites change, and third-party summaries go out of date.

Building hands-on skill, legally

Security is a practical field and cannot be learnt from reading. It is also a field where practising on the wrong target is a criminal offence, so the boundary needs to be explicit: only ever test systems you own, or systems you have written authorisation to test. Curiosity is not authorisation, and neither is a publicly reachable login page.

• ✓Build a home lab with virtual machines - a Linux server, a Windows machine, and a network you configure yourself. Breaking and fixing your own infrastructure teaches more than any course.
• ✓Use deliberately vulnerable applications and training environments designed for practice. These exist precisely so you can attack something legally.
• ✓Capture the flag competitions - excellent for skill building, entirely legal, and genuine resume material.
• ✓Bug bounty programmes, but only strictly within the published scope and rules of a programme that has invited testing.
• ✓Defensive practice too: set up log collection, generate suspicious activity in your own lab, and learn to detect it. Detection skill is what SOC roles actually hire for, and far fewer beginners practise it.
• ✓Document what you do. A written account of a lab exercise or a CTF solve is portfolio evidence, and writing is a large part of real security work.

A realistic 12-month plan

Note where the emphasis sits. Nine of the twelve months go to fundamentals and defensive skill, not to offensive tooling - which is the opposite of how most beginners spend their first year, and a large part of why they struggle to get interviews.

Interviews and the first role

• ✓Expect fundamentals questions: explain what happens when a browser loads a page, how TLS establishes trust, what a specific vulnerability class is and how to prevent it.
• ✓Expect scenario questions: an alert fires - what do you do first? These test process and judgement, so answer with a sequence rather than a guess.
• ✓Expect to discuss your lab and your CTF work in detail. It is the substitute for professional experience and interviewers take it seriously.
• ✓Communication is weighted heavily. Security work involves explaining risk to people who do not want to hear it, and writing findings that someone will act on.
• ✓Be honest about limits. Overclaiming in security interviews is unusually easy to expose and unusually damaging when it is.