Cybersecurity Career Roadmap for Beginners

Start with systems knowledge and responsible scope. Cybersecurity learning should help you protect systems and communicate risk. Access to a website is not authorisation to test it. This roadmap is for beginners in India, including freshers from non-IT backgrounds, and for IT support or network professionals moving towards security. Every practical exercise in it happens only with written permission, in an isolated lab, on systems you own or are explicitly authorised to test. Unauthorised access to a computer system is an offence under India's Information Technology Act, 2000, regardless of intent.

Stage 0: Prerequisites

You need a laptop that can run virtual machines, a willingness to read documentation and the patience to do defensive work that is not dramatic. Programming is not required to start, but you should be comfortable with a terminal. Begin with Linux basics; the Linux Foundation's free Introduction to Linux course covers users, permissions, processes and logs, all of which security work depends on.

You are ready to move on when you can explain what a user account, a file permission and a running process are, and find each on a Linux machine.

Stage 1: Foundations, how systems work

Study operating systems, accounts, networking, DNS, TLS and HTTP. Practise explaining the difference between authentication and authorisation with an example. Learn what a log is, where common services write them and what a normal entry looks like, because you cannot spot abnormal until you know normal.

Your first milestone is a diagram of a small local application showing users, services and access boundaries. Identify what should be public and what should remain restricted.

TryHackMe offers free introductory rooms on networking, Linux and security fundamentals that run in the browser, so you are not touching anyone else's systems. The Linux Foundation's free intro courses and the official documentation for the services you run are the other resources at this stage.

You are ready to move on when you can read an authentication log and point to the lines that show a failed login, a successful login and a change of privilege.

Stage 2: First project, an isolated lab

Build an isolated lab on your own machine. Run an intentionally vulnerable training application such as OWASP Juice Shop inside a virtual machine or container, disconnected from public networks, with synthetic accounts only. Write a scope statement first, naming the environment, the permitted activity and the stopping conditions. If an exercise reaches outside that scope, stop rather than extend the test. This habit is what employers look for.

Use OWASP's list of the ten most common web application risks to guide what you look at, but do not treat a list as a complete security assessment. For each finding, record what you did, what you observed and what you could not confirm. Then fix the finding in the lab where possible and retest.

OWASP's project pages and the Juice Shop documentation are free. PortSwigger's Web Security Academy is free and gives you labs that are designed to be attacked, so you never need to touch a system you do not own.

You are ready to move on when you have one written finding with evidence, a proportionate fix and a retest log, and your scope statement was never crossed.

Stage 3: Depth, defensive checks and reporting

Learn defensive checks: inspect permissions, configuration, patch levels and available logs on a host you own. Learn what a tool's alert means and when it is wrong; a clean result does not establish that a system is secure, and an alert needs interpretation before anyone acts on it.

Practise the SOC analyst's basic loop: an alert arrives, you gather context, decide whether it is a real incident, and write it up with the evidence. Use MITRE ATT&CK, which is free, as a vocabulary for describing attacker behaviour. Write one investigation of a simulated event in your lab, including one false alarm and how you assessed it.

For one authorised finding, write a report describing the affected component, the observed behaviour, the potential impact and a proportionate correction. Sanitise evidence before sharing. Do not publish personal information, secrets or details from systems you lack permission to discuss.

You are ready to move on when another person can read your report and reproduce the finding in the same lab, and your false alarm write-up explains clearly why it was not an incident.

Stage 4: Interview readiness

Prepare to explain your lab, your scope statement and your report. Expect questions on networking, authentication, common web risks, log reading and what you would do when an alert fires. Expect to be asked how you handle something you find by accident outside scope; the right answer is to stop and report it. Our companion guide on cybersecurity interview questions for freshers covers the common questions.

Foundational certifications can help a fresher's profile get read, but interviewers will probe the lab you built. The free resources named here do not require a certificate.

You are ready when you can be questioned about your lab for twenty minutes and your answers stay inside what you actually observed.

Realistic first roles in India

Security operations centre analyst at level one is the usual entry into security in India, often inside IT services companies and managed security providers, and often with shifts. Other starting points are IT security support, identity and access administration, vulnerability management support and compliance support. Penetration testing, incident response and security engineering roles usually require experience in one of these first, or prior work in system administration, networking or development. Whatever the role, all practice must be on authorised targets; a portfolio built on unauthorised testing ends a candidacy rather than helping it. We do not quote salaries or hiring numbers.

Mistakes beginners make

• Testing a real website "just to learn". It is unauthorised, it is an offence, and it is disqualifying.
• Collecting tools and screenshots instead of writing one clear finding with evidence.
• Treating OWASP's list or a scanner result as a complete assessment.
• Skipping Linux, networking and logs to jump to exploitation.
• Describing a lab exercise as if it were a real engagement.

What to put in your portfolio

Deliver a scope statement, a lab architecture diagram, one finding report with sanitised evidence, a defensive checklist you applied to your own host, a retest log and one simulated-alert investigation including a false alarm. Add a README stating that everything was done in an isolated lab you own. The goal is evidence-based judgement, not dramatic screenshots. Responsible boundaries and clear documentation are part of the technical work.

How GullyMentor approaches it

On the cybersecurity track (/career-tracks/cybersecurity) a mentor sets an authorised lab exercise, reviews your scope statement, your finding and your report, and then rehearses interview scenarios with you. All practice is on your own isolated lab or an explicitly authorised platform; we never set exercises against live systems. We sell no courses. We do not guarantee jobs, interviews or salaries.

Sources & further reading

• OWASP Top Ten
• OWASP Juice Shop authorised learning environment
• Linux Foundation: Introduction to Linux (free course)
• TryHackMe (free rooms available)
• PortSwigger Web Security Academy (free)
• MITRE ATT&CK

Examples and practice recommendations are educational illustrations. Tool documentation and programme inclusions should be checked for your intended use.