Cybersecurity Analyst
Protect organizations from digital threats
Not sure this is right for you? Find My Match →
0 of 11 missions done
Is this career for you?
Two minutes before you commit months
Tick what sounds like you
Tick the ones that are true for you.
Skills you'll walk away with
Jobs this leads to
- Security Analyst
- SOC Analyst
- Penetration Tester
- Security Engineer
- CISO (long-term)
Before you start
- ✓ Basic computer networking knowledge
- ✓ Comfort with command-line tools
11 missions to Cybersecurity Analyst
4 worlds, 11 missions. Tap any circle to open it; the glowing one is next.
You can't secure what you don't understand.
Learn the core of cybersecurity.
Pick a track and build real skills.
Land your first role and keep growing.
More about this career
About the job, pay where you live, questions people ask, and where this career can take you next.
About the job
What you’d do
- Monitor the organisation's networks for security breaches and investigate when one happens
- Run and maintain protective software such as firewalls and data encryption
- Check computer and network systems for vulnerabilities
- Perform risk assessments and test systems
- Write reports on attempted attacks and security breaches
- Recommend security improvements to management or senior IT staff
Where you’d work
- Computer systems design firms (about 22% of US information security analysts)
- Finance and insurance (about 17% in the US)
- Company head offices (about 9% in the US)
- Information sector companies (about 9% in the US)
- Management and technical consulting firms (about 6% in the US)
Every step in full
The complete text of every step, to read or print. Work through them in the journey above.
IT & Networking Foundations 3 steps
Network Protocols & Architecture
Understanding exactly how data moves from point A to point B across the internet.
Real-world task: Use Wireshark on your home network. Capture a simple HTTP packet and an HTTPS packet. Physically locate the IP headers, TCP flags, and payload in the HTTP packet, and observe why the HTTPS payload is unreadable.
Why it matters: Most attacks happen over the network. If you don't know how DNS resolves or what port SSH uses by default, you won't recognize anomalous traffic.
Checklist
- Master the OSI and TCP/IP models
- Understand subnetting, IP addressing (IPv4/IPv6), and routing
- Learn core protocols: DNS, HTTP/HTTPS, FTP, SSH, RDP
- Understand the function of routers, switches, and load balancers
- Learn how NAT (Network Address Translation) works
Operating Systems & Linux Command Line
Knowing how systems are structured internally to recognize when they have been manipulated.
Real-world task: Set up an Ubuntu Server virtual machine. Create three users, assign them to different groups, and modify folder permissions so User A cannot read User B's files. Verify the logs to see the changes you made.
Why it matters: Hackers 'live off the land' using built-in OS tools to escalate privileges. You have to know the OS better than they do.
Checklist
- Navigate Linux natively via the CLI (cd, ls, grep, find)
- Understand Linux file permissions and user groups (chmod, chown)
- Learn how Windows Active Directory organizes enterprise users logically
- Monitor running processes and services (top, ps, Windows Task Manager)
- Read system logs to track events (var/log in Linux, Event Viewer in Windows)
Automation & Scripting (Python/Bash)
Writing code to automate repetitive defense tasks and parse massive security logs.
Real-world task: Write a Python script that opens a dummy Apache web server log file, parses out all the IP addresses using regular expressions, courts their frequency, and prints the top 5 most hyperactive IPs.
Why it matters: A SOC analyst might look at 10,000 security logs a day. You cannot manually read them; you must script the sorting process.
Checklist
- Write basic Bash scripts for Linux administration
- Learn Python syntax (variables, loops, dictionaries)
- Use Python's regex (re) module to search for IP addresses in text
- Understand how to make API calls using Python (requests library)
- Learn basic PowerShell for querying Windows operating systems
Security Fundamentals 3 steps
Threat Modeling & Vulnerabilities
Understanding the taxonomy of how attacks actually happen in the wild.
Real-world task: Read three recent, major data breach reports (e.g., SolarWinds, Equifax). For each, write a one-paragraph summary of the initial attack vector and what security control theoretically should have stopped it.
Why it matters: You need a mental library of attacks to rapidly hypothesize what might be happening when a system starts acting strangely.
Checklist
- Understand the CIA Triad (Confidentiality, Integrity, Availability)
- Learn common attack vectors: Phishing, Ransomware, SQLi, XSS
- Interpret CVEs (Common Vulnerabilities and Exposures) and CVSS scoring
- Understand Social Engineering tactics
- Learn the concept of Zero Trust architecture
Cryptography & Access Control
The math and policies that keep unauthorized users out.
Real-world task: Generate an SSH key pair on your machine. Configure a cheap cloud VPS (like DigitalOcean) to only accept login via your private key, expressly disabling password logins. Test that password login fails.
Why it matters: Poor access control is the leading cause of compromises. You need to know how to lock doors cryptographically, not just theoretically.
Checklist
- Differentiate between Symmetric and Asymmetric encryption
- Understand Hashing (SHA-256) and why it's used for passwords
- Learn about Digital Certificates and PKI (Public Key Infrastructure)
- Understand Multi-Factor Authentication (MFA) mechanisms
- Learn Principle of Least Privilege and Role-Based Access Control (RBAC)
Defensive Infrastructure & Appliances
The hardware and software barriers establishing the enterprise perimeter.
Real-world task: Set up a pfSense firewall in a VirtualBox lab. Create rules that explicitly block Ping (ICMP) requests from an external machine while allowing HTTP traffic on port 80.
Why it matters: When a threat is detected, you need to know exactly which firewall rule or appliance to modify to isolate the attacker instantly.
Checklist
- Understand Firewalls (Stateful vs. Stateless, WAFs)
- Learn the difference between IDS (Intrusion Detection) and IPS (Intrusion Prevention)
- Understand Endpoint Detection and Response (EDR) platforms
- Learn how VPNs secure remote access
- Understand basic cloud security concepts (AWS Security Groups)
Specialize & Get Hands-On 3 steps
Blue Team: SOC Operations & SIEM
Working the defense line: monitoring alerts, investigating logs, and kicking out intruders.
Real-world task: Install Splunk Enterprise (free tier) locally. Ingest a sample dataset of Windows Security Event Logs. Write a query to detect whenever a user account is repeatedly locked out (Event ID 4740).
Why it matters: The majority of entry-level cyber jobs are in the SOC (Security Operations Center). Being able to navigate a SIEM on day one gets you hired.
Checklist
- Learn SIEM (Security Information and Event Management) tools like Splunk or ELK
- Practice Alert Triage: determining False Positives vs True Positives
- Learn the Incident Response Lifecycle (NIST Framework)
- Understand the MITRE ATT&CK framework for categorizing adversary tactics
- Write basic correlation rules to trigger alerts
Red Team: Offensive Security Tools
Thinking like a hacker to test your own company's defenses.
Real-world task: Download the 'Metasploitable' vulnerable virtual machine. Use Nmap to discover open ports, identify an outdated service, find the exploit in Metasploit, and achieve a reverse root shell. Document every step.
Why it matters: To defend a network, you must know how adversaries probe and exploit it. Red team skills make you a drastically better Blue team defender.
Checklist
- Master Nmap for port scanning and OS fingerprinting
- Learn Metasploit to execute known exploits against vulnerable machines
- Use Burp Suite to intercept and modify web requests
- Understand privilege escalation techniques on Linux and Windows
- Learn basic password cracking with Hashcat or John the Ripper
Live Range Practice & Certifications
Formalizing your skills through gamified environments and industry-recognized exams.
Real-world task: Complete the 'Web Fundamentals' path on TryHackMe. Then, prepare for and schedule the CompTIA Security+ exam within a 60-day window to force yourself to study.
Why it matters: Cyber IT is heavily certification-driven. HR filters resumes automatically looking for the 'Security+' keyword.
Checklist
- Complete learning paths on TryHackMe or HackTheBox
- Participate in Capture The Flag (CTF) events
- Pass the CompTIA Security+ (the gold standard entry-level cert)
- Consider a specialized cert like CySA+ (Defense) or eJPT (Offense)
- Join Bug Bounty platforms to read public vulnerability write-ups
Job Hunt & Career Growth 2 steps
Building a Home Lab Portfolio
Demonstrating practical competence through self-directed projects.
Real-world task: Build an 'Active Directory Lab' with 1 Domain Controller and 2 Client VMs. Write a detailed README on GitHub explaining how you configured Group Policies to enforce password complexity, accompanied by screenshots.
Why it matters: Security experience is a catch-22: you need experience to get hired, but getting hired gives experience. A documented home lab proves to hiring managers that you possess practical, functional initiative.
Checklist
- Set up an Active Directory lab environment using Virtualization (Hyper-V / VMware)
- Deploy a honeypot on a cloud server to monitor brute force attacks
- Run an IDS (like Suricata or Snort) locally to inspect traffic
- Document your architecture with professional network diagrams (Draw.io)
- Write detailed blog posts explaining how you built the lab
Navigating the Cyber Job Market
Breaking through the HR filters to land a SOC Analyst or Junior Admin job.
Real-world task: Locate an upcoming BSides or local cybersecurity meetup in your city. Attend in person, strike up conversations with 3 people, and ask what they look for in junior hires. Networking is overwhelmingly effective in the security community.
Why it matters: Many 'entry-level' cyber jobs actually expect 1-2 years of general IT experience. You have to sell your deep technical curiosity and foundational knowledge to bypass this requirement.
Checklist
- Ensure your resume emphasizes IT fundamentals (networking, AD) just as much as security tools
- Apply broadly for Tier 1 SOC Analyst, Helpdesk, and Junior Network Admin roles
- Prepare for technical interviews: know the ports (SSH, RDP, DNS), explain the OSI model, and describe what happens when you type google.com
- Attend local security conferences like BSides, DEF CON groups, or OWASP chapters
Questions people ask about Cybersecurity Analyst
Clear answers regarding timelines, prerequisites, salaries, and study strategies.
How long does it take to become a Cybersecurity Analyst?
This roadmap estimates 6–18 months (with IT background) or 1–2 years (from scratch). It has 4 phases and 11 steps, from “IT & Networking Foundations” to “Job Hunt & Career Growth”.
How do I become a Cybersecurity Analyst?
Follow the 4 phases in order, starting with Phase 1, “IT & Networking Foundations”. Your first task: Use Wireshark on your home network. Capture a simple HTTP packet and an HTTPS packet. Physically locate the IP headers, TCP flags, and payload in the HTTP packet, and observe why the HTTPS payload is unreadable.
How much does a Cybersecurity Analyst earn?
Pay depends on the country. The salary box on this page shows DraftMyCareer’s estimate, in local currency, for the country chosen in the menu.
What do I need before starting?
This roadmap lists: Basic computer networking knowledge; Comfort with command-line tools.
What skills does a Cybersecurity Analyst need?
This roadmap covers: Network Security, Threat Analysis, Incident Response, Linux, Python, SIEM Tools.
Switch Careers: Paths Into and Out of This Role
See every switch →Next-Step Career Upgrades & Lateral Moves
- Cloud Architect
Combine critical cybersecurity expertise with cloud architecture for premier enterprise security architect roles.
⏱ 4–6 months🧭 ModerateWhat you would learnCloud Infrastructure Design (AWS/Azure/GCP) · Terraform & Infrastructure Automation · High Availability & Scaling
View Action Plan
- Month 1–2: Cloud Core Services Deeply study compute, storage, VPC networking, and database services on AWS or Azure.
- Month 3–4: Cloud Security & IaC Author secure Terraform templates with automated compliance guardrails and least-privilege IAM.
- Month 5–6: Solutions Architecture Design resilient, fault-tolerant enterprise systems and pass Cloud Solutions Architect Pro exam.