Cybersecurity roadmap

You will read constantly that there is a cybersecurity skills shortage. There is — at senior level. Entry-level security roles are heavily contested, because the field attracts far more newcomers than it creates junior positions.

This matters because it determines strategy. Applying to a hundred entry-level security roles with no differentiator competes against hundreds of similar applications. Entering via an adjacent technical role and moving across internally is slower on paper and considerably faster in practice.

The reason is structural rather than unfair. Security work requires judgement about systems, and most organisations would rather grow that from someone who already administers their systems than hire it unproven from outside.

You cannot secure what you do not understand. The most common weakness in security newcomers is jumping to attack techniques without a working model of the systems being attacked. It produces people who can run a tool and cannot explain a result.

Build the technical base first. Networking, operating systems, and enough scripting to automate and to read someone else’s code. This is unglamorous and it is the difference between a candidate who progresses and one who stalls at the first technical interview.

A blunt self-test: can you explain, without notes, what happens between typing a URL and seeing a page — DNS, TCP, TLS, request, response, rendering? Nearly every web security concept attaches to a step in that sequence, and gaps in it show up immediately under questioning.

• Networking — protocols, routing, DNS, TLS, and reading a packet capture
• Linux and Windows administration, including permissions and logging
• Scripting in Python or PowerShell, at automation level
• How web applications work — requests, sessions, authentication
• Basic cloud architecture, since most environments are now cloud or hybrid

Security is several distinct careers. Generalist knowledge helps you begin, but specialisation is what gets you hired and paid. Choose based on what you enjoy doing repeatedly, because each involves very different days.

Defensive roles are the most common entry point and give the broadest view of how organisations actually operate. Offensive roles are more sought after and correspondingly harder to enter directly. Application security has the strongest demand relative to supply, particularly for people who can code.

Be honest about the daily texture rather than the job title. Security operations involves a queue and shift patterns; penetration testing involves report writing far more than most newcomers expect; governance involves meetings and documents. All three are good jobs for different people.

• Security operations — detection, triage, incident response
• Penetration testing and red teaming
• Application security — securing software as it is built
• Cloud security — identity, configuration and workload protection
• Governance, risk and compliance — policy, audit and assurance
• Digital forensics and incident response

Certifications matter more in security than in most technical fields, partly because regulated employers require them and partly because the field lacks other standard signals. But their value is uneven and the marketing around them is relentless.

One foundational certification establishes baseline credibility. A practical, hands-on certification in your chosen specialisation is worth considerably more than several multiple-choice ones, because it demonstrates capability rather than recall.

Check the job postings you actually want before committing money and months. Requirements differ sharply by sector and country, and it is entirely possible to earn a well-regarded credential that no employer in your target market asks for.

Build an environment you can break. Vulnerable machines, a small network, logging that you configured yourself. The specific value is that you will have seen what an attack looks like in logs, which is exactly what a defensive interview probes.

Practise on legal platforms, document what you did, and write it up clearly. Write-ups are the standard currency of the field. A handful of clear, honest ones demonstrating methodical thinking will do more for you than any course completion certificate.

Include the attempts that failed and why. Methodical elimination is what the work consists of, and a write-up that only shows the successful path suggests either luck or a walkthrough followed.

• A lab where you both attack and defend, so you see both views
• Capture-the-flag and deliberately vulnerable practice platforms
• Written reports in professional format, not just screenshots
• Only ever systems you own or are explicitly permitted to test

Technical interviews in security are less about tool knowledge than newcomers expect and more about reasoning. Expect to be handed a scenario — an alert, a log extract, a described architecture — and asked what you would check and in what order.

What interviewers are listening for is structure: forming a hypothesis, naming the evidence that would confirm or eliminate it, and knowing when to escalate. Candidates who list tools without a method interview poorly regardless of how many they know.

You will also be asked something you do not know. Saying so and describing how you would find out is the correct answer, and a confident wrong one is a far worse signal here than in most disciplines.

Very few people walk straight into security from outside technology. The routes that consistently work are lateral: help desk or system administration into security operations, software development into application security, networking into network or cloud security.

If you are already in a technical role, the internal move is the highest-probability path available to you. Volunteer for security-adjacent work, build a relationship with the security team, and become the obvious candidate when a role opens. That beats the external application queue by a wide margin.

The internal route has a second advantage nobody mentions: you arrive already knowing the systems, the people and the politics. New external hires spend their first six months acquiring exactly that, which is why internal candidates are so often preferred.