Whatever else you do, homelabbing and/or coding on private projects on the side will do you well. Try to go small. Holds at literally any level.
this post was submitted on 19 Feb 2026
12 points (87.5% liked)
cybersecurity
5915 readers
14 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 2 years ago
MODERATORS
Depending on your field, your business may already have a cybersecurity department. There's an endless parade of thankless grunt work to be done like patching (often after hours), following up with users whose machines didn't patch for whatever reason, and so on. (With your manager's permission) you may be able to reach out to them and volunteer to help with some of those tasks, as a way to dip a toe into that world and start learning.
Not in NL, but these are some helpful career progression flow charts: https://roadmap.sh/devops https://roadmap.sh/cyber-security
This one is a map of cyber security certifications that are out there: https://pauljerimy.com/security-certification-roadmap/
These things look big and intimidating but that's okay, I work in cyber security and there's stuff on these that I don't know. I feel like at least having a starting place and a path to follow can be really helpful especially if you don't know where to start.
Also, Cyber Security is a huge field, do you want to do offensive cyber or defensive cyber? More hands-on-keyboard or more policy based? You mentioned that you wanted that you want to end us as a CISO, some of the best that I know where techs and do-ers first, definitely get some hands on experience before jumping to a policy-level position.
The most important thing about Cyber Security as a career field is to keep learning! Good luck!
Thank you for taking time to respond! I think Defensive Blue Team as a whole outlook for me. I don't want to hurt anybody. Ethical side for me.
There's also ethical offensive cyber: penetration testing apps/services with permission from the owner to find weaknesses and vulnerabilities so that they can implement fixes, or red-teaming which is basically pretending to be a threat actor and testing an organization's overall security posture.
Get into Governance, risk and compliance. Offensive cyber are the sexy jobs, but GRC makes CISOs, and is infinitely in demand.
Thank you for chiming in!
In the US, the cert most often expected is sec+.
Generally you should look at job listings and work backwards from there. Most companies use software like nessus and splunk, and there are plenty of free alternatives to those and others that you can play around with.
Competency in networking (firewall rules/acls, routing, subnetting) and programming (python, powershell, bash, batch script) are a big benefit.
Thank you for taking the time to respond! Much appreciated!
@LOLseas I just responded to a similar question with a bunch of my own resources/write-ups here if you’re interested in reading through: https://infosec.pub/post/41793111/20452001
Very much interested, thanks!