Cybersecurity careers and certifications
Understand the main cybersecurity roles, which skills each needs, how entry-level certifications fit, and how to build public proof of skill. A practical map for developers and students.
Cybersecurity is a wide field with many different jobs. Some are about writing code, some about watching alerts, some about policy and audits. This lesson maps the main roles, the skills each one needs, which certifications are worth considering and in what order, and how to build proof of skill without a degree in security. We do not quote salaries because they change by city, company and year; check current job listings.
The main career paths
Common roles
| Role | What you do day to day | Good background |
|---|---|---|
| SOC analyst (security operations) | Watch alerts and logs, investigate suspicious activity, escalate incidents | Networking, Linux, Windows basics, patience with logs |
| Application security engineer | Review code, threat-model features, run scanners, help developers fix flaws | Software development; this track is a good start |
| Penetration tester (ethical hacker) | Test systems with permission and write reports | Web, networks, scripting, clear report writing |
| Cloud security engineer | Secure AWS, Azure or GCP: identity, networks, configuration | Cloud and DevOps skills |
| Incident responder and forensics | Handle breaches, collect evidence, find root cause | Operating systems, networking, careful documentation |
| GRC (governance, risk and compliance) | Policies, audits, risk registers, standards such as ISO 27001 | Process thinking, writing, less coding |
| Security researcher / malware analyst | Study vulnerabilities and malicious software in depth | Programming, reverse engineering, curiosity |
| DevSecOps engineer | Build security checks into CI/CD pipelines | Developer plus operations skills |
Job titles differ between companies, so read what the job actually asks for. Smaller companies often ask one person to do several of these. Many security people start in IT support, software development, networking or system administration and move across. You do not need to choose a final path now.
Which path suits you
Match interests to roles
| If you like... | Look at... | Next lesson to revisit |
|---|---|---|
| Building software | Application security, DevSecOps | *The OWASP Top 10 explained*, *Security testing tools: ZAP, Semgrep and Trivy* |
| Breaking things to understand them | Penetration testing, research | *Practise legally: CTFs and labs* |
| Watching systems and solving puzzles from clues | SOC, incident response | Networking and Linux basics |
| Cloud platforms | Cloud security | Cloud and DevOps tracks |
| Rules, documents and audits | GRC | *The security mindset and threat modelling* |
The same tracks help: you can learn networking and Linux through the Cloud and DevOps track, Python through Backend Development, and writing secure code from the earlier lessons in this track.
Core skills to build
Skills almost every security role uses
- Networking: IP, DNS, HTTP and HTTPS, TCP versus UDP, what a firewall does.
- Linux command line and one scripting language (Python or Bash).
- How the web works: cookies, sessions, JWTs, headers, APIs.
- The OWASP Top 10 and how to fix each one in code.
- Cryptography basics: hashing, encryption, TLS, and what not to build yourself.
- Identity and access: authentication, MFA, least privilege.
- Reading logs and basic incident thinking.
- Writing clearly. A security report that nobody understands changes nothing.
Certifications: what they are for
A certification is proof that you passed an exam from a provider. Some hiring managers use them to filter CVs, especially for entry-level and government or services-company roles, but projects and demonstrated skills matter too. Fees, exam names and rules change, so always check the official page. Never pay for a certification before you know a specific job or employer values it.
Certifications at different levels
| Certification | Provider | Who it suits | Notes |
|---|---|---|---|
| Google Cybersecurity Certificate | Google, on Coursera | Complete beginners | A course programme with a certificate; Coursera may offer financial aid. Check the page for details |
| ISC2 Certified in Cybersecurity (CC) | ISC2 | Complete beginners | Entry-level exam. ISC2 has run free training and exam programmes; check whether one is currently open |
| CompTIA Security+ | CompTIA | Freshers and early-career, widely recognised | Broad foundations; an exam fee applies |
| CompTIA Network+ | CompTIA | People starting from networking | Good base before security roles |
| Certified Ethical Hacker (CEH) | EC-Council | Often named in Indian job posts | Exam fee applies; check eligibility rules on the official page |
| eJPT | INE Security | Beginners to practical penetration testing | Hands-on exam; check the current name and fee |
| OSCP | OffSec | Experienced learners who want to prove hands-on pentesting | Hard, practical exam; fee applies |
| AWS Certified Security - Specialty | Amazon Web Services | People with cloud experience | Recommended after cloud basics |
| CISSP | ISC2 | Experienced professionals | Requires years of work experience to be fully certified |
A simple order for a fresher: learn the skills first, then pick one broad entry certificate (Google Cybersecurity Certificate, ISC2 CC or Security+), then a specialist one that matches the role you want (CEH, eJPT or OSCP for testing; a cloud security certificate for cloud). Check that the exam name is still current before you plan, as providers rename and retire exams.
Build proof of skill
A portfolio plan
- 1Complete CTFs and labs (see *Practise legally: CTFs and labs*) and keep a write-up for each in a public GitHub repository.
- 2Secure one of your own projects: add input validation, rate limits, secrets in environment variables, dependency audits and a CI scan. Document what you changed in the README.
- 3Run Semgrep and Trivy on an open-source project you use and learn how maintainers fix the issues. Do not publish vulnerabilities that are not yet fixed; report them privately to the maintainers.
- 4Write short blog posts explaining one concept in plain language, such as how SQL injection works and how to prevent it.
- 5Join a local security club or an online community, enter student CTFs and learn from write-ups.
- 6Apply for internships. Developer, IT support and network roles are good entry points to security, too.
Security in India: what to know
India has a growing demand for security professionals in IT services, product companies, banks and fintech, and government. India's national cyber-security agency is CERT-In. Data protection rules such as the Digital Personal Data Protection Act, 2023 and sector rules (for example from RBI for banks) create demand for GRC and privacy roles. Some work needs background checks or has restrictions, for example government and defence roles. Check each employer's requirements.
How this comes up in interviews
For security or developer roles you may be asked "Why security?" and "How do you keep up to date?". Good answers are concrete: a lab you completed, a project you hardened, a write-up you published, a news item you followed and what you learned. Interviewers often care more about how you reason ("what could go wrong here, and how would we limit it?") than about tool names. You can practise this with InterviewAI's mock interviews.
I am [a final-year B.Tech student / a working developer / a BCA graduate] with skills in [list your skills]. I am interested in [roles from the lesson, or 'not sure']. I can study [hours per week] hours a week for the next [number] months. Make a month-by-month plan with: skills to learn, 2 or 3 free resources per month, one portfolio project per phase, and when a certification makes sense. Mark any claim about exam fees or names with 'verify on the official page'.What to expect: Check the plan against current job listings for the role you want, and verify every certification detail on the provider's website.
Try it: Read five job posts
Find five security-related job posts (for example application security engineer, SOC analyst, cloud security). Make a table of the skills and certifications that appear in at least three of them. Compare it with your current skills.
Try it: Write a 90-day plan
Choose one role from this lesson. Write a 90-day plan with weekly goals, one portfolio project and one certification decision (take it, or not yet, and why).
Key takeaways
- Security has many paths: SOC, application security, pentesting, cloud security, incident response, GRC, research and DevSecOps.
- Developers have a head start in application security and DevSecOps.
- Core skills: networking, Linux, scripting, web fundamentals, the OWASP Top 10, identity and clear writing.
- Certifications help to get past CV filters, but check the official page for current names, fees and eligibility, and match them to a target role.
- Proof of skill matters: CTF write-ups, a secured project, blog posts and responsible, legal practice.
- Interviews reward clear reasoning about risk, not tool name-dropping.
Check yourself
Finishing the quiz marks the lesson as done.
1. You enjoy building web apps and want to move toward security. Which role is the most natural fit?
2. What is the best first step before paying for a certification?
3. Which activity best proves practical skill to an employer?
4. Which role mainly handles policies, audits and standards such as ISO 27001?
5. Why are salary numbers not given in this lesson?
Saved on this device. Create a free account to keep it on every device.
Practise this with Sam
A real mock interview, out loud, with an honest scorecard. Free to start.