Cyber Security Career Roadmap for India: 12-Month Plan for Beginners

How to Use This Roadmap

This plan assumes you can invest 8-10 hours a week. If you have less time, stretch each phase; if you have more, compress. The sequence matters more than speed: each phase builds on the previous one. You can follow it by self-study, but a structured live course offers feedback that is hard to replicate alone. Adapt the plan to your background; the links below point to relevant courses.

Months 1-3: Foundations

• Networking: OSI and TCP/IP models, IP addressing and subnetting, DNS, DHCP, HTTP/HTTPS, VPN basics.
• Linux: install Kali and Ubuntu in VirtualBox, learn the command line, permissions, processes, services.
• Windows and Active Directory basics.
• Security basics: CIA triad, threats, authentication, encryption and hashing.
• Output: a working home lab and a notebook of 15-20 small exercises.

Courses: Cyber Security Course for Beginners and Kali Linux course.

Months 4-6: Attacks and Defences in Labs

• Reconnaissance, scanning, enumeration with Nmap and OSINT tools.
• Exploitation basics with Metasploit and manual methods.
• Password attacks and hashing in a lab.
• Web application security: OWASP Top 10 with Burp Suite.
• Defence: logs, Wireshark, introduction to SIEM and incident response.
• Output: five write-ups (network, web, password, log analysis, phishing analysis).

Course: Ethical Hacking or the complete Cyber Security Course.

Months 7-9: Pick a Specialisation

Spend these months going deep: complete at least ten labs in your chosen area and produce a mini-project, such as a SIEM detection pack, a full pentest report or a cloud audit.

Months 10-12: Certification, Portfolio and Job Search

1. Take a recognised certification: Security+ for broad entry, CEH or eJPT for offence, CySA+ for defence, or a cloud credential.
2. Polish your portfolio on GitHub or a blog with clean write-ups.
3. Rewrite your resume to emphasise projects, tools and results.
4. Practise interview questions weekly (see SOC analyst interview questions).
5. Apply to 10-15 relevant roles a week, including remote and MSSP positions, and follow up politely.
6. Network: LinkedIn, local meetups and alumni.

Your First Job and Beyond

Typical first roles are SOC analyst L1, junior VAPT analyst, security analyst trainee, GRC associate or cloud security associate. Treat the first 12-18 months as an apprenticeship: ask for exposure to incidents, tools and review meetings. Then re-evaluate your specialisation and set a two-year goal, such as L2 analyst, OSCP, cloud certification or leading small projects. See pay expectations in cyber security salary in India.

Common Roadmap Pitfalls

• Skipping foundations to learn “cool” tools.
• Collecting many certifications without projects.
• Studying in isolation without feedback.
• Ignoring communication and report writing.
• Giving up during the plateau between months 4 and 6; this is normal.

Common Misconceptions About Roadmaps

• “There is one perfect roadmap.” Paths differ by background; use this as a template and adapt.
• “I must finish every topic before applying.” Start applying when you have a few strong projects; interviews teach you what to improve.
• “Tools matter more than concepts.” Tools change; concepts transfer.
• “A roadmap guarantees a job.” It improves your odds through preparation but the market, timing and effort decide outcomes.
• “Specialising early is mandatory.” Sampling offence, defence and governance for a few months helps you choose well.

Hands-On Exercise: Create Your Personal 90-Day Sprint

Pick the phase you are in and write three measurable goals for the next 90 days, for example: finish a networking module and explain the TCP handshake to a friend; build a home lab with attacker, victim and SIEM machines; publish five lab write-ups. Put weekly milestones in a calendar, track hours spent and review progress every Sunday. Share your sprint with a study partner or mentor so that you have accountability. Revisit the plan after 90 days and adjust. Learners in our complete course receive weekly checkpoints that follow the same idea.

Self-Test

1. Which skills form the base of the roadmap? (Networking, Linux and security fundamentals.)
2. When should you choose a specialisation? (After sampling several areas, around months 6-9.)
3. What should a portfolio contain? (Documented labs, reports and projects.)
4. Why apply before feeling fully ready? (Interviews reveal gaps and build confidence.)
5. Name two entry roles. (SOC analyst L1 and junior VAPT analyst.)

Illustrative Scenario: A BCom Graduate’s Year

Consider a commerce graduate working in a bank back office. She starts the roadmap while still employed, studying five hours a week. By month three she can explain networking basics, by month six she has built a small SIEM lab, and by month nine she has chosen the GRC and SOC hybrid path because she enjoys investigating anomalies in transactions. In month ten she passes Security+ and applies to fraud analytics and SOC roles. Her banking background gives her an advantage, and she receives interview calls from two financial firms. The roadmap worked because she combined consistent effort with her existing domain knowledge.

Practical Tips for Staying on Track

• Study in the same time slots each week; habit beats motivation.
• Use a public learning log such as a blog or GitHub to create accountability.
• Find a study partner or join a batch so you can ask questions quickly.
• Revisit the roadmap monthly and adjust if your interests change.
• Take one rest day each week to avoid burnout.

Where to Go Next: Practice and Resources

Careers in cyber security are built through a mix of skills, evidence and relationships. Keep your learning plan visible, track your progress and treat each job as a stage rather than a destination. The most valuable investment is usually time spent on hands-on practice and communication, which compounds every year.

• Job portals and company career pages for market research on skills and salaries.
• LinkedIn communities of security professionals in India.
• Local meetups and chapters of OWASP and Null.
• Podcasts and blogs by practitioners about real incidents.
• Mentors who can review your resume and mock-interview you.

More Questions Learners Ask

What if I fail my first interviews?

Treat them as feedback, note the questions, practise and apply again.

Is remote work common in security?

Yes, particularly in SOC, GRC, consulting and cloud security roles.

How do I choose between SOC, pentesting and GRC?

Try one beginner lab in each area and notice which one holds your attention; then talk to professionals in that field.

Can I switch careers at 30 or 35?

Yes. Many professionals enter security later, bringing valuable domain experience.

Do employers prefer degrees or certifications?

It varies; many prefer a combination of education, certification and demonstrable skill.

How important is communication in security jobs?

Very important, since findings must be explained to developers and management.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is hashing and why are salts used?

Hashing creates a fixed-length fingerprint of data and cannot be reversed easily. Salts are random values added before hashing passwords so identical passwords produce different hashes and precomputed attacks fail.

Explain the CIA triad.

Confidentiality keeps data secret from unauthorised people, integrity ensures it is not altered improperly and availability ensures it can be used when needed. Controls such as encryption, hashing and backups map to each.

What is MFA and why is it effective?

Multi-factor authentication requires two or more proofs, such as a password and a one-time code, so a stolen password alone is not enough. App-based or hardware methods are stronger than SMS codes.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Patch management: The routine of testing and installing software updates that fix known vulnerabilities.
• DDoS: A distributed denial-of-service attack that floods a service with traffic until legitimate users cannot reach it.
• Threat intelligence: Analysed information about attackers, tools and indicators that helps defenders prioritise and detect threats.
• Brute force: Trying many passwords or keys automatically until one works; rate limiting and MFA reduce the risk.
• CERT-In: India’s national agency for responding to cyber security incidents, which issues advisories and reporting directions.
• Ransomware: Malware that encrypts files and demands payment for the key; modern variants also steal data first to threaten publication.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Cyber Security Course, Cyber Security Course for Beginners and Cyber Security Certification Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: How to Become a Cyber Security Expert: Skills, Steps and Timeline • Cyber Security Jobs for Freshers in India: Roles, Skills, Salary and How to Apply • Is Cyber Security a Good Career in India? Honest Pros, Cons and Scope.