Skip to content

career-roadmaps.md

Latest commit

 

History

History
180 lines (138 loc) · 7.42 KB

career-roadmaps.md

File metadata and controls

180 lines (138 loc) · 7.42 KB

Cybersecurity Career Roadmaps

Detailed learning paths for different security career tracks. Each roadmap includes skills to develop, resources, certifications, and timeline estimates.

📊 Career Path Overview

┌─────────────────────────────────────────────────────────────────┐
│                    CYBERSECURITY CAREERS                         │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌──────────────┐   ┌──────────────┐   ┌──────────────┐        │
│  │  OFFENSIVE   │   │  DEFENSIVE   │   │   HYBRID     │        │
│  │  (Red Team)  │   │  (Blue Team) │   │  (Purple)    │        │
│  └──────┬───────┘   └──────┬───────┘   └──────┬───────┘        │
│         │                  │                   │                │
│  • Pentester        • SOC Analyst       • Security Engineer     │
│  • Red Teamer       • Threat Hunter     • Security Architect    │
│  • Bug Bounty       • DFIR              • Cloud Security        │
│  • Exploit Dev      • Malware Analyst   • AppSec Engineer       │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

🎯 SOC Analyst / Security Analyst Path

Timeline: 6-12 months to entry-level position

Phase 1: Foundation (Months 1-3)

Topic Resources Goal
Networking Professor Messer Net+, TryHackMe Network Fundamentals Understand TCP/IP, protocols, packet flow
Linux Linux Journey, TryHackMe Linux Fundamentals Command line proficiency
Security Concepts TryHackMe Pre-Security Path Core security vocabulary

Phase 2: SOC Skills (Months 3-6)

Topic Resources Goal
SIEM Splunk Fundamentals, TryHackMe Splunk rooms Log analysis, queries
Incident Response TryHackMe SOC Level 1 path Alert triage, investigation
Threat Intelligence MITRE ATT&CK, CTI rooms Understanding adversary TTPs

Phase 3: Certification & Job Hunt (Months 6-12)

  • Primary cert: CompTIA Security+
  • Optional: CompTIA CySA+, Splunk Core User
  • Build home lab with SIEM (Wazuh, Elastic Security)
  • Apply to entry-level SOC positions

🔴 Penetration Tester Path

Timeline: 12-24 months to entry-level position

Phase 1: Foundation (Months 1-6)

Topic Resources Goal
Linux OverTheWire Bandit, Linux Journey Advanced command line
Networking CCNA materials, Network+ Deep protocol understanding
Python Automate the Boring Stuff, TryHackMe Python Scripting for automation
Web Technologies MDN Docs, PortSwigger basics HTTP, sessions, cookies

Phase 2: Offensive Skills (Months 6-12)

Topic Resources Goal
Methodology TryHackMe Jr Penetration Tester, TCM PEH Structured approach
Web Hacking PortSwigger Academy (complete all labs) Web vuln expertise
Network Attacks TryHackMe/HTB network machines Exploitation skills
Active Directory TryHackMe AD track, HTB Pro Labs Enterprise pentesting

Phase 3: Certification (Months 12-18)

  • Target cert: OSCP (Offensive Security Certified Professional)
  • Complete 50+ HTB/TryHackMe machines
  • Practice report writing

Phase 4: Job Hunt (Months 18-24)

  • Build GitHub portfolio with tools/write-ups
  • Network at conferences/meetups
  • Consider bug bounty for experience

☁️ Cloud Security Engineer Path

Timeline: 12-18 months (assuming some IT/Dev background)

Phase 1: Cloud Foundation (Months 1-4)

Topic Resources Goal
Cloud Fundamentals AWS Cloud Practitioner, Azure Fundamentals Core cloud concepts
Linux & Networking Standard fundamentals Prerequisite knowledge
IaC Basics Terraform getting started Infrastructure as Code

Phase 2: Cloud Security (Months 4-8)

Topic Resources Goal
AWS Security AWS Security Specialty prep, CloudGoat labs AWS security controls
Container Security Kubernetes basics, container security guides K8s security
Cloud Pentesting HackTricks Cloud, flAWS challenge Offensive cloud perspective

Phase 3: Certification & Specialization (Months 8-12)

  • Primary cert: AWS Security Specialty or AZ-500
  • Specialize in: Container security, Serverless security, or Multi-cloud

Phase 4: Portfolio & Job Hunt (Months 12-18)

  • Build cloud security projects on GitHub
  • Contribute to cloud security tools
  • Target DevSecOps or Cloud Security Engineer roles

📋 GRC Analyst Path

Timeline: 6-12 months to entry-level

Phase 1: Foundation (Months 1-3)

Topic Resources Goal
Security Fundamentals Security+ materials Vocabulary, concepts
Business Writing Professional writing courses Clear communication
IT Basics General IT knowledge Understanding systems

Phase 2: GRC Skills (Months 3-6)

Topic Resources Goal
Frameworks NIST CSF, ISO 27001 documentation Framework understanding
Risk Management Risk assessment methodologies Risk analysis
Compliance GDPR, HIPAA, PCI-DSS basics Regulatory knowledge

Phase 3: Certification & Job Hunt (Months 6-12)

  • Primary cert: Security+ or CISA
  • Consider: CRISC, ISO 27001 Lead Implementer
  • Target: GRC Analyst, IT Auditor, Compliance Analyst roles

🏗️ Security Architect Path

Timeline: 5-10 years (senior role requiring extensive experience)

Prerequisites

  • 5+ years hands-on security experience
  • Experience across multiple security domains
  • Strong business and communication skills

Development Path

  1. Start in technical role (engineer, analyst, pentester)
  2. Gain breadth across security domains
  3. Develop business acumen and stakeholder management
  4. Lead security projects end-to-end
  5. Pursue CISSP, SABSA, or TOGAF certifications
  6. Transition to architecture/advisory roles

📈 General Timeline Expectations

Experience Level Typical Timeline Salary Range (US)
Entry-level 0-2 years $60-85K
Mid-level 2-5 years $85-130K
Senior 5-10 years $130-180K
Staff/Principal 10+ years $180-250K+
Leadership 10+ years $200-400K+

💡 Key Success Factors

  1. Consistency - Daily/weekly learning beats sporadic cramming
  2. Hands-on practice - Labs and projects over passive learning
  3. Community involvement - Network, contribute, help others
  4. Documentation - Blog, GitHub, portfolio demonstrate skills
  5. Patience - Security expertise takes years to develop fully

← Back to Main README