Your First Security Job: The First 180 Days for Students and Career Changers

Security is a big field with its own language. When you first look at it, it can seem like everyone else speaks it fluently. They do not. Most people know their own corner well and the rest only roughly. The feeling of being behind is common, including among people who have worked in security for years.

The fix is not to learn everything. It is to learn the foundations in a sensible order, then go deeper in one area.

Foundations, in order

1. How computers and operating systems work: files, processes, users and permissions.
2. How networks work: addresses, ports, DNS, how a web page loads.
3. How the web works: requests, responses, cookies, logins.
4. Basic security ideas: confidentiality, integrity, availability, least privilege, authentication.
5. How attacks happen in practice: phishing, stolen passwords, unpatched software, misconfiguration.

You do not need to master each before moving to the next. Get a working feel for each, then circle back.

Learn by doing

Reading and videos give you words. Practice gives you understanding. After you learn a concept, find a way to see it: look at a real log, inspect a web request in your browser, break something in a safe lab. You will remember what you did far better than what you read.

• Keep a simple notes file of what you learned each week, in your own words.
• When you get stuck, write down the exact question. Precise questions get answers.
• Pick a regular time to study. Short and regular beats long and rare.

Rule of thumb:Compare yourself with where you were a month ago, not with someone online who has worked in security for ten years.

Within a few weeks of steady work, the jargon starts to make sense. That is the moment people often mistake for the start. It is actually the first sign of progress.

Security has many kinds of work, and the job titles do not always explain them. The good news is that your first direction is not a life sentence. Many people move between areas, and early experience in any of them is useful in the others.

Some common starting points

How to choose

1. Try a small hands-on task in two or three areas: triage some logs, read a policy, review some code.
2. Notice which one you lost track of time in.
3. Look at real job adverts in your area for that direction. Note the skills that keep appearing.
4. Talk to one person who does the job, if you can. Ask what a normal week looks like.

Rule of thumb:Your previous career is not wasted. Teachers explain things well, nurses triage under pressure, accountants understand controls and audits, support staff know how users really behave. Say so in your applications.

Write your chosen direction down, with one sentence on why. It will guide which cert to take, what to put in your homelab and how to describe yourself on your CV.

If two areas still feel equally interesting, pick the one with more entry-level openings near you or in remote roles you can reach. You can always learn the other one later, and real work experience in either makes the switch easier than starting from scratch.

Certifications cause more anxiety than almost anything else for people starting out. It helps to be clear about what they are for.

What a first cert does

• Gives your study a structure and a finish line.
• Helps your CV pass keyword filters, since many adverts list certs.
• Shows an employer you can commit to learning something and finish it.

What it does not do

• It does not prove you can do the job. Hands-on work shows that.
• It does not replace experience, and employers know the difference.
• More certs is not always better. Two well-chosen ones with practical proof beat a long list with none.

Some well-known entry points

These are examples, not recommendations for everyone. Check each provider’s own page for current details, eligibility, exam format and price before you pay for anything.

• ISC2 Certified in Cybersecurity (CC): ISC2 describes it as entry-level, with no work experience required, covering five domains from security principles to incident response.
• CompTIA Security+: a widely known general security certification. CompTIA moves to a new exam version every few years (its page in November 2026 announced V8), so check which version your study materials cover.
• Google Cybersecurity Certificate: offered on Coursera, and Google says no prior cybersecurity experience is required.

Rule of thumb:Never type a price or pass mark from a forum post into your plans. Providers change them. Read the provider’s own page on the day you book.

If you are interested in AI security, look at the provider pages for AI certifications too, and check how new and recognised each one is in the job adverts you are targeting. See the AI certifications directory for a list with sources.

Whatever you choose, plan your study around hands-on practice as well as exam questions. Each time a topic comes up, look for a way to see it in a lab. That way you finish with a cert and with stories you can tell in an interview about things you actually did, which is what interviewers tend to ask about.

A homelab is a small environment you control, where you can install systems, attack them, defend them and break them without hurting anyone. It is where reading turns into skill, and it gives you something real to talk about in interviews.

Start small

• An old laptop or your current computer running a few virtual machines is enough to begin.
• Free virtualisation software and free operating systems cover most early projects.
• Browser-based labs need no setup at all and are a good first step.
• Cloud free tiers can work, but set billing alerts before you start.

Rule of thumb:Only attack systems you own or have written permission to test. Scanning or attacking someone else’s systems without permission can be a crime, even when you mean no harm.

Projects that teach a lot

1. Set up a small network with two or three virtual machines and get them talking.
2. Turn on logging and find your own logins in the logs.
3. Run a deliberately vulnerable web application and find a flaw in it.
4. Collect logs in one place and write a simple alert for a failed-login burst.
5. Attack your own setup, then check whether your logs and alert caught it.

Pick projects that match your direction. For a SOC role, spend more time on logs and alerts. For AppSec, more time on vulnerable apps and code. For cloud, a free-tier account with careful permissions.

Write it up

For each project, write a short page: what you set out to do, what you built, what went wrong and what you learned. Include screenshots. These write-ups become the portfolio you will use in the next chapter, and they show employers how you think.

Keep your lab separate from anything you rely on. Use a dedicated virtual network, avoid reusing real passwords and take snapshots before big changes so you can roll back. Treat it the way a careful employer would treat a test environment. That habit will matter in your first job, where test and production must never be confused.

Without security work experience, your CV has to show something else: that you can learn, that you have done hands-on work and that you understand what the job involves. A portfolio of lab results does a lot of that work for you.

CV basics

• Keep it short and easy to scan. Put the most relevant things first.
• Match the words in the advert where they truthfully describe you. Many applications pass through keyword filters.
• Describe what you did and what happened, not just your duties.
• Include certs earned or in progress, with an expected date.
• Link to your portfolio near the top.

Turning past work into security language

Most jobs have security-adjacent parts. Did you handle customer data carefully, follow a process under pressure, train others or spot something that looked wrong? Describe those plainly. Do not stretch them into claims you cannot back up in an interview.

What goes in a portfolio

1. Three to five write-ups from your homelab or online labs, each one page.
2. For each: the goal, what you did, what you found and what you would do differently.
3. Scorecards or certificates from labs you completed, with a sentence on what they tested.
4. One piece of writing that explains a security topic to a non-expert.

Rule of thumb:Never put real company data, client names or anything from an employer’s systems in a portfolio. Use your own lab and invented data only.

Ask someone to glance at your CV briefly and tell you what they remember. A first look is often quick. If they cannot say what job you want, rewrite the top.

Keep one master CV with everything on it, then trim a copy for each application so the most relevant work sits at the top. It takes a little longer per application, but a CV that clearly matches the advert is far more likely to reach a person than a generic one sent everywhere.

People looking for work are a known target for scams. Some fake recruiters want money, some want personal details for identity fraud and some send coding tests or meeting software that installs malware. As someone entering security, spotting these is also good practice.

Warning signs

• An offer or interview with almost no process, or pay that seems far above the role.
• Requests to pay for training, equipment or a background check before you start.
• A recruiter who only uses personal email or messaging apps and avoids video calls.
• Pressure to act quickly or keep the process secret.
• A coding test that asks you to clone a repository and run it, especially with install steps.
• Requests for bank details, ID documents or passwords early in the process.

Checks that take five minutes

1. Find the job on the company’s own careers page, reached by typing the address yourself.
2. Check the recruiter’s profile history and whether colleagues at the company know them.
3. Contact the company through its official channel and ask whether the role is real.
4. Search the recruiter’s name and the company with the word scam.

Rule of thumb:A real employer does not ask you to pay to get a job. If money flows from you to them, stop.

If you think you have been targeted, stop responding, keep the messages and report the profile to the platform. If you ran something, disconnect that machine, change passwords from a different device and get help. Writing up a scam attempt you spotted, with personal details removed, can also make a good portfolio piece.

None of this means every unusual approach is a scam. Small companies and busy recruiters sometimes cut corners. The point is to verify before you trust, the same habit you will use every day in a security job. A real employer will not mind you checking, and a scammer usually will.

Your first security interview will probably feel harder than it is. For entry-level roles, interviewers are usually looking for three things: basic knowledge, how you think through a problem and whether you would be good to work with.

What to prepare

• Your story: why security, why this direction, why this company. Two minutes, out loud.
• Three or four examples from labs, study or past work that show how you solve problems.
• The basics for your direction. For SOC roles: common attacks, what logs show, what you would do with a suspicious alert.
• Something about the company: what it does and what security problems that might bring.

Answering technical questions

You will be asked things you do not know. That is often the point. Interviewers want to see what you do at the edge of your knowledge.

1. Say what you do know that is related.
2. Think out loud about how you would find the answer.
3. Be honest that you have not done it before, if you have not.
4. If you work it out later, it is fine to mention it in a thank-you note.

Questions to ask them

• What does a normal week look like for someone in this role?
• How do new people learn? Is there someone to ask?
• What would make someone successful here in the first six months?

Rule of thumb:Practise out loud, ideally with another person or a recording. Answers that sound clear in your head often come out tangled the first time you say them.

After each interview, write down the questions you were asked and how you answered. Patterns appear quickly, and your next interview will be easier for it.

Finally, plan the practical details the day before: the time zone, the link or address, your camera and microphone if it is online, and a glass of water. Small problems at the start can shake your confidence, and they are the easiest ones to prevent. Arrive a few minutes early and take a breath before you begin.

Your first week in a security job is mostly about orientation. You will get accounts, meet people, read documents and watch others work. It can feel slow. That is fine. Your manager is not expecting much output yet.

What to focus on

1. Learn who is who: your manager, your team, who you go to for each kind of question.
2. Learn the tools you will use every day, starting with the ones your team mentions most.
3. Read the runbooks or procedures for your main tasks, even if they are out of date.
4. Sit with a colleague while they work, and ask why they do each step.
5. Find out the rules: what you may do alone, and what needs approval.

Access and responsibility

Security staff often get more access than most new starters: logs, alerts, sometimes sensitive data. Treat it carefully. Look only at what your work needs. If you are unsure whether something is allowed, ask before you do it.

Rule of thumb:Never test, scan or change anything in production without explicit approval, even if your account technically allows it. Having access is not the same as having permission.

Small wins

• Fix something small in the documentation that confused you.
• Write up what you learned each day in a few lines.
• Ask your manager what good looks like at one month and three months.

At the end of the week, write down three things you understand now that you did not on Monday. It will feel like less than you hoped, and it is more than you think.

Expect some things to be messy. Documentation may be out of date, tools may not match what you learned and people may be too busy to explain everything at once. That is normal in almost every security team. Note the gaps you find. Later, when you understand them, fixing one is an easy way to be useful.

New people often wait too long to ask for help, because they worry it shows they do not belong. In security, waiting can make things worse. An alert you sit on, unsure, could be the start of a real incident.

A simple rule

Try on your own for a set time, then ask. Fifteen to thirty minutes is a common rule of thumb for ordinary problems. For anything that might be a live security incident, ask straight away. Your team would much rather check a false alarm than miss a real one.

How to ask a good question

1. Say what you are trying to do.
2. Say what you already tried and what happened.
3. Share the exact error, alert or log line.
4. Say what you think is going on, even if you are unsure.
5. Ask a specific question.

A question in this shape takes less time to answer and shows that you did the work first. People who ask this way are rarely seen as needy, whatever their experience.

Escalating an alert

• Say what you saw and when.
• Say why it worries you.
• Say what you have checked and what you have not.
• Ask what they want you to do next.

Rule of thumb:Escalating something that turns out to be harmless is part of the job. Nobody gets in trouble for raising an alert in good faith. Hiding one is a different matter.

Find a mentor if you can, formally or not: someone a little ahead of you who does not manage you. They can answer the questions you would rather not ask your manager, and help you see when you are doing better than you feel.

Pay attention to how your team prefers to be asked. Some like a chat message, some a ticket, some a quick call. Some prefer questions batched at a set time each day. Matching their habits makes it easier for them to say yes, and it shows that you are paying attention to how the team works.

Around month two or three, many new starters wonder whether they are doing well. Silence from a manager can mean things are fine, or it can mean they are busy. Do not guess. Ask.

Ask for feedback directly

• What is one thing I am doing well that I should keep doing?
• What is one thing I should do differently?
• What would you expect me to be able to do alone by month six?

Ask these in a regular one-to-one, not in passing. Write down the answers and come back to them a month later.

Track what you can do alone

Fill in a table like this with the tasks from your own role. Move each task to the right as you go. It is a far better measure of progress than how confident you feel on a given day.

Picking the next skill

Look at where you most often need help. That is your next learning target. It might be a tool, a type of investigation, scripting or writing. Learning what your job needs now beats chasing the next cert for its own sake.

Rule of thumb:Keep a running list of things you did and helped with. When review time comes, you will not remember them otherwise.

Remember that confidence and competence grow at different speeds. Many people feel least sure of themselves just as they are getting good, because they now understand how much there is to know. If your table shows tasks moving to the right, you are making progress, whatever your confidence says on a bad day.

If your manager is hard to pin down, send a short written update every couple of weeks: what you worked on, what you learned and where you got stuck. It takes ten minutes, it gives them something specific to respond to and it builds the record you will need when review time comes.

Six months in, you have seen real work. You know which parts you enjoy, which you tolerate and which drain you. That is good information. Use it to choose what the next six months are for.

Three honest options

• Go deeper in your current area: take on harder tasks, aim for the next level of responsibility.
• Broaden out: learn an adjacent area, such as cloud for a SOC analyst or scripting for a GRC analyst.
• Change direction: if the work truly does not suit you, plan a move, ideally inside the same company first.

Questions to help you decide

1. Which tasks did you look forward to? Which did you put off?
2. Which colleagues’ work did you find most interesting?
3. What did your manager say you are good at?
4. Which skills keep appearing in adverts for the role you would want in two years?

Make a small plan

• One skill to build in the next three months.
• One project at work that would stretch you, agreed with your manager.
• One thing to stop doing, so there is time for the other two.

Rule of thumb:Talk to your manager before you talk to recruiters. Many managers would rather help you grow into a new area internally than lose you.

Whatever you choose, keep the habits that got you here: hands-on practice, writing things up and asking good questions. They work at every stage.

Write your decision down and share it with your manager, so they can point opportunities your way. A goal that only lives in your head is easy to drift away from when work gets busy. A goal your manager knows about tends to turn into projects, introductions and the occasional stretch task that moves you forward.

There is no deadline on any of this. Some people know their path at six months, others take a few years. What matters is that you choose on purpose rather than drift, and that you review the choice now and then as you learn more about the work and about yourself.

If getting into security has felt harder than it should, part of that is not you. The industry has habits that make it harder for newcomers than it needs to be. Naming them helps you keep going, and helps you avoid passing them on.

Gatekeeping

Some people treat security as a club with secret entry rules: you must have started young, must have a certain background, must know a particular tool. None of that is true. People enter from many paths, and the field needs that variety.

• Ignore advice that says there is only one right path.
• Find communities that answer beginner questions kindly. They exist.
• When you are more experienced, answer beginners the way you wish you had been answered.

Jargon

Security is full of acronyms and terms that sound harder than the ideas behind them. Sometimes jargon is useful shorthand. Sometimes it is a way to sound expert. Either way, it locks people out.

• Ask what a term means, every time, until you know.
• Explain things in plain words yourself. It is a skill employers value.
• Be suspicious of explanations that only work if you already understand them.

Job adverts

Some entry-level adverts ask for years of experience or long lists of certs. Often these are wish lists, not hard rules. If you meet a good part of the list and can show relevant hands-on work, it is usually worth applying.

Rule of thumb:You belong here if you are curious, careful and willing to keep learning. That is most of what the job asks.

Six months from now, someone will be where you were when you opened this book. Help them. It costs little, and it is how the field gets better.

It also helps to remember that the people who seem most confident online are a small and loud part of the field. Most security work is done quietly by people who were beginners not long ago, who still look things up every day and who are glad when someone new joins and asks good questions.