RoadmapFreshersCareers

Cyber security roadmap for beginners in India

By Cyber Shikshaa Mentor 3 min read

Most beginner roadmaps fail for the same reason: they list everything. You end up six months in, having watched a hundred hours of video, with nothing you can show and no role you are actually applying for. This roadmap is deliberately narrow.

Step 0: choose a destination first

Cyber security has at least six realistic entry doors in India: SOC operations, network security, identity and access management, GRC, cloud security and application security. Pick one now. You can change later — but a roadmap without a destination is a reading list.

If you are undecided, choose SOC analyst. It has the most open entry-level seats, the shortest ramp, and it exposes you to everything else, so your second move is better informed.

Months 1–2: fundamentals you will use every day

Networking: OSI and TCP/IP, the handshake, DNS, HTTP/S, ports, NAT, VPNs, proxies. Be able to describe what happens when you type a URL and press enter.
Operating systems: Windows processes, services, the event log, Active Directory basics; Linux file system, permissions, processes, /var/log.
Security concepts: CIA triad, authentication vs authorisation, encryption at rest and in transit, hashing, least privilege, defence in depth.

Study out loud. After each topic, explain it to an empty room in two minutes. If you cannot, you have not learned it.

Month 3: attacks and how they look in logs

Learn the common attack patterns — phishing, credential stuffing, privilege escalation, lateral movement, ransomware staging, data exfiltration — and for each one ask the only question that matters in a job: what evidence would I see?

Bring in MITRE ATT&CK here, as a map rather than a memorisation exercise. Practise mapping a described incident to tactics and techniques.

Month 4: build a lab

This is the month that separates candidates. Set up:

A small virtual environment (two VMs is enough — one Windows, one Linux).
A SIEM: Microsoft Sentinel on an Azure free tier, Splunk Free, or the Elastic stack locally.
Log forwarding from both machines into the SIEM.

Then simulate activity you can safely generate on your own machines — repeated failed logins, an unusual scheduled task, a suspicious PowerShell one-liner — and hunt for it.

Month 5: one certification, and only one

For most entry paths in India, one foundational certification is enough to get past resume filters:

CompTIA Security+ — broadest, vendor-neutral, widely recognised.
Microsoft SC-200 — strong signal for Sentinel-based SOCs.
Entry blue-team certifications — practical, hands-on formats favoured by some MSSPs.

Verify current objectives and pricing on the vendor's own site before booking. Do not stack certifications instead of applying — the second certificate rarely beats the first job offer.

Month 6: portfolio, resume, applications

Publish five triage or lab write-ups. Half a page each. Real reasoning, not tutorial screenshots.
Rewrite your resume so the top third is your target role, your tools and your write-ups — not your objective statement.
Apply to thirty targeted roles, not three hundred generic ones. MSSPs, GCCs and IT services security practices are the highest-volume employers of freshers.
Show up in the places hiring managers read: post one write-up a week on LinkedIn.

Detours that cost beginners months

Collecting courses. Three complete courses beat twelve started ones.
Chasing offensive security first. Pentesting roles are fewer and mostly want experience. Blue team is the wider door.
Learning tools without concepts. A tool changes every two years; how DNS works does not.
Skipping communication practice. Interviews are spoken, not written. Freshers with equal knowledge get different outcomes because of how they explain it.
Waiting until you feel ready. You will not. Apply while you learn.

What "ready" actually looks like

You are ready to apply when you can, without notes:

Walk through one alert you triaged end to end.
Explain the incident response lifecycle and where an L1 fits in it.
Describe how you would investigate a reported phishing email.
Talk about one thing you built and what went wrong while building it.

Next step

Test all four out loud. The free 5-question AI mock interview asks exactly this class of question and gives you a readiness score in about eight minutes — a much faster signal than another course.