Cybersecurity Career Roadmap by Het Mehta

Learning Path & Key Concepts:

Begin with the absolute basics: define what constitutes a network, differentiate between Local Area Networks (LANs) and Wide Area Networks (WANs), and understand common network layouts or topologies.[2, 5] From there, delve into the conceptual models that govern network communication:

• OSI Model: Understand the purpose of each of the seven layers (Physical, Data Link, Network, Transport, Session, Presentation, Application). For a solid foundation, focus primarily on the functions of Layers 1-4, which handle the physical transmission, local network addressing, network-wide routing, and reliable data delivery.[5, 6, 7] This model provides a universal language for understanding network processes.[6]
• TCP/IP Model: Learn the four layers (Network Access/Link, Internet, Transport, Application) and how they relate to the OSI model. This model is the practical foundation of the internet.[5, 6] Key concepts include:
  • IP Addressing: Grasp IPv4 addresses, subnet masks, the concept of subnetting, and the basics of IPv6.
  • TCP vs. UDP: Understand the difference between connection-oriented (reliable) and connectionless (fast) transport protocols.[6, 7]
  • Common Ports & Protocols: Recognize essential protocols like HTTP/HTTPS (web), DNS (name resolution), DHCP (IP assignment), SMTP (email), FTP (file transfer) and their default port numbers.[5, 7, 8]
• DNS (Domain Name System): Comprehend how user-friendly domain names (like www.google.com) are translated into numerical IP addresses that computers use to locate servers – often described as the internet's phonebook.[5, 6, 7]
• Network Devices: Learn the basic functions of key hardware components like Routers (direct traffic between networks), Switches (connect devices within a network), Firewalls (enforce security policies), and Wireless Access Points (provide Wi-Fi connectivity).[8, 9]

Curated Resources:

• Free Courses:
  • Coursera (Audit Access): Google - "The Bits and Bytes of Computer Networking" [8, 10], Google - "Connect and Protect: Networks and Network Security" [8], Cisco - "Network Security" [8], Akamai - "Networking Fundamentals" [8], Yonsei University - "Introduction to TCP/IP".[10]
  • YouTube: Professor Messer's CompTIA Network+ Training Course (covers foundational concepts).[11]
  • Udemy (Free Tier): "Introduction to networking for complete beginners" [2], "Introduction to SAN and NAS Storage".[10]
  • Other: Explore introductory modules from Cisco Networking Academy.
• Paid Courses:
  • Coursera (Certificate Track): Courses from Google, IBM, Cisco, University of Colorado offer structured learning and certificates.[8]
  • Udemy: Courses by highly-rated instructors like David Bombal [2], "Introduction to Computer Networks for Non-Techies".[10]
  • CompTIA: Official CertMaster Learn and Labs for Network+ provide comprehensive, exam-aligned training.[3, 9]
• Books/Documentation:
  • Official CompTIA Network+ Study Guide (ensure it's for the current exam version, N10-009 for 2025 prep).[3, 12]
  • General Reference: "Networking for Dummies" or similar introductory texts.
• Practice Labs:
  • Cisco Packet Tracer: Free network simulation software, excellent for beginners.
  • Wireshark Labs: Often integrated into courses [10] or available online; practice analyzing packet captures.
  • GNS3: More advanced, free network simulation software.

The availability of numerous high-quality free and paid resources from reputable providers like Google, Cisco, and IBM underscores the fundamental importance of networking knowledge.[2, 8, 10] Certifications such as CompTIA Network+ offer a structured path and industry-recognized validation of these essential skills.

Essential Tools:

• Command-Line Utilities: Get comfortable using basic tools like ping (test connectivity), ipconfig (Windows) or ifconfig (Linux) (view IP configuration), traceroute (Linux) or tracert (Windows) (map network path), and nslookup or dig (query DNS).
• Wireshark: An indispensable graphical tool for capturing and analyzing network traffic in detail. Its use is often taught in networking courses.[2, 10]

Relevant Certification: CompTIA Network+ (N10-009 recommended for 2025)

• Why Network+: It's a globally recognized, vendor-neutral certification validating core networking knowledge, including TCP/IP, OSI model, network devices, security concepts, operations, and troubleshooting.[9] It's approved for US Department of Defense directive 8140.03 work roles and often serves as a prerequisite or stepping stone for more advanced certifications or roles.[2, 9]
• Current Exam: The N10-008 exam is scheduled to retire in late 2024.[9] Preparation for 2025 should focus on the N10-009 exam objectives. Always verify the current exam version on the CompTIA website.
• Study Resources: Official CompTIA Study Guides [3, 12], CompTIA CertMaster Learn/Labs/Practice [3, 9], Professor Messer's free video course and study groups [11], Udemy/Coursera courses aligned with objectives, practice exams from sources like Gururo [11] or MeasureUp.[13]

Learning Path & Key Concepts:

Understanding operating systems (OS) is fundamental because security tools run on them, vulnerabilities often reside within them, and critical logs are generated by them. Key areas of focus include:

• Why OS Knowledge Matters: Comprehending file systems, user permissions, running processes, system services, and command-line interaction is vital for securing systems, analyzing logs, and understanding how malware operates.
• Linux Fundamentals: Proficiency with the Linux command-line interface (CLI) is crucial, as many security tools and servers run on Linux. Focus on:
  • Navigation: cd (change directory), ls (list files), pwd (print working directory).
  • File Manipulation: mv (move/rename), cp (copy), rm (remove), mkdir (make directory), touch (create empty file).[14]
  • Permissions: Understanding and changing file permissions (chmod) and ownership (chown).
  • Process Management: Viewing running processes (ps) and terminating them (kill).
  • Text Manipulation: Searching text within files (grep), and basic text processing (awk, sed).
  • Package Management: Installing and updating software using tools like apt (Debian/Ubuntu) or yum/dnf (RedHat/Fedora).</li> <li>Basic Shell Scripting (Bash): Automating simple command sequences.</li> </ul> </li> <li><strong>Windows Fundamentals:</strong> Familiarity with the Windows environment, particularly from a command-line and administrative perspective, is also important. Focus on: <ul> <li>Command Prompt / PowerShell Basics: Navigating the file system, running commands.</li> <li>System Internals: User/group management, understanding services, using Task Manager effectively.</li> <li>Logging & Diagnostics: Basics of Windows Event Viewer and the Registry.</li> </ul> </li> </ul>

    Curated Resources:

    • Free Resources:
      • Linux: Linux Journey (interactive website), LinuxCommand.org (tutorials and book) [15], Ubuntu's "Command line for beginners" tutorial [14], Free introductory courses from The Linux Foundation [16], OverTheWire's Bandit Wargame (excellent hands-on CLI practice).
      • YouTube: Numerous channels offer Linux tutorials (e.g., Learn Linux TV, NetworkChuck's introductory videos).
      • Windows: Microsoft Learn provides extensive documentation for Command Prompt, PowerShell, and Windows administration.
    • Paid Courses:
      • CompTIA Training: Official materials for A+ and Linux+ cover relevant OS topics.[4, 11, 12]
      • Online Platforms: Udemy and Coursera offer courses on Linux Administration, Bash Scripting, and Windows Server fundamentals.
    • Practice Labs:
      • TryHackMe: Offers dedicated Linux Fundamentals learning paths.[17]
      • Virtual Machines: Install VirtualBox (free) or VMware Workstation Player (free for non-commercial use) and set up Linux distributions (like Ubuntu, Kali Linux) and Windows evaluation versions to practice commands in a safe environment.

    While CompTIA A+ provides a broad overview of IT, including basic Linux concepts [4], dedicating specific time to mastering the Linux command line through resources like LinuxCommand.org [15] or OverTheWire is highly advantageous for most cybersecurity roles. Many essential security tools are Linux-native, and penetration testing or cloud security roles often demand significant Linux proficiency.

    Relevant Certifications: CompTIA A+ (Core 1 & 2), Linux+ (XK0-005)

    • CompTIA A+:
      • Why A+: Considered the industry standard for foundational IT knowledge and technical support roles. It covers hardware, various operating systems (Windows, macOS, Linux, Chrome OS, Android), software troubleshooting, networking basics, security fundamentals, and operational procedures.[4] Passing A+ demonstrates a broad understanding essential for many entry-level IT and some cybersecurity support positions.[4, 13]
      • Current Exam: Requires passing *two* exams (e.g., 220-1201 Core 1 & 220-1202 Core 2 were launched in 2022 [4]). However, updates occurred in March 2025 [13], so verify the *absolute latest* exam codes on the CompTIA website before starting studies.
      • Study Resources: Official CompTIA Study Guides and CertMaster Suite [4, 12], Professor Messer's free videos [11], Udemy/Coursera courses, practice tests (e.g., CompTIA, Gururo [11], MeasureUp [13]), books by authors like Mike Meyers or publishers like Sybex [11], and bundled resources found on platforms like Amazon.[18] **Crucially, ensure all study materials align with the current exam objectives for 2025.**
    • CompTIA Linux+:
      • Why Linux+: Validates the skills required of an early-career Linux systems administrator. As Linux dominates server environments and cloud infrastructure, this certification is increasingly valuable for cybersecurity roles involving these platforms.[12]
      • Current Exam: XK0-005 is a recent version.[12] Verify currency on the CompTIA site.
      • Study Resources: Official CompTIA materials [12], CertMaster, Linux Foundation training [16], Udemy/Coursera Linux courses, practice labs.

Learning Path & Key Concepts:

Scripting is a force multiplier in cybersecurity. It allows professionals to automate repetitive tasks (like log parsing or scanning), develop custom tools, interact with APIs, and understand (or even modify) exploit code. The two primary languages for beginners to focus on are:

• Python: Widely regarded as the dominant scripting language in cybersecurity due to its readability, gentle learning curve, and vast collection of libraries suitable for networking, web interaction, data manipulation, and security tasks. Basic concepts include:
  • Fundamentals: Variables, data types (strings, numbers, lists, dictionaries) [19], control flow (if statements, for and while loops) [19], functions, reading from and writing to files.
  • Libraries: Understanding how to import and use basic built-in libraries (e.g., os, sys) and potentially third-party ones like requests (for web interaction).
  • Practical Focus: Aim to write simple scripts that solve small problems, reinforcing the concepts.
• Bash: The default shell scripting language on most Linux systems. Essential for automating tasks directly within the Linux environment. Building upon Linux CLI knowledge, focus on:
  • Scripting Basics: Using variables, loops, conditional statements (if, case), and functions within shell scripts.
  • Command Chaining & Redirection: Using pipes (|), logical operators (&&, ||), and input/output redirection (>, <) effectively.

Starting early with scripting, particularly Python, provides a significant advantage. Its prevalence is highlighted by its inclusion in cybersecurity curricula from major providers like Google, IBM, and specialized training platforms.[19, 20, 21] Even basic proficiency builds foundational programming logic applicable across different languages and tasks.

Curated Resources:

• Free Resources:
  • Python: The official Python Tutorial (docs.python.org), "Automate the Boring Stuff with Python" (book/website - highly recommended for practical learning), Google's Python Class, Coursera (Audit Access: Google "Crash Course on Python" [20], IBM "Python for Data Science, AI & Development" [20], University of Michigan "Python Basics" [20]), Cybrary's "Python for Cybersecurity Professionals" course [19], freeCodeCamp's Python curriculum.
  • Bash: LinuxCommand.org's Shell Scripting Tutorial [15], The Bash Academy (tldp.org), Ryan's Tutorials on Bash Scripting.
  • GitHub: Search for repositories like "Python for cybersecurity scripts" or "Bash scripting examples" to see practical applications.
• Paid Courses:
  • Udemy/Coursera: Look for courses specifically targeting Python for cybersecurity, ethical hacking, or network automation.
  • TCM Security: Offers "Python 101 for Hackers" (likely part of their training bundles).[22]
• Practice Labs:
  • Write simple scripts to automate tasks learned in the Networking and OS sections.
  • Engage with scripting challenges on platforms like TryHackMe, Hack The Box, HackerRank, or Codewars.

Role Overview

A Security Operations Center (SOC) Analyst is on the front lines of cyber defense (Blue Team). Their primary role is to monitor security alerts generated by various tools (like SIEMs and EDRs), investigate potential security incidents, triage events to determine their severity and validity, escalate incidents when necessary, and perform basic incident response actions. They are the first responders to cyber threats within an organization.

Step-by-Step Learning Path

1. Solidify Security+ Concepts: Ensure a strong grasp of threats, vulnerabilities, security technologies, and basic incident response procedures.
2. Network Traffic Analysis: Deepen networking knowledge with hands-on packet analysis using Wireshark. Learn to identify normal vs. suspicious traffic patterns.
3. Log Analysis Fundamentals: Understand different log sources (OS, firewall, web server, endpoint) and how to parse and interpret log entries for signs of compromise.
4. SIEM Tool Basics: Learn the core functions of a SIEM. Gain hands-on experience with at least one platform (e.g., Splunk, ELK Stack/OpenSearch, Wazuh, Microsoft Sentinel, Google Chronicle Security Operations). Focus on searching, basic correlation rules, and dashboard interpretation.
5. Endpoint Security Basics: Understand logs generated by EDR and Antivirus tools. Learn how to investigate endpoint alerts.
6. Incident Triage & Response Fundamentals: Learn standard procedures for handling alerts, determining priority, basic containment steps, and documentation using ticketing systems.
7. Basic Threat Hunting: Learn proactive techniques to search for threats that may have bypassed automated detection, often using SIEM queries or EDR data.

Curated Resources

• Courses (Free/Paid):
  • TryHackMe: SOC Level 1 Learning Path.
  • LetsDefend: Hands-on SOC simulation platform.[24]
  • Blue Team Labs Online (BTLO): Challenges focused on defense, DFIR.
  • TCM Security: Practical SOC Level 1 Analyst course.[22]
  • Security Blue Team: BTL1 certification and associated training.[24]
  • CompTIA CySA+ Training: Covers analytical skills relevant to SOC roles.
  • SIEM Vendor Training: Splunk Fundamentals 1 (free), Elastic/OpenSearch basics, Microsoft SC-200 path.
  • Google Cybersecurity Certificate (Coursera): Covers SIEM, Incident Response, Network Security relevant topics.[20]
  • EC-Council: Network Defense Essentials (N|DE) covers relevant fundamentals.[21]
• Labs/Practice:
  • TryHackMe: Specific SOC/Blue Team rooms (e.g., rooms covering Wireshark, Splunk, Log Analysis).
  • LetsDefend / BTLO: Dedicated challenge platforms.
  • Security Onion: Set up this free and open-source Linux distribution containing multiple security tools (including SIEM and IDS) in a VM for practice.
  • Splunk: Utilize the free enterprise trial or download Splunk Free. Participate in the Boss of the SOC (BOTS) CTF dataset/challenges when available.
  • Analyze sample log files available online.
• Essential Tools:
• Wireshark: Network protocol analyzer.
• SIEM Platforms: Splunk, ELK Stack (Elasticsearch, Logstash, Kibana) / OpenSearch, Wazuh, Microsoft Sentinel, Google Chronicle Security Operations.
• EDR Consoles: Familiarity with interfaces like CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint (basics).
• Ticketing Systems: Experience with platforms like Jira Service Desk, ServiceNow (conceptual understanding).
• Threat Intelligence Platforms (Basic Use): VirusTotal, AbuseIPDB.
• Books/Docs:
  • CompTIA CySA+ Study Guides.
  • "Applied Network Security Monitoring" by Chris Sanders.
  • SIEM tool documentation (Splunk, Elastic, etc.).

Key Certifications

• CompTIA Security+ (Baseline)
• CompTIA CySA+ (Cybersecurity Analyst)
• Security Blue Team BTL1 (Blue Team Level 1)
• Splunk Core Certified User
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• GIAC Certified Intrusion Analyst (GCIA) (More advanced)

Skills-to-Job Mapping & Sample Listings

Entry-level SOC Analyst roles typically require the following skills, which align directly with the learning path:

• SIEM Operation: Monitoring dashboards, running basic queries, identifying notable events. (Path steps 4, 7)
• Log Analysis: Ability to read and interpret logs from various sources. (Path step 3)
• Network Traffic Analysis: Basic understanding of protocols and ability to use Wireshark. (Path step 2)
• Incident Triage: Assessing alerts, determining priority, basic investigation steps. (Path step 6)
• Endpoint Security Awareness: Understanding AV/EDR alerts. (Path step 5)
• Ticketing Systems: Documenting investigations and actions. (Path step 6)
• Communication: Clearly explaining findings and escalating issues.

(Example: A sample job listing might ask for "Experience with SIEM tools like Splunk or Sentinel," "Understanding of TCP/IP and common protocols," "Ability to analyze security logs," and "Security+ or equivalent certification.")

Summary Table: SOC Analyst

Role Overview

A Penetration Tester, or Ethical Hacker, simulates cyberattacks against an organization's systems, networks, and applications to identify vulnerabilities before malicious actors can exploit them (Red Team). They use various tools and techniques to gain unauthorized access (ethically), escalate privileges, and assess the potential impact of vulnerabilities. A crucial part of their role is documenting findings and providing remediation recommendations in detailed reports.

Step-by-Step Learning Path

1. Master Foundations: Strong Security+, Networking (beyond basics - routing, advanced TCP/IP), Linux & Windows CLI mastery are non-negotiable. Python/Bash scripting is highly beneficial.
2. Web Application Hacking: Deep dive into common web vulnerabilities (OWASP Top 10 and beyond) using resources like PortSwigger Academy. Learn how HTTP works intimately. Master Burp Suite.[28, 31]
3. Enumeration & Scanning: Learn to use tools like Nmap (network scanning), Gobuster/Dirb/Nikto (web enumeration) to discover services, directories, and potential attack vectors.
4. Vulnerability Assessment & Exploitation Basics: Understand common vulnerability types (buffer overflows, misconfigurations, SQL injection, XSS). Learn to use Metasploit Framework for basic exploitation and payload generation.
5. Privilege Escalation: Learn techniques to escalate privileges from a standard user to root/administrator on both Linux and Windows systems.
6. Active Directory (AD) Hacking Basics: Understand common AD misconfigurations and attacks. Learn tools like BloodHound for mapping AD environments and basic exploitation techniques (e.g., Kerberoasting).
7. Reporting: Develop the crucial skill of writing clear, concise, and actionable penetration testing reports.

Practical, hands-on certifications requiring simulated penetration tests, such as TCM Security's PNPT or Offensive Security's OSCP, are highly valued by employers in this domain.[22, 33] These certifications demand significant time spent in lab environments like those offered by TCM, Hack The Box, or Offensive Security's Proving Grounds.[22, 27] The free PortSwigger Academy is an indispensable resource for building the necessary web application security skills.[28, 29]

Curated Resources

• Courses (Free/Paid):
  • TryHackMe: Offensive Pentesting Path, specific web hacking/privesc rooms.
  • Hack The Box Academy: Pentester Job Role Path, various modules.
  • TCM Security: Practical Ethical Hacking (PEH) course, PNPT Certification Bundle.[22]
  • Offensive Security: PEN-200 Course (preparing for OSCP).[33]
  • INE Security (formerly eLearnSecurity): eJPT (entry) and eWPT/eWPTX (web) paths.[24]
  • PortSwigger: Web Security Academy (essential free resource).[28, 29, 31]
  • EC-Council: Ethical Hacking Essentials (E|HE) provides introductory concepts.[21]
• Labs/Practice:
  • TryHackMe: Numerous rooms like Vulnversity, Blue, Steel Mountain, relevant learning paths.
  • Hack The Box: Actively retiring Boxes, dedicated Labs (e.g., Dante, RastaLabs), Challenges.
  • Offensive Security Proving Grounds: PG Practice labs designed by OffSec, good OSCP prep.[27, 32]
  • VulnHub: Large repository of free, downloadable vulnerable virtual machines.
  • TCM Security: Labs included with PEH course/PNPT bundle.
  • PortSwigger: Interactive labs within the Web Security Academy.
• Essential Tools:
• Nmap: Network scanner and host discovery tool.
• Burp Suite: Web vulnerability scanner and testing proxy (Community Edition is free, Pro recommended).[31]
• Metasploit Framework: Exploitation framework.
• Web Enumeration: Nikto, Gobuster, Dirb, Ffuf.
• Password Cracking: John the Ripper, Hashcat.
• Active Directory: BloodHound, Impacket suite (basics), Mimikatz (understanding its use).
• Scripting Languages: Python, Bash.
• Books/Docs:
  • "The Web Application Hacker's Handbook" (by PortSwigger founder, though Academy is more current).[29]
  • "Penetration Testing: A Hands-On Introduction to Hacking" by Georgia Weidman.
  • "Red Team Field Manual" / "Blue Team Field Manual".
  • Tool Documentation (Nmap, Metasploit, Burp Suite).

Key Certifications

• CompTIA PenTest+
• INE Security eJPT (eLearnSecurity Junior Penetration Tester)
• TCM Security PNPT (Practical Network Penetration Tester) [22]
• Offensive Security OSCP (Offensive Security Certified Professional) [33] (Intermediate/Advanced goal)
• HTB CPTS (Certified Penetration Testing Specialist)
• (Considered: EC-Council CEH - Certified Ethical Hacker, often HR checkbox but less hands-on than PNPT/OSCP)
• PortSwigger BSCP (Burp Suite Certified Practitioner) [28] (Web focus)

Skills-to-Job Mapping & Sample Listings

Junior Penetration Tester roles often seek candidates with demonstrated skills in:

• Vulnerability Assessment: Identifying weaknesses using scanners and manual techniques. (Path steps 3, 4)
• Exploitation: Using tools like Metasploit and manual methods to exploit vulnerabilities. (Path step 4)
• Web Application Testing: Finding and exploiting OWASP Top 10 vulnerabilities using tools like Burp Suite. (Path step 2)
• Network Scanning & Enumeration: Proficient use of Nmap and other enumeration tools. (Path step 3)
• Privilege Escalation: Techniques for Linux and Windows environments. (Path step 5)
• Active Directory Basics: Understanding AD structure and common attacks. (Path step 6)
• Scripting: Basic Python or Bash scripting for automation or exploit modification.
• Reporting: Ability to clearly document findings and ecommendations. (Path step 7)</li> </ul> <p><em>(Example: A job listing might require "Hands-on experience with Nmap, Burp Suite, Metasploit," "Knowledge of OWASP Top 10," "Experience with Linux and Windows environments," "Relevant certification like PenTest+, eJPT, or OSCP preferred," and "Strong report writing skills.")</em></p>

  Summary Table: Penetration Tester

  Core Skills	Vuln Assessment, Exploitation, Web App Testing (OWASP), Network Scanning, PrivEsc, AD Basics, Reporting
  Key Resources	PortSwigger Academy, THM Pentest Path, HTB Academy/Boxes, TCM PEH/PNPT, OffSec PG/PEN-200, VulnHub
  Essential Tools	Nmap, Burp Suite, Metasploit, Gobuster, BloodHound, Python/Bash
  Relevant Certs	PenTest+, eJPT, PNPT, OSCP, CPTS, BSCP

Role Overview

A Cloud Security Engineer specializes in protecting data, applications, and infrastructure hosted in cloud environments (like Amazon Web Services, Microsoft Azure, or Google Cloud Platform). They design, implement, and manage cloud-native security controls, configure Identity and Access Management (IAM), ensure network security within the cloud, monitor for threats, and maintain compliance with relevant standards.

Step-by-Step Learning Path

1. Cloud Fundamentals: Start with a foundational understanding of cloud computing concepts (IaaS, PaaS, SaaS, shared responsibility model). Obtain a basic certification for your chosen provider (e.g., AWS Certified Cloud Practitioner, Microsoft Certified: Azure Fundamentals AZ-900, Google Cloud Certified - Cloud Digital Leader).
2. Core Security Concepts in Cloud: Learn how fundamental security principles apply in the cloud:
   • Identity and Access Management (IAM): Users, groups, roles, policies, principle of least privilege.
   • Network Security: Virtual Private Clouds (VPCs) / Virtual Networks (VNets), Security Groups / Network Security Groups (NSGs), Subnets, VPNs, Load Balancers.
   • Logging & Monitoring: CloudTrail, CloudWatch Logs (AWS); Azure Monitor, Activity Log (Azure); Cloud Logging, Cloud Monitoring (GCP).
   • Data Security: Encryption (at rest, in transit), key management services.
3. Platform-Specific Security Services: Dive deeper into the security services offered by your chosen cloud provider(s):
   • AWS: Security Hub, GuardDuty, Inspector, WAF & Shield, Macie, IAM Identity Center (SSO).
   • Azure: Microsoft Defender for Cloud, Microsoft Sentinel (SIEM), Azure Firewall, Azure Key Vault, Entra ID (formerly Azure AD).
   • GCP: Security Command Center, Chronicle Security Operations, Cloud Armor, Identity Platform, Key Management Service.
4. Infrastructure as Code (IaC) Security Basics: Understand tools like Terraform or CloudFormation and how to write secure configurations and scan templates for vulnerabilities.
5. Container Security Basics (Optional but Recommended): Learn security best practices for Docker and orchestration platforms like Kubernetes (EKS, AKS, GKE).

Curated Resources

• Courses (Free/Paid):
  • Cloud Provider Training: AWS Skill Builder, Microsoft Learn, Google Cloud Skills Boost (offer free tiers and extensive paid paths).
  • Third-Party Platforms: A Cloud Guru, Cloud Academy, Udemy, Coursera (search for specific cloud security courses/paths).
  • Cloud Security Alliance (CSA): Training for the Certificate of Cloud Security Knowledge (CCSK).
• Labs/Practice:
  • Cloud Provider Free Tiers/Credits: Essential for hands-on practice within the actual cloud environments (AWS Free Tier, Azure Free Account, GCP Free Tier). Be mindful of usage to avoid unexpected costs.
  • Provider-Specific Labs: Qwiklabs (Google Cloud), AWS Workshops, Microsoft Learn Sandboxes.
  • Hack The Box: Offers dedicated Cloud Hacking challenges.
  • Vulnerable-by-Design Environments: CloudGoat (OWASP project for AWS), SadCloud (Azure), GCPGoat.
• Essential Tools:
• Cloud Provider Consoles: AWS Management Console, Azure Portal, Google Cloud Console.
• Cloud Provider CLIs: AWS CLI, Azure CLI, gcloud CLI.
• Infrastructure as Code (IaC): Terraform, AWS CloudFormation, Azure Resource Manager (ARM) Templates.
• Native Cloud Security Services: (As listed in Path Step 3 - e.g., GuardDuty, Sentinel, Security Command Center).
• Open Source Tools: Cloud Custodian (policy enforcement), Prowler (security assessments).
• Scripting: Python (using SDKs like Boto3), Bash.
• Books/Docs:
  • Official Cloud Provider Documentation: AWS Docs, Azure Docs, GCP Docs (especially the security sections).
  • Cloud Security Alliance (CSA) Guidance (e.g., Security Guidance for Critical Areas of Focus).
  • NIST Cloud Computing Program publications.
  • Certification study guides (AWS Security Specialty, AZ-500, Google Cloud Security Engineer, CCSP).

Key Certifications

• CompTIA Cloud+ (Vendor-neutral foundation)
• AWS Certified Security - Specialty
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• Google Professional Cloud Security Engineer
• (ISC)² CCSP (Certified Cloud Security Professional) (Requires experience)
• Cloud Security Alliance (CSA) CCSK (Certificate of Cloud Security Knowledge)

Skills-to-Job Mapping & Sample Listings

Cloud Security Engineer roles typically demand proficiency in:

• Cloud Platform Expertise: In-depth knowledge of AWS, Azure, or GCP services and security features. (Path steps 1, 3)
• IAM Configuration: Managing users, roles, policies, and permissions securely. (Path step 2)
• Network Security: Configuring VPCs/VNets, Security Groups/NSGs, Firewalls, VPNs in the cloud. (Path step 2)
• Security Service Configuration: Implementing and managing native security tools (e.g., GuardDuty, Sentinel, Security Command Center). (Path step 3)
• Monitoring & Logging: Analyzing cloud logs and configuring alerts. (Path step 2)
• Compliance Frameworks: Understanding how standards like PCI-DSS, HIPAA, ISO 27001 apply in the cloud.
• Scripting/Automation: Using Python, Bash, or IaC tools for security tasks. (Path step 4)
• Container Security (Often): Securing Docker and Kubernetes workloads. (Path step 5)

(Example: A job listing might specify "Experience securing AWS/Azure/GCP environments," "Proficiency with IAM, VPC, Security Groups," "Hands-on experience with cloud-native security tools like GuardDuty/Sentinel/Security Command Center," "Knowledge of IaC tools like Terraform," and "Relevant certifications like AWS Security Specialty or AZ-500.")

Summary Table: Cloud Security Engineer

Role Overview

A Threat Intelligence (TI or CTI) Analyst researches and analyzes information about cyber threats, threat actors, malware, and their Tactics, Techniques, and Procedures (TTPs). Their goal is to provide actionable intelligence to help organizations understand their adversaries, anticipate attacks, and improve defenses (often Purple Team adjacent). They produce reports, briefings, and technical indicators (like IP addresses or file hashes) to support security operations and strategic decision-making.

Step-by-Step Learning Path

1. Foundations: Security+, strong understanding of networking, OS, common attack vectors.
2. Geopolitics & Cybercrime Landscape: Understand the motivations and common origins of different threat actor types (nation-state, e-crime, hacktivist).
3. Open Source Intelligence (OSINT) Techniques: Learn how to gather information from publicly available sources legally and ethically.
4. Malware Analysis Basics: Learn fundamental techniques for analyzing malware samples safely (static analysis: examining code without running it; dynamic analysis: observing behavior in a sandbox).
5. Threat Modeling Frameworks: Understand and apply frameworks like MITRE ATT&CK® to categorize adversary behaviors and map defenses.
6. Indicator of Compromise (IoC) Management: Learn about different types of IoCs (IPs, domains, hashes, etc.), how they are used, and platforms for sharing them (e.g., MISP).
7. Intelligence Reporting & Briefing: Develop strong analytical writing and presentation skills to communicate findings effectively to different audiences (technical and non-technical).

Curated Resources

• Courses (Free/Paid):
  • SANS Institute: FOR578 (Cyber Threat Intelligence) is a highly regarded (but expensive) course.
  • Recorded Future University: Offers free introductory TI courses.
  • MITRE ATT&CK®: Provides free online training materials.
  • Cybrary / Udemy / Coursera: Search for "Threat Intelligence" or "OSINT" courses.
  • TCM Security: Offers an OSINT course.
• Labs/Platforms/Data Sources:
  • Malware Repositories (Use with extreme caution in isolated VMs): MalwareBazaar, VirusTotal, Any.run, Hybrid Analysis.
  • Threat Intelligence Platforms (Explore trial versions): Recorded Future, Mandiant Threat Intelligence, CrowdStrike Falcon Intelligence.
  • OSINT Tools/Frameworks: The OSINT Framework (online resource), Maltego (visualization), Recon-ng, Shodan (IoT search engine).
  • Analysis VMs: Set up REMnux or Flare VM for safe malware analysis.
• Essential Tools:
• MISP (Malware Information Sharing Platform & Threat Sharing): Open-source TI sharing platform.
• Maltego: Data visualization tool for connecting OSINT data points.
• Analysis Tools: Text editors, hex editors, basic disassemblers (e.g., Ghidra basics), sandboxes.
• Search Engines & OSINT Databases: Google (advanced searching), Shodan, Public DNS records, WHOIS lookups.
• MITRE ATT&CK® Navigator.
• Books/Docs:
  • "Intelligence-Driven Incident Response" by Scott J. Roberts and Rebekah Brown.
  • "The Tao of Network Security Monitoring" by Richard Bejtlich.
  • MITRE ATT&CK® documentation.
  • Reports from major cybersecurity vendors (Mandiant, CrowdStrike, Secureworks, etc.).

Key Certifications

• CompTIA CySA+ (Covers TI concepts)
• GIAC Cyber Threat Intelligence (GCTI)
• EC-Council Certified Threat Intelligence Analyst (CTIA)
• SANS FOR578 Certification (associated with the course)

Skills-to-Job Mapping & Sample Listings

Threat Intelligence Analyst roles typically require:

• Research & Analytical Skills: Ability to gather, correlate, and analyze disparate data points. (Path steps 2, 3, 7)
• OSINT Proficiency: Skill in using open-source tools and techniques. (Path step 3)
• Malware Analysis Fundamentals: Basic understanding of static/dynamic analysis. (Path step 4)
• MITRE ATT&CK® Framework Knowledge: Ability to map TTPs. (Path step 5)
• Understanding of Threat Landscape: Knowledge of current actors, campaigns, and TTPs. (Path step 2)
• Report Writing & Communication: Ability to produce clear intelligence products. (Path step 7)
• IoC Management: Familiarity with indicator types and usage. (Path step 6)

(Example: A job listing might ask for "Experience researching threat actors and campaigns," "Proficiency with OSINT techniques," "Familiarity with the MITRE ATT&CK framework," "Basic malware analysis skills," and "Excellent writing and briefing skills.")

Summary Table: Threat Intelligence Analyst

Role Overview

A Governance, Risk, and Compliance (GRC) Analyst focuses on the non-technical, policy-driven side of cybersecurity. They help organizations manage cyber risk, ensure adherence to relevant laws and regulations (like PCI-DSS for payment cards, HIPAA for healthcare, GDPR for data privacy, SOX for financial reporting), and implement security best practices based on frameworks like NIST or ISO 27001. Their work involves developing security policies, conducting risk assessments, managing security awareness training, coordinating audits, and ensuring documentation is maintained.

Step-by-Step Learning Path

1. Foundation: Security+ provides essential context on risk, compliance, and security controls.
2. Understand Business Context: Learn how businesses operate and how security supports business objectives.
3. Key Regulations & Frameworks: Choose 1-2 relevant frameworks/regulations based on industry interest (e.g., NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF 800-53), ISO 27001/27002, PCI-DSS, HIPAA Security Rule, GDPR). Study their requirements.
4. Risk Assessment Methodologies: Learn common approaches to identifying, analyzing, and evaluating risk (e.g., qualitative vs. quantitative, NIST RMF steps).
5. Policy Writing & Documentation: Learn how to develop clear, enforceable security policies, standards, and procedures.
6. Audit Fundamentals: Understand the basics of internal and external audits, evidence collection, and responding to audit findings.
7. Security Awareness Principles: Learn how to design and manage effective security awareness training programs.

Curated Resources

• Courses (Free/Paid):
  • ISACA: Resources and training related to CISA (audit), CRISC (risk), and CISM (management) certifications.
  • (ISC)²: Training for CISSP (broad security management) and CAP (authorization/NIST RMF). Offers a free entry-level Certified in Cybersecurity (CC) cert.
  • Udemy / Coursera / LinkedIn Learning: Search for "GRC," "Cybersecurity Risk Management," "ISO 27001," "NIST RMF," "PCI DSS," "HIPAA Security."
  • GRC Mastery: Mentioned as a resource provider.[24]
• Documentation (Essential Reading):
  • NIST Publications: Special Publications (SP) 800 series (especially 800-53, 800-37 RMF), Cybersecurity Framework (CSF). (All free at nist.gov).
  • ISO Standards: ISO 27001/27002 (requires purchase or library access).
  • Regulation Texts: PCI-DSS standard, HIPAA Security Rule text, GDPR text (available online).
• Essential Tools:
• GRC Platforms: Familiarity with concepts behind tools like ServiceNow GRC, Archer, LogicGate (explore vendor demos/trials).
• Productivity Software: Proficiency in spreadsheets (Excel, Google Sheets) for risk registers and tracking, word processors (Word, Google Docs) for policy writing.
• Books/Docs:
  • Certification study guides (CISA, CRISC, CISSP, CCSP, Security+).
  • "Security Risk Management" by Alan Calder and Steve Watkins.
  • "IT Governance: An International Guide to Data Security and ISO27001/ISO27002" by Alan Calder and Steve Watkins.

Key Certifications

• CompTIA Security+ (Baseline)
• ISACA Certified Information Systems Auditor (CISA)
• ISACA Certified in Risk and Information Systems Control (CRISC)
• ISACA Certified Information Security Manager (CISM) (Requires experience)
• (ISC)² Certified Information Systems Security Professional (CISSP) (Requires experience)
• (ISC)² Certified in Governance, Risk and Compliance (CGRC) (formerly CAP)
• (ISC)² Certified in Cybersecurity (CC) (Entry-level)
• Relevant framework certs (e.g., ISO 27001 Lead Implementer/Auditor, PCIP for PCI-DSS).

Skills-to-Job Mapping & Sample Listings

GRC Analyst roles typically emphasize:

• Knowledge of Frameworks/Regulations: Understanding requirements of NIST, ISO, PCI, HIPAA, GDPR, etc. (Path step 3)
• Risk Assessment & Management: Ability to identify, analyze, and treat risks. (Path step 4)
• Policy Development & Documentation: Writing clear security policies and procedures. (Path step 5)
• Audit & Compliance Support: Understanding audit processes and evidence requirements. (Path step 6)
• Communication & Collaboration: Working with technical and non-technical stakeholders.
• Security Awareness: Understanding training principles. (Path step 7)

(Example: A job listing might seek "Experience with NIST RMF or ISO 27001," "Knowledge of risk assessment methodologies," "Experience developing security policies," "Familiarity with compliance requirements like PCI-DSS or HIPAA," and "Strong documentation and communication skills.")

Summary Table: GRC Analyst

Role Overview

An Application Security (AppSec) Engineer focuses on ensuring software is designed and developed securely throughout the Software Development Lifecycle (SDLC). They work closely with development teams to perform security code reviews, implement secure coding practices, conduct security testing (Static Application Security Testing - SAST, Dynamic Application Security Testing - DAST), secure APIs, and help remediate vulnerabilities found in applications (Purple Team role, bridging development and security).

Step-by-Step Learning Path

1. Foundations: Security+, Solid understanding of web fundamentals (HTTP, HTML, JavaScript).
2. Programming Proficiency: Become proficient in at least one common development language relevant to the target environment (e.g., Python, Java, JavaScript/Node.js, C#). Understand common programming paradigms.
3. Web Application Security Deep Dive: Master common web vulnerabilities (OWASP Top 10 and beyond) using resources like PortSwigger Academy.[28, 29]
4. Secure Coding Principles: Learn language-specific secure coding practices (e.g., input validation, output encoding, proper error handling, secure session management). Refer to OWASP Application Security Verification Standard (ASVS) and Cheat Sheets.[23]
5. SAST (Static Analysis): Learn how SAST tools work and how to interpret their findings. Practice reviewing code manually for security flaws.
6. DAST (Dynamic Analysis): Learn how DAST tools work. Master using tools like Burp Suite Pro or OWASP ZAP to actively test running applications.[31]
7. API Security Basics: Understand common API architectures (REST, GraphQL) and specific security concerns (authentication, authorization, injection, rate limiting).
8. Container & Cloud Security Basics (Contextual): Understand security implications of deploying applications in containers or cloud environments.

Curated Resources

• Courses (Free/Paid):
  • PortSwigger: Web Security Academy (Invaluable free resource).[28, 29, 31]
  • OWASP Resources: OWASP Top 10 Project, Application Security Verification Standard (ASVS), Cheat Sheet Series, Juice Shop (vulnerable web app).[23]
  • SANS Institute: DEV series courses (expensive).
  • Secure Code Warrior / Kontra Application Security Training: Gamified secure coding platforms.
  • Udemy / Coursera: Search for "Application Security," "Secure Coding," "Web Security Testing."
• Labs/Practice:
  • PortSwigger: Extensive labs within the Web Security Academy.
  • OWASP Projects: Juice Shop, Damn Vulnerable Web Application (DVWA), WebGoat.
  • PentesterLab / Web Security Dojo: Practice environments.
  • Hack The Box / TryHackMe: Web application focused challenges/rooms.
• Essential Tools:
• Burp Suite Professional: The industry standard tool for web application testing.[31] (Community Edition is free but limited).
• OWASP ZAP (Zed Attack Proxy): Free, open-source alternative to Burp Suite.
• SAST Tools (Conceptual Understanding): SonarQube, Checkmarx, Veracode, Snyk Code (understand how they work and interpret results).
• DAST Scanners: Integrated scanners in Burp/ZAP, standalone scanners.
• Software Composition Analysis (SCA): OWASP Dependency-Check, Snyk Open Source (identify vulnerable libraries).
• Integrated Development Environments (IDEs): VS Code, IntelliJ, Eclipse, etc.
• Books/Docs:
  • "The Web Application Hacker's Handbook" (2nd Ed.) [29] (Foundation, Academy is more current).
  • "Alice and Bob Learn Application Security" by Tanya Janca.
  • "Real-World Bug Hunting: A Field Guide to Web Hacking" by Peter Yaworski.
  • OWASP Documentation (ASVS, Top 10, Cheat Sheets).

Key Certifications

• PortSwigger Burp Suite Certified Practitioner (BSCP) [28]
• GIAC Web Application Penetration Tester (GWAPT)
• GIAC Secure Software Programmer (GSSP - language specific)
• EC-Council Certified Application Security Engineer (CASE)
• Offensive Security OSWE (Web Expert) (Very advanced)
• (ISC)² CSSLP (Certified Secure Software Lifecycle Professional) (Requires experience)

Skills-to-Job Mapping & Sample Listings

Application Security Engineer roles often require:

• Secure Coding Expertise: Understanding language-specific vulnerabilities and best practices. (Path step 4)
• Code Review Skills: Ability to manually identify security flaws in code. (Path step 5)
• SAST/DAST Tool Proficiency: Experience running and interpreting results from security testing tools. (Path steps 5, 6)
• Web Vulnerability Knowledge: Deep understanding of OWASP Top 10 and common web attacks. (Path step 3)
• API Security Fundamentals: Understanding API risks and testing techniques. (Path step 7)
• SDLC Understanding: Knowledge of software development processes.
• Programming Skills: Proficiency in relevant languages. (Path step 2)

(Example: A job listing might ask for "Experience with SAST and DAST tools like Burp Suite, Checkmarx, or SonarQube," "Strong understanding of OWASP Top 10 and secure coding principles," "Ability to perform manual code reviews," "Proficiency in Python/Java/JavaScript," and "Familiarity with secure SDLC practices.")

Summary Table: Application Security Engineer

Role Overview

A DevSecOps Engineer focuses on integrating security practices seamlessly into the DevOps workflow (Purple Team role). Their goal is to automate security testing and controls within the Continuous Integration/Continuous Deployment (CI/CD) pipeline, enabling development teams to build and release software faster *and* more securely. Key responsibilities include automating SAST, DAST, Software Composition Analysis (SCA), securing Infrastructure as Code (IaC), managing secrets, and securing containerized environments.

Step-by-Step Learning Path

1. Foundations: Security+, Strong understanding of DevOps principles (CI/CD, Agile), Linux proficiency.
2. Cloud Platform Basics: Familiarity with at least one major cloud provider (AWS/Azure/GCP) and their core services.
3. Infrastructure as Code (IaC): Learn Terraform or CloudFormation/ARM Templates. Understand how to write and secure infrastructure configurations.
4. CI/CD Pipeline Fundamentals: Gain hands-on experience with CI/CD tools like Jenkins, GitLab CI, or GitHub Actions. Understand pipeline stages.
5. Containerization & Orchestration: Master Docker fundamentals. Learn Kubernetes basics (deployments, services, networking, security contexts).
6. Automated Security Testing Integration: Learn how to integrate SAST, DAST, SCA, and IaC scanning tools into CI/CD pipelines.
7. Secrets Management: Understand secure ways to handle API keys, passwords, and certificates using tools like HashiCorp Vault or cloud provider services.
8. Container Security: Learn best practices for building secure Docker images, scanning images for vulnerabilities, and securing Kubernetes clusters (RBAC, Network Policies, Pod Security Policies/Admission Controllers).

Curated Resources

• Courses (Free/Paid):
  • Linux Foundation: Offers DevOps and Cloud Native courses/certifications.[16]
  • Cloud Provider Training: AWS/Azure/GCP offer specific DevOps and DevSecOps learning paths and certifications.
  • SANS Institute: SEC540 (Cloud Security and DevSecOps Automation).
  • Udemy / Coursera / LinkedIn Learning: Search for "DevSecOps," "Kubernetes Security," "Terraform Security," "CI/CD Security."
  • EC-Council: Offers a DevSecOps course/certification.[21]
• Labs/Practice:
  • Build sample CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions) and integrate open-source security tools (e.g., Trivy for container scanning, tfsec/Checkov for IaC scanning, OWASP ZAP for DAST).
  • Use Katacoda or cloud provider sandboxes for Kubernetes practice.
  • Explore Kubernetes security tools like Kube-bench, Kube-hunter, Falco.
  • Practice securing Terraform/CloudFormation templates.
• Essential Tools:
• CI/CD Platforms: Jenkins, GitLab CI, GitHub Actions, Azure DevOps.
• IaC Tools: Terraform, CloudFormation, ARM Templates, Pulumi.
• IaC Scanners: Checkov, tfsec, Terrascan.
• Container Technology: Docker, Kubernetes (and cloud provider variants EKS, AKS, GKE).
• Container Scanners: Trivy, Clair, Anchore, Snyk Container.
• Secrets Management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager.
• SAST/DAST/SCA Tools: (As mentioned in AppSec, but focusing on pipeline integration).
• Scripting: Bash, Python, Go (increasingly common).
• Books/Docs:
  • "Pipeline Attack Vectors" by Check Point Research.
  • "Kubernetes Security" by Liz Rice and Michael Hausenblas.
  • "Terraform: Up & Running" by Yevgeniy Brikman.
  • Official documentation for CI/CD tools, Kubernetes, Terraform, Vault, Cloud Providers.
  • OWASP DevSecOps Guideline project.

Key Certifications

• GIAC Cloud Security Automation (GCSA)
• Certified Kubernetes Security Specialist (CKS) (Requires CKA)
• Certified DevSecOps Professional (CDP) from Practical DevSecOps
• Cloud Provider Certifications: AWS Certified DevOps Engineer - Professional, Microsoft Certified: DevOps Engineer Expert (AZ-400), Google Professional Cloud DevOps Engineer. (Often combined with security certs).
• HashiCorp Certified: Terraform Associate / Vault Associate.

Skills-to-Job Mapping & Sample Listings

DevSecOps Engineer roles frequently require a blend of DevOps and Security skills:

• DevOps Practices & CI/CD: Strong understanding of pipelines, automation, and DevOps culture. (Path step 4)
• Cloud Security: Proficiency in securing cloud environments. (Path step 2)
• IaC Security: Ability to write and secure infrastructure code. (Path step 3)
• Container Security: Securing Docker images and Kubernetes clusters. (Path steps 5, 8)
• Security Tool Integration: Experience automating SAST/DAST/SCA/IaC scanning in pipelines. (Path step 6)
• Secrets Management: Implementing secure credential handling. (Path step 7)
• Automation Scripting: Proficiency in Bash, Python, or Go.

(Example: A job listing might require "Experience implementing DevSecOps practices," "Hands-on experience with CI/CD tools like Jenkins/GitLab/GitHub Actions," "Proficiency with Terraform and cloud platforms (AWS/Azure/GCP)," "Experience securing containers and Kubernetes," "Experience integrating security tools (SAST/DAST/SCA) into pipelines," and "Knowledge of secrets management solutions.")\\ ```

Summary Table: DevSecOps Engineer

Core Skills	DevOps/CI/CD, Cloud Security, IaC Security, Container/Kubernetes Security, Security Tool Integration, Secrets Management, Automation
Key Resources	Cloud Provider DevOps Paths, Linux Foundation Courses, SANS SEC540, Kubernetes Docs, Terraform Docs
Essential Tools	CI/CD Platforms, Terraform, Docker, Kubernetes, Vault, Security Scanners (Trivy, Checkov), Bash/Python/Go
Relevant Certs	GCSA, CKS, CDP, Cloud Provider DevOps Certs, HashiCorp Certs