What is a Cyber Security Analyst?
A cyber security analyst protects an organisation’s computers, networks and data from attacks. They monitor systems for suspicious activity, investigate alerts, fix weaknesses and help everyone in the company work safely.
Cyber security covers many areas, including network security, cloud security, incident response and ethical hacking. Most people start as a security or SOC analyst, then specialise as they gain experience.
How to use this cyber security roadmap
Follow this cyber security roadmap in order. Strong IT basics such as networking and operating systems come first, because you cannot protect what you do not understand.
Only practise security skills on systems you own or on legal training platforms. Testing other people’s systems without written permission is illegal.
1Step 1: IT and operating system basics
Understand how computers, Windows and Linux work.
What is it?
Operating systems control how a computer runs programs and manages files and users. Permissions decide who can read or change each file, which is a key part of security.
What to learn
Many attacks abuse simple misconfigurations. Knowing how systems are set up helps you spot them.
Example
bash
ls -l /etc/passwd
sudo chmod 600 secret.txt
whoCheck file permissions, make a file private to its owner and see who is logged in.
Helpful resource: Linux Journey
2Step 2: Networking fundamentals
Learn how data travels across networks and where it can be attacked.
What is it?
Networks move data in small packets between devices. Ports identify services, such as 443 for HTTPS, and firewalls decide which traffic is allowed in or out.
What to learn
Networking is the foundation of security. Spend real time here.
Example
bash
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 443/tcp
sudo ufw enableBlock all incoming traffic except SSH and HTTPS on your own Linux server.
Helpful resource: Wireshark documentation
3Step 3: Security fundamentals
Learn the core ideas, common threats and how defences work.
What is it?
The CIA triad describes the three goals of security: confidentiality (only the right people see data), integrity (data is not changed) and availability (systems stay up). Hashing helps check integrity.
What to learn
Most attacks still start with phishing or weak passwords. Defences like MFA stop a large share of them.
Example
bash
sha256sum installer.exe
# compare the result with the hash published by the vendorVerify a downloaded file has not been changed by comparing its hash.
Helpful resource: CISA cybersecurity best practices
4Step 4: Scripting for security
Automate checks and investigations with scripts.
What is it?
Security teams handle huge amounts of logs. Scripts help search them quickly for signs of trouble, such as many failed logins from one address.
What to learn
Even simple scripts save hours when checking logs or many systems. Our Python roadmap can help.
Example
python
from collections import Counter
fails = Counter()
for line in open("auth.log"):
if "Failed password" in line:
fails[line.split()[-4]] += 1
print(fails.most_common(5))Count failed SSH logins per IP address and show the top five.
Helpful resource: Official Python tutorial
5Step 5: Security operations and monitoring
Learn how security teams detect and respond to threats.
What is it?
A Security Operations Centre (SOC) watches systems around the clock. A SIEM collects logs from many systems in one place and raises alerts when it sees suspicious patterns.
What to learn
SOC analyst is the most common first job in cyber security. These skills are exactly what that role needs.
Example
text
Incident response steps
1. Prepare
2. Detect and analyse
3. Contain
4. Eradicate
5. Recover
6. Lessons learnedThe standard incident response life cycle used by most security teams.
Helpful resource: Elastic Security docs
6Step 6: Vulnerability management and ethical hacking
Find and fix weaknesses before attackers do, legally and safely.
What is it?
Vulnerability management means regularly finding, ranking and fixing security weaknesses. Ethical hackers test systems with permission to find problems first.
What to learn
Only scan systems you own or have written permission to test. Use legal labs to practise.
Example
bash
# Only scan networks you own or are authorised to test
nmap -sV 192.168.56.0/24Discover devices and services running on your own lab network.
Helpful resource: Nmap reference guide
7Step 7: Cloud and identity security
Protect cloud services and user accounts.
What is it?
Least privilege means giving users only the access they need for their job. In the cloud, this is controlled with identity and access management (IAM) policies.
What to learn
Most companies now run in the cloud, so cloud security skills are in high demand.
Example
json
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::reports-bucket/*"
}An AWS policy that only allows reading files from one storage bucket.
Helpful resource: Microsoft: Zero Trust guidance
8Step 8: Certifications and job preparation
Prove your skills and prepare for security interviews.
What is it?
Entry-level security jobs often ask for a certification like Security+, plus proof that you can apply your knowledge in practice.
What to learn
Certifications help you pass HR filters, but home lab projects and clear write-ups show real skill.
Example
markdown
## Home Lab: Failed Login Detection
- Tools: Linux, Python, Elastic SIEM
- Goal: detect brute-force login attempts
- Result: alert triggers after 10 failures in 5 minutesA short lab write-up you can share on GitHub or LinkedIn.
Helpful resource: CompTIA Security+
Cyber Security roadmap project ideas
Projects turn what you learn into real skills. Build at least one project from each level below, and put every finished project on GitHub with a clear README.
Home security lab
Windows and Linux VMs on an isolated virtual network.
Password and MFA audit
Review and secure your own accounts and document the steps.
Log analysis script
Detect brute-force attempts in authentication logs.
SIEM dashboard
Collect lab logs and build alerts and dashboards.
Vulnerability management report
Scan, rank and fix issues in your lab with a full report.
Incident response exercise
Simulate an incident in your lab and write a post-mortem.
Tips to finish this cyber security roadmap
- Learn by building. Spend at least two thirds of your study time writing code and making projects, not watching videos.
- Be consistent. One focused hour every day beats a long session once a week. Small daily progress adds up quickly.
- Share your work. Post your projects on GitHub and LinkedIn. It builds your confidence and helps recruiters find you.
- Ask for feedback. Join a community, ask questions and review other people’s code. Explaining things to others is one of the fastest ways to learn.
- Do not chase every new tool. The fundamentals in this cyber security roadmap change slowly. Master them first, then explore new libraries.
Career paths and next steps
After this cyber security roadmap, you can apply for SOC analyst, junior security analyst, IT security support or vulnerability analyst roles. With experience, many move into penetration testing, cloud security or security engineering.
Strong infrastructure skills help a lot in security, so the DevOps engineer roadmap is a useful companion.
Related roadmaps
Cyber Security Roadmap FAQs
Can I get into cyber security without experience?
Yes, but you need strong IT basics first. Many people start in IT support or as SOC analysts and build experience from there.
Do I need to know coding for cyber security?
Basic scripting in Python, Bash or PowerShell is very useful. Deep programming is only needed for some specialised roles.
Which certification should I get first?
CompTIA Security+ is a popular first certification for entry-level security roles.
Is ethical hacking legal?
Yes, when you have written permission from the system owner or use legal training platforms. Testing systems without permission is illegal.