An Information Security Engineer builds and maintains the defenses that keep a company's systems and data safe: firewalls, encryption, logging, access controls, and the plans for when something goes wrong. You will also test those defenses by scanning for weaknesses, investigate breaches, and teach colleagues safe habits. This roadmap works because each stage builds on the last: you first learn how computers and networks work (you cannot defend what you do not understand), then how attackers break them, then how to build controls that stop them, then how to design security for whole organizati
See the full roadmap free
Every stage from beginner to expert, with lessons, practice drills, projects, interview questions and free resources. Free with a Rolearch account.
Stage 1 of 4 · about 16 weeks
Understand how computers, operating systems and networks work. Learn Linux command line, TCP/IP, DNS, HTTP, and basic Python and Bash scripting. Set up a home lab with virtual machines. Learn the CIA triad (confidentiality, integrity, availability) and why least privilege matters.
Computer and operating system fundamentals plus a home lab
Every security control protects something running on a computer. If you do not know what a process, a file permission or a service is, you cannot tell normal from suspicious. A lab also gives you a safe place to break things, which is how security engineers learn.
Linux command line
Most servers, firewalls, security tools and cloud machines run Linux, and you will work in a terminal daily. Logs, permissions and processes are the evidence you read during investigations.
Networking: TCP/IP, DNS and HTTP
Attacks and defenses travel over the network. To judge whether traffic is normal, block the right port, or understand an alert, you must know how a request actually moves from a browser to a server.
Bash and Python scripting
Security engineers automate. Checking one server by hand is fine; checking 500 is only possible with scripts. Scripting also lets you parse logs, call APIs and later write detections and infrastructure automation.
Security principles: CIA triad and least privilege
Every security decision comes back to a few ideas. If you can name which one a control protects, you can explain it to a manager, choose between options and spot gaps.
Then 3 more stages (about 176 weeks in all) with lessons, drills, projects, 10 interview questions with strong answers and free resources.