A complete, honest roadmap for the skills cybersecurity analysts actually use, from IT and networking fundamentals through security concepts, network defence, monitoring and SIEM, incident response, vulnerability management, identity, governance, and AI. It’s a defensive path, ordered foundational to advanced, so you always know what comes next. Free to read, no signup required.
How to use this: each step below is collapsed. Tap one to expand its details, skill pills, and guidance (only one opens at a time). Work down the spine in order; each stage assumes the ones above it. Security is learned by practising in a safe, lawful lab, so build one as you go, and only ever test systems you own or are authorised to test.
01
You can’t defend what you don’t understand. Cybersecurity sits on top of solid IT and networking knowledge, so build that foundation first.
How networks work: IP, DNS, HTTP, TLS, ports, and routing, since most defence involves understanding and watching network traffic.
Core IT: Servers, clients, the cloud, and how a typical corporate environment is put together.
The command line: Comfort in a terminal on both Linux and Windows, because security tools and investigation live there.
A bit of scripting: Enough scripting to automate routine checks and parse logs, which quickly pays off.
This roadmap is defensive. A cybersecurity analyst protects an organisation by monitoring, detecting, and responding. Understanding how attacks work is part of that, always in service of defending against them.
Most activity worth watching happens on endpoints and servers. Knowing how operating systems behave normally is what lets you spot when something is wrong.
Windows & Linux internals: Processes, services, users, and permissions, so you recognise normal versus suspicious behaviour.
Logs: Where systems record what happened, and how to read those logs during an investigation.
Endpoints: How laptops and servers are managed and protected, since they’re a common entry point.
A baseline of normal: Building a sense of what healthy systems look like, because detection is mostly spotting the abnormal.
Windows internalsLinux internalsProcesses & servicesLogsEndpoints
03
Before tools, learn the concepts the whole field is built on. These ideas frame every decision an analyst makes.
The CIA triad: Confidentiality, integrity, and availability, the three properties security exists to protect.
Threats, vulnerabilities & risk: The difference between them, and how they combine into the risk an organisation manages.
Defense in depth: Layering controls so that no single failure exposes everything, a core defensive principle.
Least privilege: Giving people and systems only the access they need, which limits the damage of any compromise.
CIA triadThreats & riskDefense in depthLeast privilege
04
A large part of defence is understanding and protecting the network. This is where a lot of monitoring and detection happens.
Firewalls & segmentation: Controlling what can reach what, and dividing a network so a problem in one area stays contained.
Secure protocols: TLS, VPNs, and encryption in transit, and why unencrypted traffic is a risk.
Network monitoring: Watching traffic for unusual patterns that may indicate a problem worth investigating.
Common attack types: Understanding, at a defender’s level, how common network attacks work so you can detect and block them.
Good defenders understand how attackers think, purely so they can anticipate and stop them. This awareness is defensive, not a how-to for causing harm.
Common attack types: How phishing, malware, and account compromise generally work, at the level a defender needs.
The attack lifecycle: The broad stages of an intrusion, so you know what to look for and where to break the chain.
Social engineering: Why people are often the easiest target, and how awareness and controls reduce that risk.
Threat intelligence: Using information about current threats to prioritise defences where they matter most.
Defenders study attacks the way doctors study disease: to prevent and treat them. Everything here is framed around detection, prevention, and response, not causing harm.
The core of an analyst’s day is watching for signs of trouble. Monitoring and SIEM tools are how you turn a flood of logs into detectable signals.
Log analysis: Collecting and reading logs from across an environment to find what matters in the noise.
SIEM: Security information and event management tools that centralise logs and raise alerts on suspicious activity.
Detection rules: How alerts are defined, and why tuning them well is the difference between useful signals and noise.
The SOC: How a security operations centre works, and where an analyst fits into monitoring and triage.
The hardest part of monitoring is not too little information but too much. Cutting through alert noise to the few that matter is a defining analyst skill.
Log analysisSIEMDetection rulesAlert triageSOC
07
When something does happen, a calm, practised process makes all the difference. Incident response is a core, high-value analyst skill.
Triage: Quickly judging whether an alert is real and how serious it is, so effort goes where it counts.
Investigation: Piecing together what happened from logs and evidence to understand the scope of an incident.
Containment & recovery: Limiting the damage, removing the problem, and safely restoring normal operations.
The response process: Following a clear plan under pressure, and learning from each incident to prevent the next.
TriageInvestigationContainmentRecoveryIR process
08
Much of defence is closing doors before anyone tries them. Finding and fixing weaknesses in a prioritised way is steady, essential work.
Scanning: Using tools to find known weaknesses across systems and software.
Prioritisation: Focusing on the vulnerabilities that carry the most real risk rather than trying to fix everything at once.
Patching & hardening: Keeping systems updated and reducing their exposure by removing what isn’t needed.
Working with other teams: Coordinating fixes with the people who own the systems, since analysts rarely patch everything themselves.
Security changes constantly, so the ability to keep learning is itself a core skill. Hands-on practice in a safe environment is how it sticks.
A home lab: Practising detection and response in your own safe, isolated lab rather than on anything you don’t own.
Capture-the-flag & challenges: Legal, purpose-built practice environments that build defensive skills without touching real systems.
Staying current: Following credible sources so you know about new threats and defences as they emerge.
Certifications: Entry-level security certifications that many employers value and that give study a structure.
A crucial rule of this field: only ever practise on systems you own or are explicitly authorised to test. Curiosity is essential, but it has to stay lawful and ethical.
Home labCTF challengesStaying currentCertificationsEthics
12
AI is changing both defence and the threats analysts face. Understanding it is quickly becoming part of the job.
AI for defence: Using AI to help with detection, log analysis, and triage, while keeping a human making the decisions.
AI-enabled threats: Awareness that attackers use AI too, for example to make phishing more convincing, so defences must adapt.
Securing AI systems: The new questions AI systems raise, such as protecting data and guarding against prompt injection.
AI helps process the flood of security data, which raises the value of the judgement it can’t replace: deciding what’s a real threat and how to respond.
AI for detectionAI-enabled threatsSecuring AIHuman judgement
Build a home lab and practise defending it
Nothing builds security skill like hands-on practice in a safe environment. A home lab lets you learn detection and response for real, and it’s exactly the kind of initiative that gets an entry-level analyst noticed.
Set up a small, isolated home lab with a couple of virtual machines you fully own.
Install a SIEM or log collector, send it logs from your machines, and learn to read them.
Simulate benign suspicious activity against your own lab, then practise detecting and investigating it.
Write up an incident from your lab like a real report: what you saw, what it meant, and how you’d respond.
Keep everything to systems you own or are authorised to test. Being able to walk through how you detected and investigated something in your own lab is exactly what an analyst interview looks for.
Frequently asked questions
Do I need to know how to code to be a cybersecurity analyst?
Not heavily to start. Analyst roles lean more on understanding systems, reading logs, and using tools than on writing software. That said, some scripting to automate checks and parse data is very useful and grows more valuable as you advance.
Is this an offensive or defensive roadmap?
Entirely defensive. A cybersecurity analyst protects an organisation by monitoring, detecting, responding, and hardening. Understanding how attacks work is included only so you can defend against them, and any practice should happen only on systems you own or are explicitly authorised to test.
Do I need a degree or certifications?
A degree helps but isn’t required, and many analysts enter through IT, help desk, or self-taught routes. Entry-level security certifications are common in this field and can help get past hiring filters and structure your learning, though hands-on skill matters most.
How do I get hands-on experience safely and legally?
Use environments built for it: your own isolated home lab, and legal practice platforms and capture-the-flag challenges. Never practise on systems you don’t own or aren’t authorised to test. Staying lawful and ethical is a non-negotiable part of the profession.
How long does it take to become a cybersecurity analyst?
It depends far more on building real IT and security fundamentals than any fixed timeline. Many people move in from IT or support roles by adding security skills. Consistent hands-on practice in a lab and a genuine grasp of the fundamentals are what accelerate it.
Do I need to master every topic on this roadmap?
No. IT and networking fundamentals, security concepts, monitoring, and incident response are the core for an analyst. Deeper specialisms grow with experience, and security has many paths beyond the analyst role once you have the foundation.
Early access
Cybersecurity Analyst support is coming to Interview Ready
Our personalized Interview Ready plans don’t cover Cybersecurity Analyst just yet, so unlike our other roles, this page doesn’t hand you off to a plan we can’t build for you honestly. This roadmap is free to use in the meantime. Want to be first in line when we add it? Register your interest and we’ll let you know the moment it’s ready.
