An information security analyst protects an organization's networks, systems and data. Day to day you watch alerts, investigate suspicious activity, scan for vulnerabilities, run risk assessments, manage who has access to what, write security policies, and help respond when something goes wrong. It is a job of reading, thinking, and explaining as much as technical work: you must understand how systems normally behave so you can spot what is abnormal, then explain the risk in plain words to people who are not technical. Most US employers want a bachelor's degree or equivalent proof of skill, an
See the full roadmap free
Every stage from beginner to expert, with lessons, practice drills, projects, interview questions and free resources. Free with a Rolearch account.
Stage 1 of 4 · about 14 weeks
Understand how computers, operating systems and networks work, because you cannot defend what you do not understand. Learn TCP/IP, the OSI model, DNS, HTTP, ports, subnetting, Windows and Linux basics (command line, users, permissions, logs), and the CIA triad (confidentiality, integrity, availability). Do small drills: use Wireshark to capture your own web request and find the DNS lookup, the TCP handshake and the HTTP response; set up a Linux VM in VirtualBox and practice file permissions with chmod. Start learning basic Python or Bash to automate small tasks.
Networking: OSI, TCP/IP, DNS, HTTP, ports and subnetting
Almost every alert you will ever triage is network traffic or a log of it. If you cannot read a packet, a port number or an IP range, you cannot tell normal from malicious.
Linux fundamentals: command line, users, permissions and logs
Most servers, security appliances and tools like Security Onion and Wazuh run on Linux. Fluency at the command line lets you investigate a system quickly and is expected in every security interview.
Windows fundamentals: accounts, permissions, PowerShell and event logs
Most corporate laptops and servers run Windows and Active Directory, so most of the alerts you triage will come from Windows. Knowing what normal looks like is how you spot abnormal.
Security basics and the CIA triad
Every control, policy and alert maps back to protecting confidentiality, integrity or availability. This gives you a vocabulary for explaining risk to anyone.
Scripting basics with Bash and Python
Analysts face thousands of log lines and repetitive checks. Small scripts turn an hour of copy and paste into seconds, and employers notice who can automate.
Then 3 more stages (about 96 weeks in all) with lessons, drills, projects, 10 interview questions with strong answers and free resources.