How to start a
cybersecurity career

Cybersecurity protects systems, networks and data from attack, misuse and failure. The fundamentals employers expect are the CIA triad (confidentiality, integrity, availability); common threats such as phishing, malware, ransomware, credential theft and exploitation of vulnerabilities; core controls — identity and access management, multi-factor authentication, patching, encryption, backups, network segmentation, logging and monitoring; networking and operating system basics; and frameworks such as the NIST Cybersecurity Framework, whose 2.0 version organises security into govern, identify, protect, detect, respond and recover.¹

The threat picture keeps shifting. Verizon's 2026 Data Breach Investigations Report found that 31% of breaches now start with exploited software vulnerabilities, overtaking stolen credentials as the top way in.² Demand for people is strong: ISC2's 2024 workforce study found 67% of organisations reporting security staffing shortages,³ and the US Bureau of Labor Statistics projects 21% growth for information security analysts from 2025 to 2035, with a median of $129,180.⁴ In India, AmbitionBox lists cyber security analysts at a typical ₹6.5–7.1 lakh.⁵

US median, information security analysts (BLS, May 2025)

$129,180

US job growth, 2025–35 (BLS)

21%

Organisations with security staffing shortages (ISC2, 2024)

67%

Breaches starting with software vulnerabilities (Verizon DBIR 2026)

31%

Table: How entry-level security candidates are assessed (editorial summary)

Table: Common threats and the controls that reduce them (editorial guidance)

Table: How cybersecurity careers developed (editorial summary)

• A home lab with logging
• A detection or investigation write-up
• Knowledge of the CIA triad and common attacks
• Basic scripting for automation
• A short risk explanation for non-technical readers
• A verified cybersecurity fundamentals certificate

Show hands-on proof: "Built home lab with firewall, Windows and Linux hosts and SIEM; wrote detection for brute-force logins; documented investigation steps." List labs and write-ups, not just course names.

"Explain the CIA triad with examples."

Confidentiality: encrypting customer data. Integrity: checksums on transactions. Availability: backups and redundancy.

"What would you do if a user clicked a phishing link?"

Contain the account (reset credentials, revoke sessions), check for malware, look for similar emails, and report.

"What's the difference between a vulnerability, a threat and a risk?"

A weakness, something that could exploit it, and the likelihood and impact of that happening.

"Why is MFA important?"

It stops most attacks that rely on stolen passwords alone.

"How do you stay current?"

Threat reports, advisories, labs and community resources — with examples.

• "What does a typical week look like for this role?" — real work.
• "How mature is the security programme?" — learning opportunities.
• "Is there mentoring or training budget?" — growth.
• "Which tools does the team use?" — skills to build.

Table: Security roles and typical pay in India (AmbitionBox, October 2026; indicative)

Table: Common beginner security tools (editorial guidance)

• IT support / junior analyst — fundamentals in practice.
• SOC analyst — monitoring and triage.
• Security analyst / engineer — controls and investigations.
• Specialist — cloud, application security, pentesting, GRC.
• Security architect / CISO — strategy and leadership.

1. Week 1: Networking — TCP/IP, DNS, ports and firewalls.
2. Week 2: Operating systems — Windows and Linux basics and logs.
3. Week 3: Threats — Phishing, malware, ransomware, exploits.
4. Week 4: Controls — MFA, patching, backups, least privilege.
5. Week 5: Lab — Build a home lab with logging and a detection.
6. Week 6: Prove it — Write it up; take the Cybersecurity Fundamentals Certification.

Next: SOC Analyst, Networking Fundamentals and Phishing Awareness. Guides: SOC analyst, networking and Linux.

• Monitoring — alerts and logs.
• Investigating — suspicious activity.
• Hardening — patching and configuration.
• Advising — teams on secure choices.
• Documenting — incidents and procedures.
• Learning — new threats weekly.

"What's the difference between IDS and IPS?"

An IDS detects and alerts on suspicious traffic; an IPS can also block it.

"What is least privilege?"

Giving people and systems only the access they need, for only as long as they need it.

Table: A first-90-days plan (editorial guidance)

Learn the environment and tools first, including what normal looks like. Handle alerts with a mentor, document carefully and ask questions. By the third month, improve one detection, playbook or report — small improvements build trust quickly.

Attackers now use AI to write convincing phishing, find vulnerabilities faster and automate attacks; Verizon's 2026 report notes generative AI is being used across many attack techniques. Defenders use AI too: summarising alerts, explaining logs, drafting detections and speeding investigations. ISC2's 2024 study found 45% of security teams had already added generative AI to their tools.

For newcomers this changes the bar. Routine triage is increasingly assisted, so employers value people who understand fundamentals deeply enough to check AI output, spot false conclusions and handle novel situations. Learn to use AI assistants in your lab work, but always verify against raw logs and documentation.

Use virtual machines on your own computer or a cloud free tier, isolated from your home network. Include a Windows machine, a Linux server and a firewall or router VM. Send logs to a free SIEM or log platform. Practise attacks only against your own machines or intentionally vulnerable labs designed for training. Document each exercise: what you did, what logs showed, what you'd detect and how you'd respond. Never test systems you don't own or have written permission to test — it's illegal and ends careers before they start.

"You need to be a hacker." Most security jobs are about defence, monitoring, risk and engineering.

"Certifications alone get jobs." Hands-on evidence and fundamentals matter more.

"It's all technical." Communication, documentation and judgement are essential.

Use reputable, free or low-cost resources: official framework documentation, vendor learning portals, capture-the-flag events and practice platforms built for training. Join local security meetups or online communities to learn from practitioners. Set up your own lab and only test systems you own or have explicit written permission to test. Keep a learning journal and publish short write-ups of what you've done; they become your portfolio.

• Collecting certificates without labs.
• Weak networking basics.
• Testing systems without permission.
• Jargon without understanding.
• Ignoring communication skills.

US pay and outlook come from the Bureau of Labor Statistics (May 2025); workforce data from ISC2's 2024 study; breach patterns from Verizon's 2026 DBIR; frameworks from NIST; and India pay from AmbitionBox (read October 2026). The threat table, lab guidance and history are editorial. Science of Apps publishes the free test linked here. Last reviewed October 2026.

• CIA triad — confidentiality, integrity and availability.
• Vulnerability — a weakness that can be exploited.
• MFA — multi-factor authentication.
• SIEM — a system collecting and analysing security logs.
• Least privilege — minimum access needed.