Career roadmap
Cybersecurity Engineer
Build and run the defences: identity, network, endpoint and detection, wired together so they hold.
Before you start Cybersecurity
- Networking fundamentals: TCP/IP, DNS, TLS
- Linux and Windows administration basics
- One scripting language, usually Python
Security foundations
The models and vocabulary every security conversation is built on.
CIA triad, defence in depth and least privilege — the framing for every design answer.
- Confidentiality, integrity, availability
- Defence in depth and blast radius
- Least privilege and separation of duties
- Risk = likelihood × impact, applied
You will not invent cryptography, but you must know what each primitive guarantees.
- Symmetric vs asymmetric, and where each fits
- Hashing, salting and password storage
- TLS handshake and certificate validation
- Key management and rotation
STRIDE and attack trees. A structured method impresses far more than a list of tools.
- STRIDE and data flow diagrams
- Trust boundaries and assets
- MITRE ATT&CK as a shared language
- Prioritising by realistic threat
Segmentation is the control that most limits an intruder's movement.
- Firewalls, segmentation and microsegmentation
- IDS/IPS and traffic inspection
- VPN and zero trust network access
- DNS security and egress filtering
Most breaches start with credentials, which makes identity the primary control plane.
- Authentication factors and MFA strength
- SSO, SAML and OIDC
- Privileged access management
- Joiners, movers and leavers process
BuildThreat model a real application and produce a prioritised control list with justifications.
Securing systems
Move from principles to configured, tested controls on real infrastructure.
Benchmarks turn opinion into a defensible, auditable standard.
- CIS benchmarks for Linux and Windows
- Service minimisation and secure defaults
- Host firewalls and local policy
- Configuration drift detection
EDR is where most real detections land, and where most interviews go next.
- EDR capabilities and tuning
- Application allow-listing
- Disk encryption and device policy
- Patch management at scale
Misconfiguration, not exploitation, causes most cloud incidents.
- IAM policy design and privilege review
- Storage exposure and public access blocks
- Security groups and private networking
- Cloud security posture management
Scanning is easy; prioritising and actually closing findings is the job.
- Scanning cadence and coverage
- CVSS, EPSS and real-world prioritisation
- Patch SLAs and exceptions
- Measuring remediation over time
Phishing remains the most common initial access vector by a wide margin.
- SPF, DKIM and DMARC
- Phishing simulation programmes
- Business email compromise controls
- Security awareness that changes behaviour
BuildHarden a small environment end to end and produce evidence against a recognised benchmark.
Detection and response
Assume prevention fails. Detection quality decides how bad the incident becomes.
You can only detect what you collect. Coverage gaps are the usual root cause.
- Log sources and coverage mapping
- Windows event and Sysmon telemetry
- Cloud audit logs
- Retention, cost and legal requirements
Writing detections is a software discipline now, with tests and version control.
- Detection as code and rule repositories
- Sigma rules and portability
- Tuning for false positives
- Detection coverage against ATT&CK
The lifecycle, and the decisions that get made badly under pressure.
- Preparation, detection, containment, eradication, recovery
- Containment trade-offs and evidence preservation
- Communication and legal escalation
- Lessons learned that change controls
Enough to answer 'what did they do' rather than only 'they got in'.
- Disk and memory acquisition
- Timeline construction
- Chain of custody
- Common persistence artefacts
Intelligence is only useful when it changes a control or a detection.
- IOCs versus behavioural indicators
- Threat actor profiling
- Intelligence feeds and their quality
- Turning intel into detections
BuildBuild detections for five ATT&CK techniques, test them with simulated activity, and tune out the noise.
Automation and architecture
Security that depends on manual review does not scale past a small company.
Automating the repetitive third of alert handling frees the analysts who matter.
- Playbook design and safe automation
- Enrichment and triage automation
- Auto-containment with guard rails
- Measuring analyst time saved
Preventing a misconfiguration beats detecting it after deployment.
- Guardrails in cloud accounts
- OPA policies in pipelines
- Preventive vs detective control choice
- Exception handling that expires
Shift-left works only when the findings are actionable and fast.
- SAST, SCA and secret scanning
- Container and IaC scanning
- Triage and false positive management
- Breaking the build responsibly
Widely misused as a term. Being precise about it is a senior signal.
- Identity-aware access
- Device posture and conditional access
- Removing implicit network trust
- Realistic migration phasing
Frameworks fund security work. Speaking their language gets budget approved.
- NIST CSF and ISO 27001 structure
- SOC 2 controls and evidence
- Risk registers and acceptance
- Vendor and third-party risk
BuildAutomate a control end to end: detect a misconfiguration, alert, and remediate it without a human.
Certification and interviews
Security hiring uses certifications as a filter and scenarios as the real test.
Security+ opens doors early; CISSP unlocks senior and management roles.
- CompTIA Security+ as the baseline
- CISSP for senior and management roles
- Cloud security certifications
- Choosing based on target job ads
Given an alert or an incident, walk through your reasoning and decisions.
- Triaging a suspicious login
- Containing a compromised host
- Deciding when to take a system offline
- Communicating risk to executives
Deep questions on TLS, authentication and how specific attacks actually work.
- Explain the TLS handshake
- How does Kerberoasting work
- OWASP Top 10 mechanics
- Detecting lateral movement
Security hiring respects demonstrated hands-on work more than most fields.
- Detection lab with attack simulation
- Published detection rules
- CTF participation
- Write-ups of what you learned
Security is a constant negotiation with delivery pressure.
- Blocking a release for a security issue
- Being overruled and what you did
- Explaining risk without scaremongering
- Handling an incident calmly
BuildA home lab with an attack simulation, the detections that caught it, and a written report.
Cybersecurity tools on your CV
- MITRE ATT&CK
- Splunk / Elastic
- Sysmon
- CrowdStrike / EDR
- Nessus
- OPA
- Python
- Wazuh
What Cybersecurity employers ask to see
- A detection lab with published rules and test results
- A threat model for a real application with prioritised controls
- A hardening project measured against CIS benchmarks
- An automated remediation pipeline for a cloud misconfiguration
Security postings grew 124% year on year, with cybersecurity engineers alone accounting for around 20,000 new posts. Demand consistently exceeds the supply of people who can actually build controls rather than only audit them.
Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.