Career Roadmap
Cybersecurity Specialist: Zero to Hero
This is the generalist gateway roadmap into cybersecurity. It covers what every security professional needs regardless of specialization—networking foundations, Security+, and CySA+. From there, it hands you off to a dedicated specialization roadmap (Cloud Security, SOC, or GRC) once you know which direction fits. This keeps the path focused instead of trying to teach every branch of security in one place. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for IT Support Technicians and Network Administrators transitioning into cybersecurity, as well as Help Desk Professionals moving into security roles. Additionally, it is tailored for Career Changers entering security from non-IT backgrounds who need foundational training, as well as Recent Graduates building their first security credentials.
Skills You'll Develop
Apply CIA triad, defense in depth, and security controls to real-world scenarios.
Identify attack patterns from logs, conduct vulnerability assessments, and perform incident triage.
Secure networks, operating systems, and applications with foundational security controls.
Understand GDPR, HIPAA, PCI-DSS, NIST CSF, and basic risk management principles.
Apply the incident response lifecycle and participate in security operations.
Analyze security logs, use MITRE ATT&CK framework, and conduct vulnerability assessments.
Target Roles in this Roadmap
- Security Analyst: Monitors, detects, and responds to security threats
- SOC Analyst: Operates SIEM platforms and investigates security alerts
- Security Support Specialist: Provides security operations support and incident triage
- Security Administrator: Implements and maintains security controls
- Junior Security Engineer: Assists in designing and implementing security solutions
Typical Employer Categories
- Technology & Software Firms: Internal security teams, product security, and SOC operations
- Financial Services: Banking, insurance, fintech, and payment processors
- Healthcare Organizations: HIPAA compliance, patient data protection
- Government & Defense: Federal agencies, DoD contractors, and public sector security
- Consulting & Professional Services: Security assessments, managed security providers, and advisory firms
- Managed Security Service Providers (MSSPs): 24x7 security monitoring and incident response
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| CompTIA Security+ (SY0-701) | Month 2-4 | Foundational security knowledge. Required for DoD/government roles. Gets you Job Ready. |
| CompTIA CySA+ (CS0-003 or V4) | Month 6-8 | Intermediate practitioner credential. Gets you Hire Ready and ready to specialize. |
Optional Foundation
| Cert | When | Why |
|---|---|---|
| ISC2 CC (Certified in Cybersecurity) | Month 1-2 | Optional warm-up. Only needed if you are completely new to IT and security. |
Specialization Path (Choose One)
| Cert | When | Why |
|---|---|---|
| Cloud Security Engineer | Month 8+ | For AWS/Azure/GCP infrastructure and DevSecOps-adjacent work. |
| SOC Analyst | Month 8+ | For threat detection, SIEM, and incident response work. |
| GRC Specialist | Month 8+ | For audit, risk, and compliance program work. |
Senior Path
| Cert | When | Why |
|---|---|---|
| ISC2 CISSP | Month 18+ | Most recognized senior security credential. Requires 5 years of experience. |
| ISACA CISM | Month 18+ | Security management and governance. Requires 5 years of experience with management focus. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level — Job Ready | Security+ passed. Can identify attack types, select controls, and reason through governance scenarios. | Month 4-5 |
| Practitioner Level — Hire Ready | CySA+ passed. Can analyze logs, conduct vulnerability assessments, and respond to incidents. Ready to specialize. | Month 8-10 |
| Specialist Level — Lead Ready | CISSP or CISM passed (on top of specialization). Can design and govern enterprise security programs. | Month 18+ |
Step 0 - IT and networking foundations
Build the technical foundation every security concept depends on. Security is applied IT—without this, security concepts stay abstract instead of operational.
~1 month~1 month
Step 0 - IT and networking foundations
Build the technical foundation every security concept depends on. Security is applied IT—without this, security concepts stay abstract instead of operational.
- Networking fundamentals: OSI model, TCP/IP, subnets, CIDR, DNS, DHCP, routing
- Common protocols: HTTP/S, FTP, SSH, SMTP, LDAP, Kerberos
- Operating systems: Windows AD, Group Policy, event logs; Linux filesystem, permissions, bash
- Virtualization and cloud basics: hypervisors, containers, shared responsibility model
- Cryptography foundations: symmetric vs asymmetric, hashing, PKI, TLS
- Basic scripting: Python or PowerShell—enough to read automation scripts
Certifications
💡 CompTIA Network+ is worth considering if you have minimal networking experience. Not required, but candidates who cannot reason through TCP/IP and DNS questions will struggle with everything that follows.
💡 Linux command line fluency is increasingly expected. TryHackMe and HackTheBox have free Linux fundamentals rooms for hands-on practice.
🏁 Entry Level Checkpoint: You understand networking, operating systems, and basic scripting. You can reason through TCP/IP and DNS scenarios.
🛠 Project Ideas
- ▸Set up a Windows domain controller and a Linux VM. Configure basic security controls and analyze event logs.
- ▸Write a Python script that scans for open ports on a target IP and logs the results.
Step 1 - Security fundamentals and Security+
Build foundational security knowledge and earn the credential that opens the door to your first security role.
~2-3 months~2-3 months
Step 1 - Security fundamentals and Security+
Build foundational security knowledge and earn the credential that opens the door to your first security role.
- CIA triad in real scenario contexts: confidentiality, integrity, availability trade-offs
- Authentication, authorization, and accounting (AAA) frameworks
- Common attack categories: phishing, malware, ransomware, social engineering, MITM, injection
- Defense in depth and layered security principles
- Risk fundamentals: threats, vulnerabilities, likelihood, impact, risk appetite
- Security controls: preventive, detective, corrective, administrative, technical
- Compliance frameworks at an introductory level: GDPR, HIPAA, PCI-DSS, NIST CSF
- Basic incident response lifecycle: preparation, detection, containment, eradication, recovery, lessons learned
💡 ISC2 CC is optional. It is the right starting credential for candidates coming from outside IT entirely. Candidates with existing IT experience can move directly to Security+.
💡 Security+ is the most widely recognized vendor-neutral security baseline. 90 minutes, maximum 90 questions, 750/900 passing score. Satisfies DoD 8570/8140 IAT Level II.
💡 Performance-based questions (PBQs) appear before multiple-choice. Practice applied scenario reasoning actively, not just definition recall.
🏁 Entry Level Checkpoint — Job Ready: You have passed Security+. You can identify attack types from symptoms, select appropriate controls for described scenarios, and reason through governance decisions. This qualifies you for junior SOC analyst, security support, and IT roles with a security focus.
🛠 Project Ideas
- ▸Identify a recent security breach in the news. Map the incident to the incident response lifecycle and identify which controls failed.
- ▸Write a one-page security policy for a fictional small business covering passwords, access control, and incident reporting.
Step 2 - CySA+ and applied defense
Move from knowing security concepts to applying them—analyzing logs, assessing vulnerabilities, and responding to real incident scenarios. This is the credential that gets you genuinely hired and where you build enough context to choose your specialization.
~2-3 months~2-3 months
Step 2 - CySA+ and applied defense
Move from knowing security concepts to applying them—analyzing logs, assessing vulnerabilities, and responding to real incident scenarios. This is the credential that gets you genuinely hired and where you build enough context to choose your specialization.
- Security operations and log analysis at an applied level
- Vulnerability management lifecycle: scanning, prioritization, remediation tracking
- MITRE ATT&CK framework: tactics, techniques, sub-techniques
- Incident response and reporting: IR frameworks, evidence collection, containment strategies
- Cloud and hybrid environment security concepts (new emphasis in CySA+ V4)
- AI-driven threat detection concepts (new in CySA+ V4)
Certifications
💡 CySA+ V4 launches June 23, 2026, replacing CS0-003. The new version increases cloud and hybrid environment coverage and adds AI-driven threat detection content.
💡 CySA+ is heavily PBQ-weighted. Security Operations (33%) and Vulnerability Management (30%) both include performance-based questions. Hands-on lab practice is essential—this is not a definitions exam.
🏁 Practitioner Level Checkpoint — Hire Ready: You have passed CySA+. You can identify attack patterns from logs, conduct vulnerability assessments, and reason through incident response scenarios. This is the point where most people land their first real security role—and where you have enough context to pick a specialization deliberately instead of by default.
🛠 Project Ideas
- ▸Build a simple SIEM lab using ELK or Splunk Free. Ingest logs, create a detection rule, and respond to a simulated alert.
- ▸Perform a vulnerability assessment on a test network. Generate a report with prioritized remediation recommendations.
- ▸Write a Python script that parses a log file and alerts on specific attack patterns.
Step 3 - Choose your specialization
Security splits into genuinely different disciplines from here. Rather than compress all three into one roadmap, pick the dedicated path that matches the work you actually want to do. Each is a full roadmap in its own right.
~1 month (decision phase)~1 month (decision phase)
Step 3 - Choose your specialization
Security splits into genuinely different disciplines from here. Rather than compress all three into one roadmap, pick the dedicated path that matches the work you actually want to do. Each is a full roadmap in its own right.
- **Cloud Security Track**: Infrastructure security across AWS, Azure, and GCP, IAM design, IaC scanning, container security, and DevSecOps pipeline work. Best fit if you enjoyed the cloud and networking parts of this roadmap the most.
- **SOC / Threat Detection Track**: SIEM operations, threat hunting, digital forensics, and incident response at depth. Best fit if you enjoyed the CySA+ log analysis and MITRE ATT&CK content the most.
- **GRC Track**: Risk management frameworks, audit methodology, compliance program management, and data privacy regulation. Best fit if you enjoyed the governance and compliance framework content the most, and prefer program-level work over hands-on technical work.
Certifications
💡 The Cloud Security Engineer roadmap is live and covers CCSK, platform-specific certifications (AWS Security Specialty, SC-500, GCP Cloud Security Engineer), and CCSP for senior cloud security roles.
💡 A dedicated SOC Analyst roadmap and GRC roadmap are planned. Until then, SC-200 (Microsoft Security Operations Analyst) and CISA (Certified Information Systems Auditor) are reasonable starting points for those tracks respectively.
💡 Do not try to pursue more than one specialization track at once. Depth in one beats shallow coverage of three.
🏁 Practitioner Level Checkpoint: You have chosen your specialization. You know which certifications, tools, and skills to build next.
🛠 Project Ideas
- ▸Research three different security job postings for each specialization. Identify the certifications, tools, and experience required.
- ▸Shadow a security professional in each specialization (if possible) or review public incident reports, cloud security blogs, and GRC frameworks to see which resonates.
Step 4 - Senior credentials (CISSP or CISM)
Earn the most recognized senior security credentials once you have accumulated the required professional experience. Both are 5-year experience gates, not exams you should target early.
~4-6 months (after experience requirements met)~4-6 months (after experience requirements met)
Step 4 - Senior credentials (CISSP or CISM)
Earn the most recognized senior security credentials once you have accumulated the required professional experience. Both are 5-year experience gates, not exams you should target early.
- CISSP domains: Security and Risk Management (15-16%), Asset Security (10%), Security Architecture (13%), Network Security (13%), IAM (13%), Assessment and Testing (12%), Operations (13%), Software Security (11%)
- CISM domains: Information Security Governance (17%), Risk Management (20%), Program Development (33%), Incident Management (30%)
- The managerial mindset shift: from technical solutions to governance-aware, risk-balanced, management-defensible answers
- April 2026 CISSP update: AI security content added across all eight domains
- Follow-on paths: CCSP for cloud-focused senior roles, ISSEP/ISSAP/ISSMP for engineering/architecture/management concentrations
Certifications
💡 CISSP requires 5 years of paid work experience across two or more of the eight domains (4 years with a relevant degree). Without the experience, you can earn Associate of ISC2 after passing and fulfill the requirement later.
💡 The April 2026 CISSP update added AI security content across all eight domains. Supplement older materials with the ISC2 Exam Guidance for Artificial Intelligence document.
💡 CISSP is not a technical exam. It tests managerial security judgment. The most common failure mode for technical practitioners is defaulting to technically correct answers rather than governance-aware, risk-balanced ones.
💡 CISM targets professionals managing security programs rather than staying hands-on. If your specialization track led you toward GRC, CISM is usually the better fit over CISSP.
🏁 Specialist Level Checkpoint — Lead Ready: You have passed CISSP or CISM on top of a specialization credential. You can design and govern enterprise security programs. This qualifies you for senior security engineer, security architect, and security leadership roles.
🛠 Project Ideas
- ▸Write a security program strategy document for a fictional organization. Include risk assessment, control selection, and governance structure.
- ▸Conduct a mock board-level presentation on security posture, risk trends, and proposed investments.
Final Step - What this path actually builds
This roadmap gets you from zero to Hire Ready and gives you enough real experience to choose a specialization deliberately. Security+ opens the door to your first security role. CySA+ proves you can analyze logs, assess vulnerabilities, and respond to incidents. Together, they qualify you for junior SOC analyst, security support, and IT roles with a security focus. From there, the Cloud Security Engineer roadmap, SOC Analyst roadmap, or GRC roadmap take you deeper into your chosen specialization. Cybersecurity knowledge has the shortest half-life in IT. Exam content changes annually, attack techniques evolve continuously, and regulations shift faster than certification syllabi can track. Build the daily practice habit before your first exam and maintain it after your last. Use ExamOS scenario practice to keep your reasoning sharp, and carry that daily practice habit into whichever specialization you choose next.
Final Step - What this path actually builds
This roadmap gets you from zero to Hire Ready and gives you enough real experience to choose a specialization deliberately. Security+ opens the door to your first security role. CySA+ proves you can analyze logs, assess vulnerabilities, and respond to incidents. Together, they qualify you for junior SOC analyst, security support, and IT roles with a security focus. From there, the Cloud Security Engineer roadmap, SOC Analyst roadmap, or GRC roadmap take you deeper into your chosen specialization. Cybersecurity knowledge has the shortest half-life in IT. Exam content changes annually, attack techniques evolve continuously, and regulations shift faster than certification syllabi can track. Build the daily practice habit before your first exam and maintain it after your last. Use ExamOS scenario practice to keep your reasoning sharp, and carry that daily practice habit into whichever specialization you choose next.
Certifications
Final Thoughts
💡 Total: 8-12 months at 2 hours/day to reach Hire Ready (Security+ and CySA+)
💡 Security+: 2-3 months for candidates with basic IT experience.
💡 CySA+: 2-3 months for candidates with Security+ and some hands-on experience.
💡 CISSP/CISM: 4-6 months of study, but requires 5 years of experience.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| ISC2 CC + Security+ | ~3 months | ~5 months |
| Security+ + CySA+ (Hire Ready) | ~5 months | ~8 months |
| Full path to CISSP or CISM (Lead Ready) | ~12 months study | ~18 months study, plus the 5-year experience gate |