Cybersecurity

Level by level: what to learn and do

1. 1

   Starting out

   0–1 year

   IT support · Junior IT security assistant

   What you do

   Work in IT while learning security: handle phishing reports, password resets, MFA setup, patching and device security.

   Skills to learn

   • Networking and operating system basics
   • The CIA triad and common attacks
   • Phishing and social engineering
   • Reading logs

   Certifications to consider: CompTIA Security+ or ISC2 Certified in Cybersecurity (CC)

   To reach the next level: Practise in free blue-team labs and apply for SOC analyst roles.

2. 2

   SOC analyst (tier 1)

   0–2 years

   SOC analyst · Security monitoring analyst

   What you do

   Watch security alerts in a SIEM, decide which are real (triage), gather evidence and escalate genuine incidents.

   Skills to learn

   • SIEM tools and log analysis
   • Windows event logs and endpoint alerts (EDR)
   • Email and phishing analysis
   • The MITRE ATT&CK framework
   • Writing clear incident notes

   Certifications to consider: CompTIA CySA+

   To reach the next level: Learn to investigate fully rather than just escalate, and start scripting.

3. 3

   Security analyst or engineer

   2–5 years

   SOC analyst tier 2 · Incident responder · Security engineer

   What you do

   Investigate and contain incidents, tune detections, run vulnerability management and manage security tools such as firewalls and EDR.

   Skills to learn

   • Incident response process
   • Threat hunting and detection rules
   • Vulnerability scanning and patch prioritisation
   • Firewall and endpoint security management
   • Python or PowerShell for automation

   Certifications to consider: GIAC GCIH; CompTIA PenTest+ or OSCP if you move into penetration testing

   To reach the next level: Choose a specialisation: defence, offence, cloud, application security or governance.

4. 4

   Senior specialist

   5–8 years

   Senior security engineer · Penetration tester · Threat hunter · Forensic analyst

   What you do

   Lead major incidents, run penetration tests or red-team exercises, build detection programmes and mentor others.

   Skills to learn

   • Deep expertise in your specialisation
   • Attack simulation or digital forensics
   • Security architecture reviews
   • Reporting to management

   Certifications to consider: ISC2 CISSP; OSCP or GIAC certifications in your specialisation

   To reach the next level: Learn risk, governance and how security decisions affect the business.

5. 5

   Architect and leadership

   8+ years

   Security architect · Security manager · CISO path

   What you do

   Set security strategy, policies and budgets, manage risk and compliance, lead teams and report to senior leadership.

   Skills to learn

   • Security architecture and Zero Trust
   • Governance, risk and compliance (GRC)
   • Policy writing and audits
   • Leadership and budgeting

   Certifications to consider: ISC2 CISSP, ISACA CISM, CompTIA SecurityX

   To reach the next level: Lead security as a business function, not only a technical one.

Years of experience are typical ranges, not rules: some people move faster, others take longer. Certification names and versions change, so always check the exam provider's website before you book.