The Ultimate Guide

Start Your
Cybersecurity
Journey.

Everything has a first day. This is yours. Pick where you stand — the path unfolds below.

Scroll to explore

Where do you stand?

Choose Your Path.

Same destination. Different starting points.

Most people fail because they skip the fundamentals and reach for Kali Linux on day one. Don't. The foundation you build in the next 90 days determines how far you can go. Start slow, go deep — everything else builds on top of this.

1

Month 1

Networking & Operating Systems

Every attack and every defence lives on a network. Before tools, learn the terrain — how packets travel, where they get stopped, and what the command line actually does.

  • IP Addresses (IPv4 vs IPv6), DNS, Ports (80, 443, 22), OSI Model (Layers 1–7)
  • Linux file system: /etc, /var, /home — Commands: cd, ls, grep, chmod, sudo
  • Install Ubuntu on VirtualBox/VMware — hands-on from day one
2

Month 2

Core Security Concepts

Now that you understand the technology, learn how it breaks.

  • CIA Triad — Confidentiality, Integrity, Availability. Memorise this.
  • Phishing, Social Engineering, Malware types (Ransomware, Trojan, Spyware)
  • OWASP Top 10 — the 10 most critical web vulnerabilities
NetworkChuck on YouTube
3

Month 3

First Hands-On Labs & Certification

Reading and watching will only take you so far. Month 3 is about doing — breaking real systems in controlled environments, writing your first investigation report, and earning a credential that proves you started. Pick one lab platform and one cert. Finish both before moving on.

From the Lab

OSINT Guide — 2026 Edition

A practical, no-fluff walkthrough of open-source intelligence gathering. Perfect as your first real investigation exercise — no special tools, just a browser and methodology.

Mistakes Everyone Makes (Don't Be That Person)
  • Don't install Kali Linux immediately. Learn Ubuntu first — Kali is a tool, not a playground.
  • Don't pay for bootcamps. TryHackMe, Cybrary, and YouTube are free and superior at this stage.
  • Don't try to hack anything without permission. It is a crime in every country.

Ready to start? Open your first lab.

The TryHackMe Pre-Security path is browser-based — no setup required. Do it now.

Start TryHackMe

You are not a beginner. You are a professional changing domains. Your strategy is "Translation", not Re-learning. Your existing experience is an advantage — you just need to learn the language of security.

<Devs / SysAdmins / QA / Network>

From IT Background

Developer → AppSec / DevSecOps

You know how to build. Now learn to break and patch.

  • / Learn SAST/DAST: Snyk, SonarQube, CI/CD Security pipelines
  • / Read: OWASP Top 10 — you'll recognize all 10
  • / Project: Build an app, inject an SQLi/XSS bug, then patch it

SysAdmin → Cloud Security / Blue Team

You already understand permissions and logs — that's 50% of defense.

  • / Learn: CIS Benchmarks, SIEM tools (Splunk, Wazuh), IAM
  • / Target cert: CompTIA Security+ or AWS Security Specialty

From the Lab

SOC Lab Guide — Monitoring Logs in Wazuh

Set up a real SIEM, ingest logs, trigger alerts. Exactly what Blue Team interviews will ask you to walk through.

QA / Network → Penetration Testing

  • / Your testing mindset is already 70% of pentesting — you already think adversarially
  • / Month 1–2: Learn Burp Suite + Nmap. Do Hack The Box Starting Point (free tier)
  • / Month 3: Complete TryHackMe Jr Pentester path. Target: eJPT cert
  • / Month 4+: PNPT → OSCP. Build a report portfolio — write every engagement up, publish on Medium

From the Lab

API Security Lab — ShopEasy

Hands-on OWASP API Top 10 exploitation on a deliberately vulnerable e-commerce API. Build this kind of lab report for your portfolio.

<Sales / HR / Finance / Medical / Arts>

From Non-IT Background

Tech can be taught in 3 months. Crisis communication, stakeholder management, and clear reporting are harder to learn and take years. You already have these.

Strategy 1: The GRC Route (Less code, more logic)

Governance, Risk, and Compliance. Policy writing, auditing, risk management.

  • / Read: ISO 27001, NIST Framework, GDPR basics
  • / Target roles: Jr. GRC Analyst, Third-Party Risk Analyst

Strategy 2: The Tech Sprint (High effort, high reward)

  • / CompTIA A+ (Month 1–2) — do not skip even if it feels basic
  • / CompTIA Network+ (Month 3)
  • / CompTIA Security+ or CEH (Month 4+)

Not sure which path fits your background?

Ask Ethan — describe your current role and he'll map your transferable skills to the right entry point.

Ask Ethan

Certifications get you past HR filters. Projects get you the job. Pick your specialization, build the portfolio, and stop waiting.

RED TEAM

The Pentester

Find vulnerabilities before criminals do.

Write Pentest Reports

Don't just say "I hacked a box." Write: Executive Summary → Technical Walkthrough → Remediation. Publish on Medium.

GitHub Scripting

Build a Python "Subdomain Enumerator" or "Port Scanner" and host it publicly.

Cert Target

eJPT (beginner) → PNPT → OSCP (advanced)

From the Lab

API Security Lab — ShopEasy

OWASP API Top 10 on a real target. Model your portfolio reports on this.

BLUE TEAM

The SOC Analyst

Monitor, Detect, Respond.

Home Lab Blueprint

Ubuntu Server + Wazuh SIEM. Attack with Kali VM. Detect the attack. Screenshot the alerts.

Malware Analysis

Detonate a sample in Any.Run. Write a report: C2 IPs, persistence, exfiltration method.

Cert Target

CompTIA Security+ → CySA+ → BTL1

From the Lab

SOC Lab Guide — Wazuh SIEM

Build a real detection lab. Screenshot the alerts. That's your portfolio piece.

The Golden Rule

Don't list "Watching YouTube" as a skill. List Projects. "Built a Home Lab SIEM" beats "Enthusiastic self-learner" every single time.

Why Juniors Get Rejected
  • /Tool Monkey — knows Nmap but not the TCP handshake
  • /Can't explain risk to a non-technical manager
  • /No community presence — join Discord, build in public
Getting the Interview — What Most Guides Don't Tell You
/ LinkedIn headline matters. "Aspiring SOC Analyst | CompTIA Security+ | Home Lab Builder" beats "Looking for opportunities" — recruiters search by keyword, not intent.
/ Apply to 10, tailor 3. Mass-applying burns you out and produces generic cover letters. Pick 3 roles per week, read the JD, mirror their language exactly in your application.
/ Cold outreach works. Find a mid-level analyst at a company you want to join. Send a 4-line LinkedIn message: who you are, what you've built, one specific question. 30% reply rate is realistic.
/ After 50 rejections, stop and audit. It's not the market — it's either your resume, your certs, or your portfolio. Ask Ethan to review your application honestly.
/ Build in public. Write one Medium post per lab. Share it. Recruiters Google your name — make sure they find something that proves you know your craft.

Need a mock technical interview?

Ask Ethan to grill you on Active Directory, SQL injection, or incident response — and critique every answer.

Practice with Ethan

You have the theory — data structures, networking, maybe some OS concepts. What you're missing is adversarial thinking and practical exposure. Employers know this gap exists. Your job is to close it before graduation, not after.

1

Year 1–2

Bridge Theory to Practice with CTFs

Capture The Flag competitions are the fastest way to make your coursework feel real. You already understand TCP/IP — now use that knowledge to exploit it. Start with TryHackMe, move to PicoCTF, then compete in CTFtime events as a team.

  • TryHackMe Pre-SecurityJr Pentester path — spend 1 hour per day
  • picoCTF — designed for students. Solve 10 challenges per semester
  • Join or start a cybersecurity club at your institution — CTF teams get noticed by recruiters

From the Lab

OSINT Guide — 2026 Edition

A great first practical exercise — no special tools, just methodology. Use it as a template for writing your own investigation reports.

2

Year 2–3

Cert Order & Specialisation Decision

Your degree is the baseline. Certifications prove you can apply knowledge under exam conditions. Get your first cert before your final year — it massively improves internship applications.

Step 1 — Free

ISC2 CC

Free certification. Covers all core domains. Do this first — it validates your degree-level knowledge.

Step 2 — Foundation

CompTIA Security+

The industry standard. Many graduate job listings require it or treat it as equivalent to 1 year of experience.

Step 3 — Specialise

Pick your lane

Red: eJPT → PNPT. Blue: CySA+. Cloud: AWS Security. GRC: CISA. Don't spread across all — go deep on one.

3

Final Year

Internships, Projects & Building in Public

A 3-month internship is worth more than any certification in a hiring manager's eyes. Apply early — most security internships are posted in October for the following summer. While you wait, build your public portfolio.

  • Use your final-year project for something security-related — then publish the writeup publicly
  • Apply to bug bounty programs on HackerOne or Bugcrowd — even $0 findings teach you real-world scope management
  • Write one Medium article per project — recruiters read portfolios, not just CVs

From the Lab

API Security Lab — ShopEasy

A real-world style security assessment writeup. Use this as a template for your own bug bounty or internship reports.

Not sure which specialisation fits you?

Ask Ethan to map your interests and strengths to the right cybersecurity domain before you invest in a cert.

Ask Ethan

You're already in the field. The question isn't whether to keep learning — it's where to go next. Use this map to find adjacent roles, identify the gaps between where you are and where you want to be, and plan the shortest path.

Lateral move map — find your next role

From

SOC Analyst / L1–L2

Threat Intelligence Analyst

Gap: MITRE ATT&CK, Threat hunting

Cert: GCTI

Incident Responder

Gap: DFIR methodology, memory forensics

Cert: GCFE / BTL1

Cloud Security Engineer

Gap: AWS/Azure security, IAM, CSPM tools

Cert: AWS Security Specialty

From

Pentester / Red Team

AppSec / Product Security

Gap: SAST/DAST, secure SDLC, threat modelling

Cert: CSSLP / GWEB

Red Team Lead / Manager

Gap: Report writing, team management, CBEST

Path: OSCP → CRTO → Lead

Bug Bounty / Independent

Gap: Scope management, disclosure writing

Platform: HackerOne / Bugcrowd

From

GRC / Compliance

CISO / Security Manager

Gap: Board communication, budget ownership

Cert: CISSP / CISM

Privacy Engineer

Gap: GDPR technical implementation, data flow mapping

Cert: CIPP/E

Third-Party Risk Lead

Gap: Vendor assessment frameworks, TPRM tooling

Cert: CTPRP

From

DevOps / Cloud Eng.

DevSecOps Engineer

Gap: Pipeline security, secrets management, SCA

Tools: Snyk, Checkov, Trivy

Cloud Security Architect

Gap: Zero Trust architecture, CSPM, landing zones

Cert: CCSP / AWS Security

Container / K8s Security

Gap: CIS Benchmarks for K8s, Falco, OPA/Gatekeeper

Cert: CKS

From the Lab

SOC Lab Guide — Monitoring Logs in Wazuh

Even if you're moving away from SOC, understanding how SIEM detection works makes you a better architect, engineer, or IR lead. Run through this lab once — it'll change how you think about visibility.

Rules for Upskillers
  • Don't chase every new tool. Pick one domain, go deep, get certified, then move. Breadth without depth is a recruiter red flag.
  • Your current role is leverage, not a cage. Use your existing network to find internal transfers first — it's faster than external applications by 3–6 months.
  • Document what you already know. Most upskillers undersell themselves. Write a list of 10 things your current role has taught you — then map each to the job description of the role you want.

Want a personalised upskilling plan?

Tell Ethan your current role, your target role, and your timeline. He'll map the gap and suggest the shortest path.

Map My Path with Ethan

AI-Powered Mentor

Ask Ethan.

Copy a prompt below, then open Ethan — your AI cybersecurity mentor — to get a personalised answer.

Beginner

Build My Learning Path

"I am completely new to cybersecurity. I have [X] hours per week and [Y] months. Build me a step-by-step learning plan with free resources only."

Beginner

Explain a Concept Simply

"Explain [concept, e.g. 'TCP/IP' or 'Public Key Cryptography'] to me like I am 15 years old. Use an analogy from real life."

Career Changer

Translate My Skills

"Act as a Technical Recruiter. I am a [Developer/SysAdmin/HR Professional]. List 5 specific security-relevant skills I already have. Format as a resume Skills section."

Career Changer

Write My Cover Letter

"I come from [Sales/HR/Finance]. Explain how my experience in 'Crisis Management' and 'Reporting' applies to a GRC Analyst role. Write 3 bullet points for my cover letter."

Job Seeker

Technical Interview Drill

"Act as a Senior Penetration Tester. Simulate a technical interview. Ask me one hard question about [Active Directory / SQL Injection / Buffer Overflow] and critique my answer."

Job Seeker

Incident Response Scenario

"Act as a SOC Manager. Present a Ransomware scenario. Walk me through the Containment and Eradication phases using the NIST Incident Response framework. Critique my answers."

Student

Build My CTF & Cert Roadmap

"I am a [Year X] CS/IT student. I have [Y] hours per week. I want to enter [Red Team / Blue Team / GRC / Cloud Security]. Build me a 12-month roadmap mixing CTF practice, a certification, and a project I can publish."

Upskiller

Map My Career Move

"I am currently a [SOC Analyst / Pentester / GRC Analyst / DevOps Engineer] with [X] years of experience. I want to move into [target role]. List the 3 most critical skill gaps, the best certification to bridge them, and a realistic 6-month plan."

Learn Every Day

Stay Sharp.

Cybersecurity changes daily. Commit to reading one article per day from these trusted sources.

Hands-On Platforms

The Next Step

One Conversation
Can Change Everything.

Ethan is trained on real-world cybersecurity knowledge. Ask the question you're afraid to ask anywhere else.

Start with Ethan

Free · No signup required · Powered by ChatGPT