Defence & Career · Lesson 6 of 6
How to Start a Cybersecurity Career: Roles, Skills, Certifications and Legal Practice
A practical, honest guide to getting into security as a student or fresher: the entry-level roles, the skills that matter, a week-by-week learning plan, certifications worth your money, legal places to practise and how to build a portfolio.
Cybersecurity has a strange problem: companies say they cannot find enough people, while freshers say they cannot get their first job. The gap is usually evidence. Employers want to see that you understand the basics and can actually do something — investigate an alert, find a bug, write up what you found. This lesson shows how to build that evidence, legally.
Entry-level roles
| Role | What you do | Key skills |
|---|---|---|
| SOC Analyst (L1) | Monitor alerts in a SIEM, triage them, escalate real incidents | Networking, logs, Windows/Linux basics, curiosity |
| Security / IT Support Engineer | Manage endpoints, access, patching and security tools | Operating systems, identity (Active Directory, Entra ID), scripting |
| Junior Penetration Tester / VAPT | Authorised testing of apps and networks, writing reports | Web security, Linux, Burp Suite, report writing |
| Application Security (junior) | Review code, run security scanners, help developers fix issues | Programming, OWASP Top 10, secure code review |
| GRC Analyst | Policies, risk assessments, audits, compliance (ISO 27001, DPDP Act) | Writing, frameworks, attention to detail |
In India, SOC and VAPT roles at IT services companies, managed security providers, banks and consulting firms are the most common first jobs.
The foundation skills (in this order)
- Networking — IP addressing, TCP/UDP, DNS, HTTP, common ports, how to read a packet capture.
- Operating systems — Linux command line (files, permissions, processes, logs) and Windows basics (users, event logs, PowerShell).
- Web fundamentals — how requests, cookies, sessions and APIs work.
- Scripting — Python or Bash to automate small tasks and parse logs.
- Security concepts — everything in this track: CIA, authentication, common attacks, defences.
A 12-week starter plan
- Weeks 1–3: networking and Linux basics; set up a home lab (VirtualBox with a Linux VM).
- Weeks 4–5: this Cybersecurity track and its Skill Check; the OWASP Top 10.
- Weeks 6–8: pick a direction — defensive (SIEM basics, log analysis, Wireshark, incident response) or offensive (web app testing with Burp Suite in labs).
- Weeks 9–10: beginner CTF challenges; write a blog post for each one you solve.
- Weeks 11–12: one portfolio project (below), polish your resume and LinkedIn, start applying.
Legal places to practise
- Capture The Flag (CTF) platforms — picoCTF (beginner-friendly), OverTheWire (Linux and basics) and many college and community CTFs.
- Guided lab platforms — TryHackMe and Hack The Box offer structured, legal labs for both defence and offence.
- Deliberately vulnerable apps on your own machine — OWASP Juice Shop, DVWA.
- Bug bounty programmes — later, once you are comfortable: only within the published scope and rules of each programme.
Non-negotiable: never scan, test or "check" a system you do not own or have written permission to test — not your college portal, not a friend's website, not a company you want to impress. Unauthorised access is a criminal offence under the IT Act, 2000, and it ends careers before they start. Ethics is the first skill employers check.
Certifications: which ones are worth it?
- ISC2 Certified in Cybersecurity (CC) — entry level; good first step to learn the vocabulary.
- CompTIA Security+ — widely recognised for entry-level security roles worldwide.
- Vendor fundamentals — Microsoft SC-900, AWS or Azure security basics, useful for cloud-heavy companies.
- Later and more hands-on — OSCP or similar practical exams for penetration testing, CEH where employers ask for it, cloud security certifications after the fundamentals.
A certificate helps you pass the resume filter. Labs, write-ups and projects help you pass the interview. Plan for both.
Portfolio project ideas
- Home SOC lab — collect logs from a Windows and a Linux VM into a free SIEM (for example Wazuh or Elastic), simulate a brute-force attack on your own VM and write up how you detected it.
- Secure code review — take an open-source or your own college project, find and fix OWASP issues, document before/after.
- CTF write-up blog — clear explanations of 10 challenges you solved.
- Phishing awareness kit — a one-page guide and short quiz for your college, based on real Indian scam patterns.
What interviewers love: "Tell me about something you investigated." Have one story ready — a CTF, your home lab, a bug in your own code — explained step by step: what you saw, what you checked, what you concluded and what you would do next.
Try it yourself: Create a free account on picoCTF or TryHackMe and complete one beginner room or five easy challenges this week. Write a short post about one of them — your portfolio starts today.
Common interview questions
Try answering each one aloud before you open it.
1What does a SOC analyst do?
Monitors security alerts from tools such as a SIEM and EDR, triages them to separate false positives from real threats, investigates using logs and other evidence, escalates or responds to incidents, and documents findings.
2What is a SIEM?
Security Information and Event Management — a system that collects and correlates logs from many sources, detects suspicious patterns with rules and analytics, raises alerts and supports investigation and compliance reporting.
3How do you practise security skills ethically?
Only on systems I own or have explicit written permission to test: CTF platforms, guided labs, deliberately vulnerable applications on my own machine, and bug bounty programmes strictly within their published scope.
Practise this
Build something with it
FAQs
Do I need a degree in cybersecurity?
No. Most entry-level hires come from computer science, IT, electronics or self-taught backgrounds. Demonstrated skills, labs and certifications matter more than the degree name.
Is coding required for cybersecurity?
For SOC and GRC roles, basic scripting is enough to start. For application security and penetration testing, solid programming helps a lot. Learning Python is a good investment either way.
References & further reading
Finished this lesson?
Mark it complete. Create a free account to save it on every device.