Cybersecurity Analyst Career Roadmap
Cybersecurity is adversarial thinking applied at industrial scale — the systematic practice of finding how systems fail before someone with bad intentions finds it first. It rewards paranoia, lateral thinking, and a deeply inconvenient habit of reading terms-of-service documents. The threat landscape evolves faster than any curriculum can track, which means the job is genuinely never finished. That's the frustration. It's also the entire appeal.
Is this the right path for you?
Cybersecurity analysts come from IT help desk and networking backgrounds (the operational foundation is there), from self-taught paths through CTFs and home labs, and from military or government backgrounds where security clearances and operational experience were built. The help desk to security path is the most common — 2–3 years in IT support builds the foundational understanding of systems that security builds on.
If you instinctively think about how a system could be broken before you think about how it should work — if reading about a CVE makes you want to reproduce it rather than just patch it — you're already thinking like a security analyst. The job rewards adversarial curiosity and a low tolerance for assumptions about what's safe.
CompTIA Security+ is the floor credential. It's not deep and it won't impress anyone at a mature security team, but it's the minimum bar that gets resumes through initial screening at most corporate security teams. Treating it as the ceiling is a mistake — treat it as the ticket to the room, then build real skills through labs, CTFs, and eventually the OSCP or equivalent.
Career Progression
Where does this role lead?
Click any role to explore timeline, key skills and, where the Department of Labor publishes it, pay.
Entry
SOC Analyst
~1–2 yrs
$70,117 (Level I)
You're watching dashboards, triaging alerts, and escalating real threats from noise. Building pattern recognition on what normal traffic looks like is the foundational skill.
Key skills
Pay shown is the U.S. Department of Labor prevailing wage for Level I (entry), Level III (mid) and Level IV (senior) in the nearest BLS occupation, base wage for the typical metro, wage year 2025, shown for the main track only. It is a benchmark, not an offer; branches and lead, staff and executive stages have no official figure.
Visual roadmap
Cybersecurity Analyst learning path
Work down the line, one step at a time. Tick each skill as you can do it.
- 1
Networking & Operating System Foundations
6–8 weeksSecurity is built on networking. Master TCP/IP, DNS, HTTP/HTTPS, firewalls, and VPNs. Get comfortable in Linux — most security tools run there. Study the Windows Active Directory environment that attackers target.
Skills to learn
- TCP/IP Model (all layers)
- DNS, DHCP, ARP protocols
- HTTP/HTTPS & TLS/SSL
- Firewalls, NAT & VPNs
- Wireshark (packet analysis)
- Linux CLI (Kali / Ubuntu)
- Windows Active Directory
- Subnetting & CIDR
- Network protocols (ICMP, SNMP)
Start with
- 2
Security Fundamentals & CompTIA Security+
8–10 weeksStudy the core security domains: threats & vulnerabilities, access control, cryptography, PKI, identity management, and risk management. CompTIA Security+ is the industry-standard entry cert and often required by employers.
Skills to learn
- CIA Triad
- Symmetric & Asymmetric Cryptography
- PKI & Digital Certificates
- Identity & Access Management (IAM)
- Multi-Factor Authentication (MFA)
- NIST Cybersecurity Framework
- ISO 27001 awareness
- Vulnerability Management Lifecycle
- Incident Response (SANS PICERL)
- Social Engineering Awareness
Start with
- 3
Threat Detection & SIEM Tools
6–8 weeksLearn to monitor and analyse security events using SIEM platforms (Splunk, Microsoft Sentinel, IBM QRadar). Practice log analysis, alert triage, and threat hunting. Understand the MITRE ATT&CK framework.
Skills to learn
- Splunk (SPL queries)
- Microsoft Sentinel (KQL)
- IBM QRadar
- Windows Event Log Analysis
- Syslog Analysis
- MITRE ATT&CK Framework
- Threat Hunting Methodology
- Alert Triage & False Positive Reduction
- IOC (Indicators of Compromise)
- OSINT Techniques
Start with
- 4
Ethical Hacking & Vulnerability Assessment
8–12 weeksLearn offensive techniques to think like an attacker: network scanning, exploitation, privilege escalation, and web app attacks (OWASP Top 10). Use Kali Linux and tools like Nmap, Metasploit, and Burp Suite in legal lab environments.
Skills to learn
- Kali Linux
- Nmap & Nessus (network scanning)
- Metasploit Framework
- Burp Suite (web app testing)
- OWASP Top 10 (SQLi, XSS, IDOR)
- Password Cracking (Hashcat, John)
- Privilege Escalation Techniques
- Active Directory Attacks (BloodHound)
- CVSS Scoring & Report Writing
- Wireshark for attack analysis
Start with
- 5
Certify, Build Portfolio & Land Your First Role
4–8 weeksPass CompTIA Security+ (and optionally CySA+ or CEH). Document your CTF wins, lab write-ups, and home lab projects on GitHub. Apply to SOC Analyst roles at MSSPs, enterprises, and government contractors.
Skills to learn
- CompTIA Security+ (SY0-701)
- CompTIA CySA+ or CEH
- TryHackMe / Hack The Box Profile
- CTF Competition Write-ups
- Home Lab Documentation
- SOC Analyst Interview Prep
- HIPAA / SOC 2 / PCI DSS basics
- GitHub Portfolio (scripts, tools)
Start with
jobroadmaps.com/roadmaps/cybersecurity-analyst · Pay, demand and employer data for this role are further down the page.
Job Market Insights for Cybersecurity Analyst
Data-backed
Which skills appear most in job postings?
Read from live job postings, ranked from most to least often named.
penetration testing is the most-named skill. Common, but not universal: many postings do not list it.
Past the fundamentals, 1 specialisation skill (penetration testing included) start separating candidates who can do the job from candidates who have done it. The 5 niche skills are named rarely enough that knowing them is upside, not prerequisite.
Skill
How often named
penetration testing
incident response
cloud security
web application security
threat detection
Sorted by how often named · JobRoadmaps
Data-backed
Which tools and artifacts appear most in job postings?
Read from live job postings, ranked from most to least often named.
Cosmos is the most-named tool, but no tool is a universal requirement here.
Industry overlay
Targeting a specific industry?
The core roadmap gets you through the door anywhere. The difference between "qualified" and "they hired someone else" often lives in industry-specific context — the norms, the compliance floors, the tools assumed fluent in that sector.
governance risk and compliance
Enterprise roles emphasize policy, control implementation, and regulatory alignment across complex organizations.
security architecture
Large systems require designing secure solutions and establishing standards that multiple teams follow.
threat modeling
Enterprise architects proactively identify risks in large-scale systems before deployment.
Companies hiring:
PalantirGitLabAppianSnowflakeSOC 2 Type II programme management
B2B SaaS companies must earn SOC 2 to land enterprise deals — security analysts drive the control implementation and audit readiness.
Cloud-native security (AWS/GCP/Azure)
SaaS infrastructure lives in the cloud — IAM policies, VPC design, and GuardDuty/Security Hub are daily tools.
Bug bounty programme management
Security-forward SaaS companies run HackerOne or Bugcrowd programmes — analysts triage, validate, and reward vulnerability reports.
Zero trust architecture
Remote-first SaaS companies replace VPNs with identity-aware proxies — BeyondCorp and SASE implementations are analyst-owned.
Application security (SAST/DAST integration)
Shift-left security means integrating scanners into CI/CD — analysts own the toolchain and triage developer-facing findings.
Companies hiring:
CloudflareOktaCrowdStrikePalo Alto NetworksZscalerIndustry premiums based on aggregated job posting data · Updated quarterly
Interactive
How ready are you right now?
Check the skills you already have to see your current job-market fit.
The most-named skill for this role is penetration testing, so a gap there costs you the most. No single skill dominates, but each gap narrows which postings fit you. Check what you already have to see your biggest current gap.
Readiness Check
Check the skills you already have
0/5
base skills
Your biggest gap: penetration testing, the most often named of the skills you have not ticked.
Start there, then work down the list.
Books worth reading as a Cybersecurity Analyst
Where to start, in order. The full list of 12, grouped by career stage, is on its own page.
Getting started
CompTIA Security+ Study Guide: Exam SY0-701
by Mike Chapple, David Seidl · 2023
Exam-aligned coverage of threats, network and system security, identity, operations and governance. The standard first certification book for this path; work through it alongside a home lab rather than only memorising terms.
View book →
Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
by Chris Sanders · 2007
~370 pages~9 hrs to read
Teaches you to capture traffic, read it and spot what is wrong using Wireshark. Read it early: every alert you triage later rests on knowing what normal packets look like.
View book →
Doing the job
Applied Network Security Monitoring: Collection, Detection, and Analysis
by Chris Sanders, Jason Smith · 2013
~500 pages~13 hrs to read
Walks through the collect, detect and analyse cycle for network security monitoring, with worked investigations. Read it when you are triaging real alerts and want a method behind your hunches.
View book →
Intelligence-Driven Incident Response: Outwitting the Adversary
by Scott J. Roberts, Rebekah Brown · 2017
~280 pages~7 hrs to read
Shows how to fold threat intelligence into the incident response cycle: find, fix, finish, exploit, analyse, disseminate. Fits analysts moving from closing tickets to explaining who is behind an intrusion.
View book →
Senior and leading
How to Measure Anything in Cybersecurity Risk
by Douglas W. Hubbard, Richard Seiersen · 2016
~370 pages~9 hrs to read
Argues for measuring security risk with calibrated estimates and simple quantitative models rather than colour-coded heat maps. Useful when you have to justify budget or report on risk to executives.
View book →
Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan
by Jeff Bollinger, Brandon Enright, Matthew Valites · 2015
~250 pages~6 hrs to read
Describes how to build a security monitoring and incident response program, including playbooks that tie data sources to the threats you care about. For analysts running or designing a SOC.
View book →
All 12 books for a Cybersecurity Analyst →Browse all books →
Some book links are affiliate links: we earn a small commission if you buy, at no cost to you. It does not affect what we list.
Prerequisites & Education
What credentials do employers look for?
These are the most common paths into this role — no single one is required.
Education Level
View list — coming soon- Bachelor's in Cybersecurity, Computer Science, or Information Systems
- Bachelor's in Computer Networking or IT — common entry path via sysadmin roles
- Bachelor's in any discipline with self-study, labs, and relevant certifications
- No degree — certifications and hands-on lab work can substitute, especially for SOC Tier 1 roles
Government and defence contractor roles often require a degree and clearance. Private-sector SOC and security analyst roles are more cert- and skills-gated than degree-gated.
Certifications
View list — coming soon- CompTIA Security+ — the industry-baseline cert, listed in the majority of analyst JDs
- CompTIA CySA+ (Cybersecurity Analyst+) — focused on threat detection and response
- Microsoft Security, Compliance & Identity Fundamentals (SC-900) — entry-level; good baseline for analysts working with Microsoft 365 and Azure environments ($165)
- Microsoft Azure Security Engineer Associate (AZ-500) — covers identity, platform protection, and security operations on Azure; valued at enterprise security teams
- Google Cloud Professional Cloud Security Engineer — validates securing GCP workloads with IAM, VPC, DLP, and Cloud Armor; strong signal for cloud-native security roles ($200)
- Google Cloud Professional Security Operations Engineer — covers threat detection, investigation, and response using Google Security Operations (Chronicle); valued for SOC roles at GCP-heavy enterprises ($200)
- Certified Ethical Hacker (CEH) — widely recognised, especially in mid-market companies
- GIAC Security Essentials (GSEC) — highly respected, more rigorous than Security+
Security+ is the near-mandatory baseline for most analyst roles. AZ-500 is increasingly listed in enterprise security JDs as Azure adoption grows. CySA+ and GSEC carry stronger signal for defensive/blue-team positions.
Bootcamps & Training
View list — coming soon- TryHackMe — gamified, structured learning paths for blue and red team skills
- Hack The Box Academy — hands-on labs covering exploitation, forensics, and detection
- SANS Institute courses — expensive but the most respected technical training in the field
- TCM Security Academy — affordable, practitioner-taught ethical hacking curriculum
Lab-based platforms (TryHackMe, HTB) are viewed positively by security hiring managers — they demonstrate hands-on skill, not just memorisation.
Portfolio & Other
View list — coming soon- Hack The Box profile with 10+ machines compromised and a public rank visible
- TryHackMe profile with Top 5% or Top 1% badge — verifiable in the JD screening stage
- Home SOC lab: pfSense firewall, Elastic SIEM, Suricata IDS — document setup in a blog or GitHub README
- CTF (Capture the Flag) competition writeups published on a personal blog or GitHub
- Any CVE disclosure, bug bounty report, or HackerOne/Bugcrowd acknowledgement
Verifiable lab activity on HTB or TryHackMe is the most effective differentiator at the entry level. A documented home lab setup also signals genuine interest to security hiring managers.
Your Roadmap
5 stepsNetworking & Operating System Foundations
6–8 weeksSecurity is built on networking. Master TCP/IP, DNS, HTTP/HTTPS, firewalls, and VPNs. Get comfortable in Linux — most security tools run there. Study the Windows Active Directory environment that attackers target.
Skills to learn
Security Fundamentals & CompTIA Security+
8–10 weeksStudy the core security domains: threats & vulnerabilities, access control, cryptography, PKI, identity management, and risk management. CompTIA Security+ is the industry-standard entry cert and often required by employers.
Skills to learn
Threat Detection & SIEM Tools
6–8 weeksLearn to monitor and analyse security events using SIEM platforms (Splunk, Microsoft Sentinel, IBM QRadar). Practice log analysis, alert triage, and threat hunting. Understand the MITRE ATT&CK framework.
Skills to learn
Ethical Hacking & Vulnerability Assessment
8–12 weeksLearn offensive techniques to think like an attacker: network scanning, exploitation, privilege escalation, and web app attacks (OWASP Top 10). Use Kali Linux and tools like Nmap, Metasploit, and Burp Suite in legal lab environments.
Skills to learn
Certify, Build Portfolio & Land Your First Role
4–8 weeksPass CompTIA Security+ (and optionally CySA+ or CEH). Document your CTF wins, lab write-ups, and home lab projects on GitHub. Apply to SOC Analyst roles at MSSPs, enterprises, and government contractors.
Skills to learn
Start here this week
This week: set up a home lab. Free-tier VM running Kali Linux, a TryHackMe account, and the CompTIA Security+ study guide. Do two TryHackMe rooms and understand every step of what you did. That's week one. The people who get into security did this kind of thing before anyone was paying them to.
For structured entry, TryHackMe's Security+ learning path and Professor Messer's free Security+ course are the best preparation for the certification exam. After Security+, the OSCP (Offensive Security Certified Professional) is the credential that opens doors at serious security teams — but it requires significant lab time and technical preparation. Build toward it deliberately.
Pay
U.S. Department of Labor data for the nearest BLS occupation, Information security analysts. BLS has no occupation for this exact title, so treat these as a benchmark.
Median: U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics (median wage, May 2024) and Employment Projections (2024–34). Levels: U.S. Department of Labor Office of Foreign Labor Certification prevailing wage levels (wage year 2025, typical metro), a base-wage benchmark for the metro in the middle of 303 areas, not an offer. See every metro.
Job Titles at Each Level
Entry
SOC Analyst / Security Analyst I
Mid
Cybersecurity Analyst / Penetration Tester
Senior
Security Architect / CISO
Steps Overview
- 1
Networking & Operating System Foundations
6–8 weeks
- 2
Security Fundamentals & CompTIA Security+
8–10 weeks
- 3
Threat Detection & SIEM Tools
6–8 weeks
- 4
Ethical Hacking & Vulnerability Assessment
8–12 weeks
- 5
Certify, Build Portfolio & Land Your First Role
4–8 weeks
Explore more roadmaps
Not sure this is the right path? Browse all tech career roadmaps.
View Similar RoadmapsBuilt a project while following this roadmap?
Turn it into a hiring-ready case study in 10 seconds — free.
Ready to explore more?
Browse all career roadmaps across tech, business, and creative fields.