Cybersecurity Roadmap for Complete Beginners
The complete path from zero knowledge to job-ready: nine phases, role-specific tracks for SOC, GRC, pentesting, and cloud, a real weekly study plan, and an honest readiness checklist.
Quick answer: Most beginners with no IT background need four to eight months of consistent effort, roughly ten hours a week, across nine phases: fundamentals, choosing a direction, core skills, a certification if it helps your path, hands-on practice, a portfolio, application materials, applying, and interview prep. No site, including this one, can promise you a job or an exact timeline.
Before you start: what “job-ready” actually means
“Job-ready” does not mean knowing everything. It means three specific things: you can explain core fundamentals in plain English without reading from notes, you hold a relevant certification where your chosen path calls for one, and you can point to two to four documented projects that prove you can apply what you’ve learned, not just describe it.
That last part is the one beginners underestimate most. Certifications prove you studied. Projects prove you can do the work. Employers increasingly want both, which is the entire premise of this roadmap.
This page runs long on purpose. If you want a five-minute overview instead of the full detail, the “roadmap at a glance” table just below covers all nine phases and timing without the deeper explanation underneath each one.
The complete roadmap at a glance
| # | Phase | Typical time |
|---|---|---|
| 1 | Learn how computers and networks work | 3–4 weeks |
| 2 | Understand cybersecurity, choose a direction | 1–2 weeks, overlaps with Phase 1 |
| 3 | Build core technical skills | 3–4 weeks |
| 4 | Choose a certification, if it helps your path | 4–6 weeks |
| 5 | Get hands-on with free labs | 2–4 weeks, ongoing after |
| 6 | Build 2–4 portfolio projects | 4–8 weeks |
| 7 | Build resume, LinkedIn, and portfolio | 1–2 weeks |
| 8 | Start applying | Ongoing |
| 9 | Prepare for interviews | Ongoing, intensifies near applying |
These overlap in practice more than the list suggests. Most people are still practicing fundamentals while starting to build their first project, and still applying while continuing to sharpen interview answers.
The nine phases, in detail
Learn how computers and networks work
Before anything security-specific, get comfortable with how devices talk to each other: IP addresses, DNS, ports, and the basic client-server model. Skipping this is the single most common reason later concepts feel confusing.
Start with What Is Cybersecurity? →Understand cybersecurity and choose a direction
Get a working sense of what the field actually involves day to day, then form a rough lean toward SOC, GRC, penetration testing, or cloud security. A lean is enough. You do not need certainty yet.
Build core technical skills
Get functional with the command line on both Windows and Linux. You do not need to be an expert, but you should be able to navigate a filesystem, manage users and permissions, and read basic logs without hand-holding.
Choose a certification, if it helps your path
For SOC, GRC, and Cloud Security, CompTIA Security+ is the standard starting certification. Professor Messer’s free video course covers the current SY0-701 objectives in full and is worth using alongside or instead of a paid course. Penetration testing paths often add a more offense-focused certification later, after Security+.
Get hands-on with free labs
Before building your own project from scratch, practice in a guided, low-stakes environment. TryHackMe’s free Pre Security path is built for exactly this, and its SOC Level 1 and Junior Penetration Tester paths extend into role-specific practice once you’ve chosen a direction.
Build two to four portfolio projects
This is where studying turns into evidence. A SIEM detection build is a strong first project for SOC-leaning paths. Whatever you build, document it clearly enough that a recruiter understands it in under a minute.
Build the Splunk SOC Project → Visit the Portfolio Hub →Build your resume, LinkedIn, and portfolio
Turn your certification and documented projects into materials that actually surface them. A resume that buries your one real project in a bullet point under “additional skills” is wasting the work you already did.
Visit the Interview Hub →Start applying
Begin targeted applications to entry-level roles matching your direction. Track what you apply to and why, so you can spot patterns if response rates are low.
Prepare for interviews
Practice common and scenario-based questions specific to your direction. This should run in parallel with applying, not wait until you get a callback.
What to learn first, by role
The nine phases above apply to everyone, but what you prioritize within them shifts by direction.
| Path | Prioritize | Certification | Free resource |
|---|---|---|---|
| SOC | Networking, Windows event logs, SIEM basics | Security+ | TryHackMe SOC Level 1 path |
| GRC | Risk frameworks, policy writing, compliance basics | Security+, then a GRC-focused certification | NIST Cybersecurity Framework (official docs) |
| Pentest | Linux, basic scripting, web application fundamentals | Security+, then an offense-focused cert later | TryHackMe Junior Penetration Tester path |
| Cloud | Cloud fundamentals, identity and access management, networking | Security+, then a cloud provider security cert | Cloud provider free-tier account and official docs |
The reasoning behind these priorities matters as much as the list itself. SOC-leaning beginners prioritize Windows event logs specifically because that’s the primary data source Tier 1 analysts triage daily. GRC-leaning beginners prioritize frameworks over tools because the job is fundamentally about mapping practice to policy, not operating software. Pentest-leaning beginners prioritize scripting because manual testing doesn’t scale, and automation is what separates a junior tester from someone just clicking through a checklist. Cloud-leaning beginners prioritize identity and access management specifically because misconfigured permissions, not exotic exploits, cause the overwhelming majority of real cloud security incidents.
How to know when to move to the next phase
A roadmap with fixed weeks per phase is a guideline, not a rule. Here’s how to tell you’re actually ready to move forward, rather than just running out the clock on a calendar estimate.
- After Phase 1 (fundamentals): you can explain, out loud and unprompted, what happens when you type a URL into a browser and hit enter, from DNS lookup to the page rendering. If you need notes, spend another week here.
- After Phase 3 (core technical skills): you can navigate an unfamiliar Linux system’s filesystem and check running processes without looking up every command. Fluency, not memorization, is the bar.
- After Phase 4 (certification): you consistently score above 80% on practice exams across multiple question sets, not just one source you’ve partially memorized.
- After Phase 6 (portfolio): you can walk a stranger through any of your projects, what it does and why, in under two minutes without referring to your own documentation.
Moving forward before hitting these markers isn’t fatal, you’ll often reinforce earlier material while working through later phases anyway, but treating them as real checkpoints rather than skippable formalities tends to produce a stronger final result.
Example 10-hour weekly study plan
This is one reasonable way to structure ten hours a week, not the only correct one. Adjust the mix based on which phase you’re in.
| Day | Focus (2 hours) |
|---|---|
| Monday | Fundamentals: video or reading on networking, OS concepts, or your certification objectives |
| Tuesday | Hands-on labs (TryHackMe or similar guided practice) |
| Wednesday | Certification study and practice questions |
| Thursday | Hands-on labs or direct project work |
| Friday | Review the week, revisit weak spots, light practice questions |
Weekends left open on purpose, for catch-up or a longer single session if that fits your schedule better than five weekday hours.
How to know you’re ready to apply
Work through this honestly. If most of these are true, you are ready to start applying, even if you don’t feel fully confident yet.
- You can explain core networking and security concepts in plain English, unscripted.
- You’re comfortable navigating both Windows and Linux from the command line.
- You hold a relevant foundational certification, or can demonstrate equivalent knowledge.
- You have two to four documented, publicly visible portfolio projects.
- Your resume has a dedicated projects section with specific, concrete details.
- You can talk through any project in your portfolio out loud, without notes.
Common beginner mistakes
- Certification hopping. Collecting three or four beginner certifications before building a single project. One solid certification plus real projects beats several certifications with nothing to show for them.
- Tutorial hell. Endlessly watching courses and videos without ever building something yourself. Watching caps out at teaching you vocabulary, not capability.
- Applying too early. Sending applications before having any documented project tends to produce silence, then discouragement.
- Skipping documentation. A project that isn’t written up clearly might as well not exist to a recruiter skimming for thirty seconds.
- Ignoring fundamentals to chase tools. Jumping straight to a SIEM or a specific platform without solid networking and OS basics makes everything downstream harder than it needs to be.
- Studying in isolation. Skipping communities, study groups, or even just posting progress publicly removes a source of accountability and feedback that meaningfully speeds up most people’s progress.
A realistic example: one beginner’s actual eight months
Abstract phases are useful, but seeing them applied to one realistic, composite beginner makes the roadmap concrete. This is not one specific real person, it’s a plausible, honest composite based on common patterns.
| Month | What actually happened |
|---|---|
| 1 | Worked through networking and OS fundamentals in the evenings, about eight hours a week. Slower than the four-week target, work and family commitments cut into study time some weeks. |
| 2 | Still finishing fundamentals while starting to browse career-path content. Leaned toward SOC Analyst after realizing the timeline mattered more than the mild interest in penetration testing. |
| 2–3 | Began Security+ study using free video content, supplemented with practice questions. Took the exam at the end of month three, on the first attempt. |
| 3–4 | Started the Splunk SOC project. The first attempt at the SPL detection search didn’t work as expected, spent an extra weekend debugging before it caught the intended pattern. |
| 4–6 | Built two more projects: a phishing email analysis writeup and a basic home-lab network diagram with documented segmentation decisions. Progress slowed in month five due to a busy period at their day job. |
| 6–7 | Rebuilt resume around the three projects, created a simple portfolio page, and began applying, roughly eight to ten applications a week, targeting SOC Analyst and IT Security Support titles broadly. |
| 7–8 | Landed three interviews after around sixty applications. Practiced scenario questions using the documented projects as talking points. Received an offer for a Tier 1 SOC Analyst role at a managed security provider in month eight. |
Eight months, not six, with a real slowdown in month five and a debugging setback in month four. That’s closer to what “realistic” actually looks like than a clean, uninterrupted six-month sprint, and it’s still a genuine success story.
Setbacks like these are normal, not a sign you’re behind. A stalled month, a failed first exam attempt, a project that doesn’t work the first time, none of these predict whether you’ll eventually get hired. What predicts it is whether you get back to consistent effort afterward rather than treating the setback as proof the plan isn’t working.
What if you already have IT experience?
Compress Phases 1 and 3 significantly, you likely already have this. Move quickly to Phase 2 to confirm a direction, then focus most of your time on Phase 4 through 6, certification, hands-on practice, and a real portfolio. Your existing IT background gets you credibility, not a shortcut around needing demonstrated cybersecurity-specific skill.
Where IT experience helps most concretely: you’ll likely test into Security+ material faster, your interview answers will naturally include real troubleshooting stories interviewers respond well to, and you may be able to skip straight to SOC Analyst rather than needing an IT Security Support stepping-stone role first. Where it doesn’t help as much: general IT experience alone rarely demonstrates security-specific judgment, which is exactly what Phase 6’s portfolio projects are meant to prove.
What if you have no degree?
Follow the roadmap as written. Many entry-level cybersecurity roles, especially SOC Analyst and GRC positions, hire based on certifications, demonstrated skills, and portfolio evidence rather than a specific degree. A degree can help at the margins, particularly for GRC roles tied to formal compliance frameworks, but it is not a prerequisite for most of the paths covered on this site.
If a job posting lists a degree as “preferred” rather than “required,” it’s usually still worth applying with a strong certification and documented portfolio. If it’s listed as strictly required, that’s more often a sign of a rigid HR filter than an actual capability requirement, and it’s reasonable to deprioritize those postings in favor of ones that evaluate skills more directly, which is most of them at the entry level in this field.
Ready to start Phase 1?
Head to the Skills hub to begin with networking fundamentals and the core concepts everything else in this roadmap builds on.
Go to the Skills Hub →Frequently asked questions
How long does it realistically take to become job-ready in cybersecurity?
Most people with no IT background need four to eight months of consistent effort, roughly ten hours a week, to become genuinely job-ready. People with existing IT experience often move faster.
What does job-ready actually mean in cybersecurity?
Being able to explain core fundamentals in plain English, hold a relevant foundational certification where appropriate, and demonstrate two to four documented projects that show you can apply what you’ve learned, not just recite it.
Should I get a certification before or after building projects?
Certification study and your first hands-on project can overlap. Avoid the common mistake of collecting multiple certifications before building a single documented project.
Do I need a college degree to follow this roadmap?
No. Many entry-level cybersecurity roles, particularly SOC Analyst and GRC positions, hire based on certifications, demonstrated skills, and portfolio evidence rather than a specific degree.
Can I follow this roadmap while working full time?
Yes, though the overall timeline typically stretches to six to nine months instead of four to six, depending on how many hours a week you can consistently dedicate.
Is 10 hours a week enough to become job-ready?
Ten hours a week is a realistic, sustainable pace for most beginners and is the basis for the roadmap’s four-to-eight-month estimate. More hours can compress the timeline, but consistency matters more than intensity.