Skip to content

The First 180 Days

Your First Security Job: The First 180 Days for Students and Career Changers

From knowing nothing to doing useful work, one honest step at a time.

Everyone in security started out knowing nothing about it. Some of them just hide it better. This book is for students and career changers who want a first security job and want to do well once they have it.

It runs in rough time order: getting ready, getting hired, then the first months in the job. Each chapter opens with the questions people tend to keep to themselves, gives plain answers and ends with one thing to practise on PlayCISO.

You do not need to read it in one go. Find the chapter that matches where you are this week and start there.

Start readingRead it on one page

Contents

Getting ready

Learn the basics, pick a direction and build proof that you can do the work.

  1. I don’t know anythingBefore you start
  2. Choosing a first directionMonths before applying
  3. The first cert: what it does and does not doMonths before applying
  4. A first homelabOngoing
  5. Writing a CV and a portfolio of lab resultsWhen you start applying
  6. Job hunting safely: spotting fake recruitersWhen you start applying
  7. The first interviewWhen you get a call back

The first months in the job

You got the job. Now learn the place, ask for help well and check your progress.

  1. The first week in the jobWeek 1
  2. Asking for helpWeeks 1–8
  3. How am I doing?Months 2–4
  4. Choose your path at 180 daysMonths 5–6

Epilogue

What the security industry is not good at, so you do not take it personally, and do not repeat it.

  1. What the industry is not good atAny time

Glossary

Alert
A notification from a security tool that something may need looking at.
Authentication
Checking that someone is who they say they are, for example with a password.
Authorisation
Checking what someone is allowed to do once they are logged in.
Blue team
People who defend systems, detect attacks and respond to them.
Certification
A credential from a provider showing you passed an exam or assessment.
CIA triad
Confidentiality, integrity and availability: the three basic goals of security.
Cloud security
Securing services and data hosted on cloud platforms.
CVE
A public identifier for a known vulnerability.
DNS
The system that turns names like example.com into network addresses.
Escalation
Passing a problem to someone more senior or specialised, with the facts.
Exploit
A method or piece of code that takes advantage of a vulnerability.
False positive
An alert that looks like a problem but is not one.
Firewall
A control that allows or blocks network traffic based on rules.
GRC
Governance, risk and compliance: policies, risk management and audits.
Homelab
A small environment you control for practising security safely.
Incident
An event that harms, or threatens to harm, systems or data.
Incident response
The steps an organisation takes to handle an incident.
IP address
A number that identifies a device on a network.
Least privilege
Giving people and systems only the access they need.
Log
A record of events written by a system, such as logins or errors.
Malware
Software designed to cause harm, such as ransomware or spyware.
MFA
Multi-factor authentication: logging in with more than one proof, such as a password and a code.
Patch
An update that fixes a flaw in software.
Penetration test
An authorised attempt to break into a system to find weaknesses.
Phishing
Messages that trick people into clicking, sharing details or running something harmful.
Port
A numbered endpoint on a device that a network service listens on.
Portfolio
A small collection of write-ups and results that shows your hands-on work.
Ransomware
Malware that locks or steals data and demands payment.
Red team
People who act as attackers, with permission, to test defences.
Risk
The chance that something bad happens, combined with how bad it would be.
Runbook
A written procedure for handling a common task or alert.
Scripting
Writing small programs to automate repetitive tasks.
SIEM
Security information and event management: a tool that gathers logs and raises alerts.
SOC
Security operations centre: the team that monitors for and responds to threats.
Social engineering
Manipulating people into breaking security rules.
Threat
Anything that could cause harm, such as an attacker or a type of attack.
Triage
Sorting alerts or problems by how urgent and serious they are.
Virtual machine
A computer simulated in software, useful for safe testing.
Vulnerability
A weakness that could be used to cause harm.
Zero-day
A vulnerability that is exploited before a fix is available.

Frequently asked questions

How do I get into cybersecurity with no experience?

Learn the foundations, pick a first direction and build hands-on proof with a homelab or online labs. Write up what you do and apply for entry-level and IT roles with a security angle.

Do I need a certification to get a cybersecurity job?

Not always, but a first cert can help your CV pass filters and give your study structure. It works best alongside practical lab work you can show and talk about.

Which cybersecurity certification should I get first?

It depends on your direction and the adverts you are targeting. Common entry points include ISC2 Certified in Cybersecurity, CompTIA Security+ and the Google Cybersecurity Certificate; check each provider’s page for current details.

Can I move into cybersecurity from a different career?

Yes. Many people do. Skills from teaching, healthcare, finance, support and other fields carry over, so describe them plainly and add hands-on security work.

What should I do in my first week in a security job?

Learn the people, the tools and the rules. Read the procedures, sit with colleagues, ask about acronyms and never test or change anything in production without approval.

Other handbooks

Updated 2026-11-14. General guidance, not legal advice. Where a chapter states a law or standard, its sources are listed at the end of that chapter.