A cybersecurity analyst protects an organization's systems and data by watching for threats, finding weaknesses, and responding when something goes wrong. Day to day you will review alerts in a SIEM, check vulnerability scan results, tune firewall and access rules, write up incidents and policies, and explain risks to non-technical people. This is why the O*NET skills are reading, critical thinking, listening, and writing: the work is half technical and half communication. You build the job in layers. First you learn how computers and networks normally work, because you cannot spot abnormal tr
See the full roadmap free
Every stage from beginner to expert, with lessons, practice drills, projects, interview questions and free resources. Free with a Rolearch account.
Stage 1 of 4 · about 14 weeks
Understand how computers, operating systems, and networks work (TCP/IP, DNS, HTTP, subnetting, Windows and Linux basics, command line), plus core security ideas: the CIA triad (confidentiality, integrity, availability), least privilege, authentication vs authorization, and basic cryptography. Check yourself: explain what happens from typing a URL to the page loading, and capture that traffic in Wireshark.
Computers, operating systems and the Linux command line
Almost every alert you will ever read comes from an operating system. If you know what a process, a file permission and a log file are, alerts stop being mysterious. The command line is how analysts look at systems quickly.
Windows fundamentals
Most company laptops and servers run Windows, and most attacks you will investigate touch it. You need to know where it keeps users, settings and logs.
Networking: TCP/IP, subnetting, DNS and HTTP
Attacks travel over networks, and your evidence is traffic and firewall logs. You cannot judge if a connection is normal unless you know how a normal one works.
Packet analysis with Wireshark
Packets are ground truth. Logs can be wrong or missing, but traffic shows what really happened. Reading a capture also proves you understand networking, not just the vocabulary.
Core security principles
These ideas are the vocabulary every policy, audit and interview uses. They also guide every decision you make when an alert fires.
Basic cryptography
Encryption protects data in transit and at rest, and hashes protect passwords and prove files are unchanged. You will see them in every log, certificate and policy.
Then 3 more stages (about 100 weeks in all) with lessons, drills, projects, 10 interview questions with strong answers and free resources.