🔏
RootGuard
HomeSOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
  • Welcome
    • RootGuard
      • Who Am I?
        • Professional Profile
  • Resources Hub
    • Blogs
      • Articles
        • Safeguarding SMEs: The Strategic Importance of a Security Operations Center (SOC)
      • Posts
        • Roadmap to Becoming a Cybersecurity Specialist
        • Starting a Career in Cybersecurity
        • A Guide to Landing Your First Cybersecurity Analyst Role
        • Moving from Intermediate to Expert Incident Responder
  • SOC Operations
    • Introduction
      • Development Resources
        • SOC Analysts Roadmap
        • Becoming A SOC Analyst
        • SOC Analysts Prep Interview Questions
    • Essential Skills
      • Critical Windows EventIDs to Monitor
    • Junior Analyst Skills
      • Splunk Use Cases
      • KQL Use Cases
        • Reconnaissance (TA0043)
        • Initial Access (TA0001)
        • Execution (TA0002)
        • Persistence (TA0003)
        • Privilege Escalation (TA0004)
        • Defence Evasion (TA0005)
        • Credential Access (TA0006)
        • Discovery (TA0007)
        • Lateral Movement (TA0008)
        • Collection (TA0009)
        • Command and Control (TA0011)
        • Exfiltration (TA0010)
        • Impact (TA0040)
      • Investigating Common Attacks
        • Domain Dominance Attacks - Detection & Analysis
        • Investigating a Suspected AD FS Distributed Key Management (DKM) Attack
        • Authentication From Suspicious DeviceName
        • Identifying Interactive or RemoteInteractive Session From Service Account
        • Identifying Split or Part Archive File Transfers
        • Detect Potential Cleartext Credentials in Command Line
        • Detecting Command Line Interpreters Launched via Scheduled Tasks
        • Detecting Files Containing Potentially Sensitive Data
        • Detecting DeviceNetworkEvents From Windows Processes and Domains by TLD
        • Detecting Silent cmd.exe Execution With Redirected STDERR & STDOUT
        • Detecting Low Prevalence DLL Loaded From Process In User Downloads Directory
        • Detecting Virtual Drive Mounted From Archive
        • Identify Execution of Script From User's Downloads Folder
        • Identify Potential RDP Tunneled Sessions
        • Identify Instances of PowerShell Invoke-WebRequest, IWR or Net.WebClient
        • Identify Processes Launched by PowerShell Remoting (WSMProvHost.exe)
        • Detect DeviceNetworkEvents for LOLBAS with Download or Upload Functions
        • Detect Execution of PSEXESVC via Remote Systems
        • Identify Suspicious String in Service Creation ImagePath
        • Identify File with Double Extensions
        • Detect Potential Cleartext Credentials in Commandline
        • Detect When Large Number of Files Downloaded From OneDrive or SharePoint
        • Identify and Investigate Phishing Attacks with KQL
      • PowerShell for SecOps
        • Powershell Remoting
        • Reconnaissance Discovery
        • Initial Access Discovery
        • Execution Discovery
        • Persistence Discovery
        • Privilege Escalation Discovery
        • Defence Evasion Discovery
        • Credential Access Discovery
        • Discovery
        • Lateral Movement Discovery
        • Collection Discovery
        • Command & Control (C2) Discovery
        • Exfiltration Discovery
        • Impact Discovery
      • Packet Analysis (pcap)
        • Tcpdump
        • Tcpdump (Intermediate)
        • Tshark
        • Ngrep
      • Investigating Suspicious Emails Using KQL
    • Intermediate and Advanced Skills
      • Investigate Using MITRE ATT&CK Methodology
        • Reconnaissance (TA0043) Techniques
        • Resource Development (TA0042) Techniques
        • Initial Access (TA0001) Techniques
        • Command Execution (TA0002) Techniques
        • Persistence (TA0003) Techniques
        • Privilege Escalation (TA0004) Techniques
        • Defence Evasion (TA0005) Techniques
        • Credential Access (TA0006) Techniques
        • Discovery (TA0007) Techniques
        • Lateral Movement (TA0008) Techniques
        • Collection (TA0009) Techniques
        • Command and Control (C2) (TA0011) Techniques
        • Exfiltration (TA0010) Techniques
        • Impact (TA0040) Techniques
    • Vulnerability Management
    • Malware Analysis
  • DFIR
    • Incident Response
      • Incident Triage
        • Triage Types and Processes
        • PowerShell for Detection and Analysis
          • Malware or Compromise Investigation
          • Lateral Movement Discovery
        • Registry Analysis
        • Sysinternals Intrusion Analysis
        • PowerShell Intrusion Analysis
        • Velociraptor Intrusion Analysis
        • Zimmerman Tools Intrusion Analysis
      • KAPE Artifacts Analysis
      • Velociraptor Artifacts Analysis
      • Using The Unified Kill Chain Model to Analyse Individual Cyber Attacks
        • Phase 1 - Gaining an Initial Foothold
          • Gaining Access to the Network
          • Establishing a Foothold
          • Network Discovery
      • Response Strategies
        • Privilege Escalation Assessment
        • Command and Control Assessment
        • Command Execution Assessment
        • Defence Evasion Assessment
        • Detection Assessment
        • Discovery Assessment
        • Exfiltration Assessment
        • Initial Access Assessment
        • Initial Impact Assessment Techniques
        • Lateral Movement Assessment
        • Persistence Assessment
    • Windows Forensics
      • Evidence of Execution
      • Window Artifact Analysis
        • Account Usage
        • User Activity Tracking (Event Logs)
        • Program Execution
        • File and Folder Opening
        • File Download
        • Browser Usage
        • Deleted File or File Knowledge
        • External Device & USB Usage
    • Linux Forensics
      • Linux Commandline Basics
      • Host Compromise Assessment
    • KQL for Defender & Sentinel
      • MDO (Office)
      • MDI (Identity)
      • MDE (Endpoint)
    • Memory Forensics
      • Memory Forensics (Volatility 3)
    • Playbooks
      • First Responder DFIR Playbook
        • Device Isolation
        • Evidence Collection
          • Acquire Triage Image Using KAPE
          • Acquire Triage Data Using Velociraptor
          • Acquire Triage Data Using Powershell
          • Acquire Triage Memory Image
          • Acquire Image Using FTK
          • AXIOM Cyber Data Collection
        • Windows Forensic Artefacts
          • Application Execution
          • File & Folder Knowledge
          • External Device Usage
          • Network Activity
          • Windows Event Logs
        • Initial Analysis
          • Memory Analysis (Vol 3)
          • Axiom Cyber Examiner
  • Detection Engineering
    • AD Attack Detections & Mitigations
      • Kerberoasting
      • Authentication Server Response (AS-REP) Roasting
      • Password Spraying
      • MachineAccountQuota Compromise
      • Unconstrained Delegation
      • Password in Group Policy Preferences (GPP) Compromise
      • Active Directory Certificate Services (AD CS) Compromise
      • Golden Certificate
      • DCSync
      • Dumping ntds.dit
      • Golden Ticket
      • Silver Ticket
      • Golden Security Assertion Markup Language (SAML)
      • Microsoft Entra Connect Compromise
      • One-way Domain Trust Bypass
      • Security Identifier (SID) History Compromise
      • Skeleton Key
      • Active Directory Security Controls
      • Active Directory Events for Detecting Compromise
    • Attack Triage Playbooks (KQL Triage)
      • Windows Malware Detection Playbook
      • Linux Host Intrusion Detection Playbook (CLI)
      • Linux Intrusion Detection Playbook
      • Large-Scale Compromise Detection Playbook
      • Ransomware Detection Playbook
      • Phishing Email Compromise Detection Playbook
      • Scam Detection Playbook
      • Customer Phishing Detection Playbook
      • Insider Abuse Detection Playbook
      • Information Leakage Detection Playbook
      • Social Engineering Detection Playbook
      • Malicious Network Behaviour Detection Playbook
      • Windows Intrusion Detection Playbook
      • Vulnerability Detection Playbook
      • Business Email Compromise Detection Playbook
    • Process Execution (KQL Triage)
    • Threat Hunting
      • Hunting Ransomware Indicators
      • Hunting With KQL
        • Detecting Malware Infection (MITRE ATT&CK: T1566, T1059)
        • Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)
        • Credential Theft (MITRE ATT&CK: T1003, T1078)
        • Lateral Movement (MITRE ATT&CK: T1076, T1021)
        • Data Theft (MITRE ATT&CK: T1041, T1071)
        • Detecting CommandLine Executions (MITRE ATT&CK: T1059)
        • Windows Security Logs (Identity and Logon Activities)
      • Hunting With Splunk
Powered by GitBook
On this page
  • Introduction to Cybersecurity
  • 6-Month Cybersecurity Career Plan
  • Month 1: Build Foundational Knowledge
  • Month 2: Obtain an Entry-Level Certification
  • Month 3: Develop Practical Skills
  • Month 4: Work on Personal Projects
  • Month 5: Gain Real-World Experience
  • Month 6: Apply for Jobs and Continue Learning
  • Goal: Secure your first cybersecurity job and continue advancing your knowledge.
  • Keys to Success in Cybersecurity
Edit on GitHub
  1. Resources Hub
  2. Blogs
  3. Posts

Starting a Career in Cybersecurity

Introduction to Cybersecurity

Cybersecurity protects systems, networks, and data from cyber threats, including unauthorised access, data breaches, and malicious attacks. It is an essential field in today’s digital landscape, ensuring the confidentiality, integrity, and availability of critical information. Cybersecurity professionals play a vital role in securing the digital infrastructure of organisations and individuals, working to anticipate, detect, and mitigate evolving threats.

Becoming a cybersecurity professional requires significant effort and commitment. It demands technical expertise, critical thinking, problem-solving, and ethical responsibility. Professionals must commit to lifelong learning and adaptability with the field constantly evolving. While challenging, a career in cybersecurity is highly rewarding, offering diverse opportunities, job security, and the chance to make a meaningful impact in protecting valuable assets.

Note: Customise the plan to include certification and courses of your choice; those mentioned will provide the relevant knowledge, but they may not suit your personal preferences.

6-Month Cybersecurity Career Plan

Month 1: Build Foundational Knowledge

Start by understanding the basics of IT and cybersecurity. Focus on networking concepts such as TCP/IP, DNS, firewalls, VPNs, and Windows and Linux operating systems. Scripting languages like Python or PowerShell are essential for automating tasks and analysing data. Explore cybersecurity fundamentals, including common threats, vulnerabilities, and attack vectors.

Action Plan:

  • Enrol in beginner courses such as “Introduction to Cybersecurity” (Cisco Networking Academy) or CompTIA IT Fundamentals (F+).

  • Use tools like Wireshark to analyse network traffic and practice basic troubleshooting.

  • Allocate time daily for structured learning to build a solid foundation.

Goal: Understand networking, operating systems, and cybersecurity fundamentals clearly.

Month 2: Obtain an Entry-Level Certification

Certifications validate your knowledge and make you a more competitive candidate for entry-level roles. Focus on earning a foundational certification such as CompTIA Security+ or CompTIA Network+. These certifications cover security principles, networking basics, and risk management.

Action Plan:

  • Dedicate 1–2 hours daily to studying certification materials.

  • Use resources like Professor Messer’s tutorials, practice exams, and official study guides.

  • Schedule your exam and focus on passing it within this month.

Goal: Earn your first cybersecurity certification to demonstrate your foundational knowledge.

Month 3: Develop Practical Skills

Hands-on experience is crucial in cybersecurity. Set up a virtual home lab using tools like VirtualBox or VMware to practice real-world scenarios. Learn how to configure firewalls, analyse logs, and conduct vulnerability scans. Platforms like TryHackMe and Hack The Box offer interactive, scenario-based challenges to enhance practical skills.

Action Plan:

  • Build a virtual lab and practice with tools like Nmap, Metasploit, and Splunk.

  • Complete hands-on exercises on threat detection, network monitoring, and vulnerability assessment.

  • Document your learning and progress in a personal journal or portfolio.

Goal: Gain confidence in using cybersecurity tools and applying practical skills.

Month 4: Work on Personal Projects

Apply your knowledge by building personal projects that showcase your skills. Projects could include conducting vulnerability scans in your lab environment, automating a security task using Python, or analysing a simulated attack.

Action Plan:

  • Create a GitHub repository to store and share your projects.

  • Document your findings in professional-style reports or blog posts.

  • Use platforms like Medium or LinkedIn to publish your work and demonstrate your expertise.

Goal: Build a portfolio that demonstrates your hands-on skills to potential employers.

Month 5: Gain Real-World Experience

Begin applying for internships or entry-level roles in IT or cybersecurity. Positions like SOC Analyst, IT Support Technician, or Cybersecurity Analyst are excellent starting points. Volunteer opportunities with nonprofits or small organisations can also provide valuable experience.

Action Plan:

  • Apply to internships and entry-level positions that align with your skillset.

  • Tailor your resume to highlight certifications, personal projects, and practical experience.

  • Join cybersecurity communities and forums to network with professionals and discover opportunities.

Goal: Gain real-world experience in a professional environment while expanding your network.

Month 6: Apply for Jobs and Continue Learning

With a solid foundation, certification, and practical experience, focus on actively applying for entry-level cybersecurity roles. Prepare for technical interviews by practising explaining key concepts, tools, and scenarios. Simultaneously, start studying for certifications like Certified Ethical Hacker (CEH), Cisco CyberOps Associate or the more advanced CompTIA Cybersecurity Analyst (CySA+).

Action Plan:

  • Apply to at least 10 roles per week, focusing on SOC or analyst positions.

  • Practice mock interviews and technical questions, such as explaining firewalls or identifying threats.

  • Enrol in a course or training program to deepen your expertise in a specialised area.

Goal: Secure your first cybersecurity job and continue advancing your knowledge.

Summary Timeline

Month

Activities and Milestones

Goal

Month 1

Learn IT basics, networking, operating systems, and start scripting.

Build foundational knowledge.

Month 2

Study and achieve an entry-level certification like CompTIA Security+.

Validate cybersecurity knowledge.

Month 3

Develop hands-on skills using virtual labs and tools like Nmap and Wireshark.

Gain practical experience.

Month 4

Work on personal projects and create a portfolio to showcase your skills.

Build demonstrable skills.

Month 5

Seek internships or entry-level roles; volunteer for cybersecurity projects.

Gain real-world experience.

Month 6

Apply for jobs, refine skills, and prepare for interviews; explore advanced certifications.

Secure your first cybersecurity job.

Keys to Success in Cybersecurity

  1. Commitment to Lifelong Learning: Cybersecurity evolves rapidly. Stay updated with emerging threats, tools, and techniques through continuous learning.

  2. Networking and Mentorship: Connect with industry professionals through LinkedIn, forums, and events.

  3. Hands-On Practice: Practical skills are as important as theoretical knowledge. Regularly test and refine your abilities in simulated environments.

  4. Resilience and Curiosity: The field demands critical thinking and problem-solving. Approach challenges with curiosity and persistence.

PreviousRoadmap to Becoming a Cybersecurity SpecialistNextA Guide to Landing Your First Cybersecurity Analyst Role

Last updated 3 months ago

Page cover image