Cybersecurity Analyst Roadmap — From Beginner to Hireable
Cybersecurity analyst roadmap from beginner to hireable: networking, attacks, detection and investigation. Kaidoro adapts it to your background and deadline.
This is a starting point — make it yours
Use this goal to build your own roadmap — tailored to you and starting fresh.
The ground you defend
You cannot secure infrastructure you don't understand. This phase is unglamorous and non-negotiable.
Learn networking to the packet level~15h
TCP/IP, DNS, HTTP, TLS, NAT, and what a three-way handshake looks like in Wireshark. Almost every detection you will ever tune is an assertion about traffic.
Done when: you can capture your own traffic and explain a DNS lookup and a TLS handshake packet by packet.
Learn Linux and Windows internals from a defender's view~15h
Processes, services, the registry, scheduled tasks, permissions, and where each system writes its logs. Knowing what normal looks like is the entire basis of spotting abnormal.
Done when: you can list running processes on both and explain what each of the top ten is.
Build a home lab you can safely break~8h
Two or three VMs on an isolated virtual network — a victim, an attacker box, and something collecting logs. Everything later happens here, where the blast radius is zero.
Done when: the VMs exist, can reach each other, and cannot reach your real network.
Learn scripting for analysis~12h
Python and shell for parsing logs, extracting indicators and automating the boring parts. Analysts who can script get through triage several times faster than those who can't.
Done when: you can parse a 100MB log file and produce a top-ten table of source IPs.
How attacks actually work
Understand offence to build defence. Everything in this phase happens in your lab or on a legal training platform — never against systems you don't own or aren't authorised to test.
Learn the MITRE ATT&CK framework and use its vocabulary~8h
Tactics, techniques and procedures. It is the shared language of the industry — every detection tool, threat report and interview will assume it.
Done when: you can map a described intrusion to at least six ATT&CK techniques.
Work through TryHackMe or HackTheBox defensive paths~25h
Legal, sandboxed practice ranges built for exactly this. Work the blue-team paths — the point is recognising an attack in logs, not collecting exploits.
Done when: one full defensive learning path is complete.
Learn the OWASP Top Ten by exploiting a deliberately vulnerable app~15h
Run something like Juice Shop in your lab and work through injection, broken auth, XSS and access control failures. Seeing the request that does it makes the defence obvious.
Done when: you have demonstrated five of the top ten in your own lab and explained the fix for each.
Learn phishing and social engineering as the dominant entry point~8h
Most real incidents start with a person, not an exploit. Learn to analyse a suspicious email — headers, sender infrastructure, attachments — safely, in your lab.
Done when: you can analyse a phishing sample and write up its indicators without executing anything.
Detection and investigation
The actual day job: alerts arrive, and you decide what happened.
Set up a SIEM in your lab and feed it real logs~15h
Elastic or Wazuh, both free. Ship logs from your VMs and get comfortable querying them. The searching, not the installing, is the skill.
Done when: logs from two hosts are searchable and you can answer 'what did this host do at 14:05?' in under a minute.
Write ten detection rules and test them~15h
Simulate the behaviour in your lab, write a rule that catches it, then deliberately try to evade your own rule. Tuning out false positives is most of detection engineering.
Done when: ten rules exist, each tested against both a true positive and a benign lookalike.
Investigate three simulated incidents end to end~15h
Alert, triage, scope, timeline, root cause, recommendation. Build the timeline before forming a theory — analysts who theorise first find evidence for the wrong story.
Done when: three written investigations exist, each with a timeline and a recommendation.
Learn the incident response lifecycle~6h
Preparation, detection, containment, eradication, recovery, lessons learned. Know when containment beats investigation — sometimes you pull the plug and ask questions later.
Done when: you can explain each phase and give an example of a decision made in each.
Employable
Security hiring leans heavily on demonstrable practice and a couple of specific certifications.
Earn a recognised entry certification~30h
CompTIA Security+ or Blue Team Level 1. Security is one of the few fields where an entry certification genuinely moves CVs past the first filter.
Done when: the exam is passed, or booked with a study plan finished.
Write up three investigations publicly~10h
A blog or a repo: the alert, what you checked, what you concluded, what you would recommend. Written analysis is the core deliverable of the job, so demonstrating it directly is worth more than a certificate.
Done when: three write-ups are public and readable by a non-specialist.
Practise explaining a technical incident to a non-technical audience~5h
Interviews test this because the job requires it. What happened, what it means for the business, what you recommend — with no jargon.
Done when: you can explain one investigation in two minutes to someone with no security background.
Follow the field weekly for three months~12h
One newsletter, a couple of vendor research blogs, and CISA advisories. Being able to discuss a recent significant incident intelligently is a standard interview question.
Done when: twelve weeks of reading are done and you can discuss two recent incidents in detail.