47 — Your Career Path — From Zero to Hired
Level: Beginner · Time: ~22 min · Prerequisites: Lesson 46 — Risk, Governance and Compliance
Why this matters
If you have read this far, you can explain a TLS handshake, read a packet capture, write a detection rule and say what you would do in the first fifteen minutes of a ransomware incident. The remaining problem is not knowledge; it is that nobody outside your own head knows you can do it. Security hiring is unusually readable once you understand it: employers are looking for reasoning, communication and evidence of hands-on work, in roughly that order, and most candidates present only a list of tools. This lesson maps the roles honestly, tells you which certifications are worth paying for and which are a comfort blanket, and describes what actually gets a person with no experience into their first role.
The mental model: roles are jobs, not titles
Three things are true of this field and save years of confusion.
First, titles are unreliable across employers. A "security engineer" at one company is a vulnerability manager; at another it is a detection engineer; at a third it is a person who configures the firewall. What matters is the work, so read the job description for what you would actually do all day, not the title at the top.
Second, the field is a ladder of work, not a ladder of years. Depth in something real pays more than time served. Somebody who has genuinely built and validated detections in a lab is more employable at two years than somebody who has attended meetings for eight.
Third, the entry point is nearly always the same. Most people arrive through alert triage, service desk, system administration or a managed service provider — because those roles let an employer see how you think before trusting you with something serious. Plan for that rather than around it.
[!TIP] Look at the job ad and count how many bullets are tools and how many are judgement: "you will triage alerts and decide what is a real threat", "you will explain findings to non-technical stakeholders". The judgement bullets are what the interview will actually test. Prepare for those.
The roles, described by what the day looks like
| Role | What you actually do all day | How you get in | Lessons that matter most |
|---|---|---|---|
| SOC analyst (Tier 1/2) | triage alerts against a queue, follow playbooks, escalate what is real, write up what you saw; often shift work | the most common entry point; help desk, MSP, or an entry certification plus demonstrable lab work | 22, 23, 24, 44, 45 |
| Incident responder | take over live incidents, scope them, contain, coordinate, write the timeline and the report | from SOC work, forensics or systems administration; comfort with pressure matters more than tooling | 24, 25, 36, 45 |
| Threat hunter | form a hypothesis from threat intelligence, go looking in the data, prove or disprove it, improve detections | from detection or SOC work, with strong log and hypothesis discipline | 22, 23, 26, 7 |
| Detection engineer | write, test and tune detection rules; map coverage to ATT&CK; reduce false positives without losing the real ones | from SOC or a scripting background; the best portfolio role for a career changer | 22, 23, 26, 31, 38, 39 |
| Security engineer | build and run the controls: endpoint, identity, email, log pipelines, automation | systems or cloud administration, then the security specialisation | 17, 19, 20, 22 |
| Network security engineer | firewalls, segmentation, VPN, proxies, network detection; the plumbing everyone else depends on | network engineering or CCNA-level background | 1, 2, 9, 18, 31 |
| Vulnerability manager | keep the inventory and the scanning honest, prioritise with CVSS and EPSS, chase the fixes, prove they landed | systems administration or analyst work; a process job as much as a technical one | 27, 29, 30 |
| Penetration tester | test agreed systems inside a scope, then write the report and explain it to the client; the job is mostly reporting and communication, not exploitation | usually not an entry role; from systems, development or SOC work plus hands-on practice | 7, 10, 29, 30, 37 |
| Red teamer | emulate a specific adversary against a mature target, evade detection, measure whether the defenders saw it | years of offensive or deep infrastructure experience; scarce and selective | 7, 13, 26, 39 |
| Application security engineer | read code, threat-model features, run SAST and DAST, help developers fix rather than blame them | a development background is the strongest route in | 3, 10, 17 |
| Cloud security engineer | identity and policy in the cloud, guardrails as code, posture scanning, workload and container security | cloud administration first, then the security layer | 15, 20, 22, 36 |
| Digital forensics specialist | acquire and analyse disks, memory and mobile devices; timelines, chain of custody, court-ready reports | from incident response, law enforcement or systems work | 25, 36 |
| GRC analyst | run the risk register, answer questionnaires, keep the policies and evidence current, prepare audits | any background with good written communication; an underrated route in for career changers | 27, 43, 46 |
| Security architect | design how identity, network, data and cloud fit together, and defend the design in front of engineers and leadership | years of engineering breadth, usually across more than one domain | 16, 17, 18, 20, 21 |
| Head of security / CISO | own the risk, the budget and the decisions; communicate up, prioritise down, and carry the accountability | a leadership move, not an entry role; often from architecture, GRC or engineering leadership | 43, 45, 46 |
Adjacent routes in, which are the most realistic for most people:
| You already do | The natural bridge | What to add |
|---|---|---|
| Service desk / help desk | SOC analyst, identity administration, endpoint management | log reading, the triage discipline of Lesson 23, one scripting language |
| System or network administration | security engineer, network security, detection engineering | detection and hunting, ATT&CK fluency, cloud basics |
| Software development | application security, detection engineering, cloud security | threat modelling, the web attack classes in Lesson 10 |
| Finance, operations, project management | GRC analyst, awareness and training, incident coordination | risk vocabulary from Lesson 46 and the frameworks |
| Anything at all, with a lab | the first role is the one you can prove you can do | a documented lab (Lesson 37) and written analysis (below) |
The tracks, and how to choose between them
| Track | The work | Best if you like | Entry realism |
|---|---|---|---|
| Blue (defend) | monitoring, detection, response, hunting, forensics | investigation, patience, reading logs, puzzles with a purpose | highest demand, most open roles, the easiest start |
| Red (attack) | penetration testing, red teaming, adversary emulation | breaking things, writing reports, working with clients | very competitive at entry level; usually a second or third job |
| Purple (both) | building detections from real attack techniques, validating them | making defenders measurably better | a growing specialism, and a superb portfolio story |
| Governance | risk, policy, audit, compliance, supplier review | language, structure, persuasion, ambiguity | genuinely open, and often overlooked by technical candidates |
| Engineering | building and running controls, identity, cloud, automation | making systems work reliably at scale | strong demand; needs breadth |
| Architecture | designing how everything fits together | systems thinking and explaining trade-offs | a later-career move, not an entry point |
The single most important honest note: blue team and detection work has far more open roles than offensive work, and it is a destination, not a consolation prize. The best defensive engineers in the industry are not failed pentesters; they are people who chose the harder, more consequential problem of finding what is already hiding in a network nobody else is watching. Offensive skills remain valuable — read Lesson 30 in your lab and learn how attacks work — but do not build a career plan on the assumption that the red team is where the jobs are.
The skills that transfer everywhere
| Skill | Why it matters | How to build it |
|---|---|---|
| Networking fundamentals | every alert, every rule and every segmentation decision sits on this | Lesson 1 and 2, then packet captures from Lesson 31 until they stop being intimidating |
| Linux and Windows administration | you cannot secure, investigate or explain a system you cannot operate | build both in the lab, manage users, services, logs and permissions by hand |
| Scripting in a real language | automation is how one person covers a hundred endpoints; Python plus PowerShell or Bash is the common pairing | automate one boring task in your lab per week until it is fluent |
| Cloud platform basics | most organisations now run at least part of their estate there, and identity is the main control surface | a free tier account, deploy a small workload, learn the logging and policy model |
| Reading logs | the core craft: turning thousands of lines into "this host was used to move sideways at 02:14" | work real datasets from the platforms below, and your own lab logs |
| Writing clearly | incident reports, findings, ticket notes and policies are the deliverable in most roles | write up every lab exercise as if a manager had to act on it |
| Explaining a technical decision to a non-technical person | this is how controls get funded and how careers progress | practise the three-sentence version: what, so what, what I recommend |
The last two are the ones that get people promoted — and they are the most commonly neglected, because they feel less like "security" than learning a new tool. A senior analyst who writes well is promoted over a brilliant one who does not, almost every time.
Certifications, handled honestly
A certification is a filter and a syllabus. It is a filter because hiring systems and recruiters use it to reduce a pile of three hundred applications, and it is a syllabus because a structured exam forces you to study things you would otherwise skip. It is not competence: a certificate shows you passed an assessment, which is a useful signal and a poor substitute for having done the work. Two consequences follow. Collecting certifications instead of building skill is the most common way to spend two years and be unhirable — the interview asks what you did, not what you passed. And a hands-on practical exam carries far more weight in an interview than a multiple-choice one, because it is much harder to fake and it proves you can work under time pressure.
| Certification | What it is really testing | Rough cost in money and months | Who should bother |
|---|---|---|---|
| CompTIA Security+ | vocabulary and breadth: the baseline knowledge a junior security role assumes | low money, two to three months of study | absolute beginners who need a first filter to pass, and anyone whose employer or contract requires it |
| ISC2 Certified in Cybersecurity (CC) | entry-level concepts, with a shorter path than Security+ | low money, one to two months | beginners who want a cheap first certificate and an entry into a professional body |
| Microsoft role certifications (security operations, identity and access, cloud security) | hands-on administration of the Microsoft platform: identity, mail, endpoints, cloud | moderate money, two to four months each | anyone working in, or targeting, a Microsoft-heavy estate — which is most small and mid-sized businesses |
| Cisco CCNA, then CCNP-level security | network theory and configuration, then network security operations | moderate to high, three to six months | anyone heading for network security, or who needs one solid networking credential |
| AWS or equivalent cloud security certification | cloud identity, policy, logging and workload security on one platform | moderate, two to four months | anyone targeting cloud security or working in a cloud-heavy environment |
| GIAC certifications (security essentials, incident handling, intrusion analysis, forensics) | deep practitioner knowledge with hands-on lab components in many exams | high — the training bundles are the most expensive path in the field by an order of magnitude; three to six months | people whose employer pays, and specialists who need the depth and the credibility |
| OffSec OSCP | practical exploitation ability against live machines, with a written report | moderate money including the lab subscription, six to twelve months of real practice | offensive-track candidates who can already work in a lab, and detection engineers who want to understand attacks properly |
| Other practical exams (PNPT, CRTP, eJPT and similar) | hands-on skills with a report or live target, at a lower entry point | low to moderate, two to six months | anyone building an offensive portfolio who is not yet ready for the hardest practicals |
| ISC2 CISSP | breadth, risk judgement and managerial thinking across domains | moderate to high, though it expects several years of relevant experience (an associate route exists if you do not have it yet) | experienced practitioners moving towards architecture, management or consulting |
| ISACA CISM | security management: governance, risk, programme and incident leadership | moderate to high, with a work-experience expectation | people moving into management, and GRC specialists |
| ISACA CISA | auditing information systems: controls, evidence, assurance | moderate to high, with an audit or controls work-experience expectation | anyone heading for audit, assurance or compliance leadership |
Practical notes that save money and disappointment: entry-level exams are the cheapest category, the deep practitioner training bundles are the most expensive, and most credentials carry an annual maintenance fee plus continuing-education credits. Before you buy, check the vendor's current exam price and requirements, ask whether your employer or a training provider bundles training with the exam voucher, and give any credential with a work-experience requirement a plan rather than a purchase date.
How to choose, in one line: pick the cheapest entry credential that gets you through the filter, then spend the next two years on hands-on skill and one specialist certification that matches the job you actually want.
Getting hired
The portfolio that gets people hired
Certifications open the conversation; the portfolio wins it. Build it in public where you safely can, and make it easy for a busy interviewer to see what you can do in five minutes.
- A home lab, documented. The machines, the network, the addresses, the isolation, drawn as a diagram — Lesson 37 built it, and describing it well is itself evidence of competence.
- Detections you wrote, with the reasoning. Not "here is a Sigma rule" but "here is the behaviour, here is why it matters, here is how I tested it, here is what it would miss". Lesson 38 gives you the pipeline; Lesson 39 gives you the validation.
- A written analysis of a laboratory attack you reproduced and detected. Attacker action, the log evidence, the rule that fired, the false positives, and what you changed afterwards. This single document is more persuasive than any certificate.
- A few structured challenge-platform write-ups. Quality over quantity: three well-written investigations beat forty screenshots.
- A public repository with something real in it — detection rules, a parsing script, a lab build file. Something that runs.
- A sample professional report. Take a lab incident and write it as you would for a client: summary, timeline, evidence, impact, recommendations. Most candidates have never tried, and it is exactly what the job produces.
[!WARNING] Everything you publish must respect authorisation and confidentiality. Write only about your own lab, purpose-built vulnerable targets, and platforms whose terms permit public write-ups. Never publish a real employer's systems, data, findings or incident details, and never write up a live vulnerability you discovered without following the disclosure route below. A portfolio that demonstrates poor judgement is worse than an empty one.
Where to practise, and how to be found
| Route | Why it works |
|---|---|
| Open training platforms and challenge ranges (TryHackMe, Hack The Box, Blue Team Labs Online, CyberDefenders, PortSwigger Web Security Academy for web) | structured practice with real data; the blue-team platforms map directly onto the triage work of Lesson 44 |
| Local community and conferences (BSides-style events, OWASP chapters, professional-body and CERT events) | jobs are frequently filled through people who have seen you speak, help or ask a good question |
| Contributing to an open-source project (detection rule repositories, a log parser, a documentation fix, ATT&CK mappings) | public evidence of collaboration, and a review from a maintainer is a reference |
| Writing publicly in small consistent pieces | one short post a month, explaining one thing you actually did, beats one ambitious essay you never finish |
| Speaking, even for five minutes | a lightning talk at a local meetup is a credential nobody can take away from you |
The hiring process, and how to pass it
| Stage | What it usually contains | How to prepare |
|---|---|---|
| Screening call | motivation, background, expectations, logistics, sometimes a salary question | know why this role and this employer; have a range researched from real sources rather than a guess |
| Technical interview | scenario questions, log or output interpretation, "what would you check first", sometimes a whiteboard of a network | practise answering out loud; do not chase the perfect answer, show the reasoning |
| Practical exercise | triage a packet capture, write a detection rule, review a configuration, or a take-home report with a deadline | do two or three at home first; time yourself, and write it up as a report |
| Behavioural or values interview | how you handled a mistake, a disagreement, a difficult stakeholder | one honest story per theme, told in a minute, ending with what you learned |
| Offer and checks | references, right to work, and in many security roles a background check | be straightforward; discrepancies here end offers |
How scenario questions actually work. An interviewer asks "you see this alert, what do you do first" or "how would you investigate this host". They are not testing whether you know the answer — they have already built in ambiguity. They are testing whether you reason in a structured way and whether you can be trusted with a real incident. The structure that lands:
- State your assumption. "Assuming this is a production workstation and I have access to the endpoint and the logs..."
- Name the data source you would use first, and why that one: the identity provider's sign-in log, the endpoint's process history, the firewall, the resolver.
- Say what you would check first and what would make you escalate — that is the judgement they are hiring.
- Say what would change your mind. "If I found the same pattern on two other hosts, I would stop treating it as an isolated alert."
- Say what you would record and who you would tell, because every real incident is a communication exercise.
Interviewers hire for reasoning and communication, not trivia. Do not memorise port numbers you can look up. Do be able to explain, in three sentences, why a control exists, what breaks without it, and what you would do next.
The first role with no experience
| Route | What it looks like | Why it works |
|---|---|---|
| Internal transfer | move from your current employer's service desk, operations or development team into its security work | your employer already trusts you; the domain is new, the environment is not |
| Service desk or administration as a bridge | two years of hands-on systems work, plus a lab and a portfolio | you accumulate the operational foundation every security role assumes |
| Managed service provider entry role | the classic apprenticeship: many clients, many technologies, fast exposure | you see more incidents in a year than most in-house staff see in five |
| Internship or apprenticeship | formal programmes, sometimes with study attached | a structured way in when you have no commercial track record |
| Volunteering with a non-profit | a small organisation that needs its mail, backups and laptops sorted properly | real responsibility, real users, and a reference you can name |
| Small-business consulting | with this course behind you, offer a fixed-scope review: inventory, second factors, backups, email authentication, a report | it is income and experience, and it teaches you the language of Lesson 46 |
On that last route, be disciplined: only ever work on systems you are authorised in writing to assess, keep the scope written down, report findings privately, and never treat a client's environment as a place to learn by exploring. Lesson 37 set that rule and it is the one that matters for the whole career.
Progression, staying current and ethics
Progression and pay, described honestly
The ladder usually looks like this: analyst, then senior analyst or specialist, then lead or principal, then either management (team lead, head of security, CISO) or depth (architect, distinguished specialist). The branches are not a hierarchy and you do not have to leave hands-on work to earn more — the market generally pays for scarce depth more than for years of service.
Hands-on depth pays better than tenure. Somebody who has genuinely done incident response, or built detection at scale, or made identity secure across a large estate, is scarce; somebody who has attended security meetings for a decade is not.
To research current rates in your own country and region, use sources that reflect your actual market rather than one global figure: national statistics agencies and official occupational data, published recruitment-agency salary guides for your country, the annual workforce studies run by professional bodies and vendors, job advertisements that state a range, and — best of all — three people doing the job you want, asked directly and politely. Salary varies enormously by country, sector, whether the role is public or private, and whether it is remote. Any single number quoted in a course is wrong for most readers, which is why this lesson gives you a method instead.
Specialising in something scarce is worth more than being average at everything. Identity, cloud security, detection engineering, application security and industrial or operational technology are all perennially short of experienced people. Pick one, go deep, and keep the breadth that lets you talk to everyone else.
Staying current without burning out
- Three good sources, not thirty. One or two newsletters, the authorities for the frameworks you actually use, and one community. Everything else is noise with a logo.
- Follow the frameworks you work with — the ATT&CK technique pages of Lesson 7 and the CIS Controls of Lesson 46 update for a reason, and reading the change is worth more than reading commentary about it.
- Practise in the lab rather than reading endlessly. An hour rebuilding a detection you read about teaches more than ten articles.
- Protect the habit. Twenty minutes twice a week for a year beats an enthusiastic weekend quarter that ends in March.
- Say no to being on call forever. Burnout ends more security careers than competence gaps do; sustainable pace is a professional skill.
Professional ethics as a career asset
Everything you have learned here is dual-use, and the field's small size means your reputation travels further than your CV.
- Authorisation discipline. Written, scoped permission for every system — the rule from Lesson 37. Never test something because you can reach it.
- Discretion. You will see payroll, medical notes, legal advice, personal messages and people's mistakes. What you see in the course of work does not exist for you afterwards, and discussing an incident outside the need-to-know circle is a career-ending error, not a lapse of manners.
- Disclosure done correctly. If you find a real vulnerability, report it privately to the owner and follow coordinated disclosure. If it is in a product, the vendor's security contact or a national coordination centre handles the process. If it involves personal data, the notification duties of Lesson 24 apply to the organisation responsible.
- Say what you know and what you do not. Overstating a finding costs a client money and costs you the account. "I can prove this happened; I cannot yet tell you how far it went" is a stronger sentence than a confident guess.
Trust is the entire currency of this profession. Certifications expire, tools change, employers merge — but a person known to be careful, honest and calm under pressure will always be employed. That reputation is built in the small decisions: the scope you refused to exceed, the finding you reported rather than kept, the mistake you owned in the incident review.
Attack it / Defend it
| The attack | How it works | The control that stops it |
|---|---|---|
| Certificate collection | two years of exams and no demonstrated work | a portfolio with a written analysis and a repository in it |
| Tool trivia interviews survived, real incidents not | memorised commands without reasoning | practise scenario answers: assumption, data source, first check, what would change your mind |
| The invisible candidate | excellent lab work that nobody has seen | publish small pieces consistently; speak at a local meetup |
| The careless write-up | a portfolio that exposes an employer's systems or data | publish only lab and permitted-platform work; never name a real environment |
| Judgement shown in public | a "research" write-up of an unauthorised finding | written authorisation, private disclosure, coordinated timelines |
| Red-team tunnel vision | a career plan built on the scarcest entry market in the field | start in blue team or detection, keep offensive skills as an edge |
| Learning by reading only | endless articles, no hands-on hours | an hour a week in the lab, built on Lessons 37 to 39 |
| Burnout | permanent on-call and constant alerts with no recovery | a sustainable pace, one specialism, and three sources rather than thirty |
| Reputation damage | discussing an incident, a client or a colleague's mistake | need-to-know discipline from day one — it is unrecoverable |
| Stagnation | staying average at everything | choose a scarce specialism and go deep while keeping breadth |
Key takeaways
- Read roles by what you would do all day, not by title. Titles vary wildly between employers; the work does not.
- Blue team and detection work is where most of the jobs are, and it is a destination rather than a consolation prize — the hard problem is finding what is already hiding.
- A certification is a filter and a syllabus, not competence. Buy the cheapest one that gets you through the filter, then spend two years building demonstrated skill; a practical exam outweighs a multiple-choice one in the room.
- The portfolio wins the interview. A documented lab, detections with reasoning, and one written analysis of an attack you reproduced and detected are worth more than any certificate.
- Interviewers hire for reasoning and communication. State your assumption, name the data source, say what you would check first, say what would change your mind, say who you would tell.
- Trust is the currency. Authorisation, discretion and honest reporting are the assets that keep you employed for a career; everything else can be relearned.
Check yourself
- A job ad says "SOC Analyst — Tier 1". What will you actually do in the first six months, and which three lessons in this course are your daily reference?
- Explain the difference between a blue-team and a red-team career in two sentences, and say where the entry-level roles actually are.
- Name the cheapest certification that would get your CV past a first filter in your country, and say what you would build in the next six months to outweigh it.
- Walk through a scenario question out loud: "You see an alert that a user's mailbox forwarded 400 messages to an external address overnight. What do you do first?" Use the five-part answer structure.
- Why is a written analysis of a laboratory attack you reproduced and detected more persuasive to an interviewer than a certification, and what must it never contain?