Cybersecurity Career Game Plan for 2025
Let's build the foundations of a strong cybersecurity career together.
If you clicked open on this newsletter, you’ve already made the decision to break into one of the most exciting, fast-growing, and—let’s be honest—lucrative industries of our time: cybersecurity. And let me tell you, if you’re just getting started, this is the most important cybersecurity newsletter you’ll read in 2025.
Why? In this newsletter issue, I’m sharing a step-by-step game plan that will guide you from complete beginner—no degree, no IT experience, no certifications—to securing your first cybersecurity job.
Everything from entry-level positions such as SOC Analyst, Penetration Tester, or even your first cybersecurity engineering role. You’ll receive all the tools, tips, and strategies necessary to stand out and thrive in an increasingly competitive job market.
So grab a notebook, stay till the end, and let’s build your cybersecurity career together. Trust me, you’ll want to catch every step because I’m going all in on this one.
Also, here’s an accompanying video if you’d like to watch along:
Interested in sponsoring an issue of Cyberwox Unplugged? Reach out below!
Stage 1: Setting Realistic Expectations
Let’s start with a little reality check.
Breaking into cybersecurity isn’t as easy as some boot camp ads or media headlines might make you believe. Yes, there are thousands of unfilled jobs, but employers aren’t just handing out these roles to anyone who applies. They expect skills, certifications, and, ideally, some hands-on experience—even for entry-level roles.
But here’s the good news: if you’re committed and strategic, you absolutely can land your first cybersecurity job, even if you’re starting from scratch.
The timeline? On average, 6 to 12 months of focused effort. Possibly more.
But you don’t need to be a hacking wizard or have a four-year degree. What you do need is a clear plan—and that’s what I’m giving you right now.
Good things take time. It took Thomas Edison thousands of attempts to finally invent the light bulb. If you're working on building a solid, long-lasting, fulfilling career, you've got to be persistent and expect it to take time.
I previously made a video highlighting that becoming a cybersecurity engineer is not easy, serving as a reminder of this reality check:
Stage 2: Laying the Foundation
"If the foundations be destroyed, what can the righteous do?"
This quote from Psalm 11:3, authored by King David in the Bible, makes a powerful point: when foundational principles are compromised, how can anyone uphold integrity and make progress?
While the broader implications for society warrant separate discussion, foundations are the essential building blocks and core principles that form the bedrock of any structure.
These foundational elements provide the crucial support system for growth, stability, and advancement in any field. In your cybersecurity career, these fundamental components will shape how effectively you can develop and progress in the industry.
Now, let's explore what I consider the absolute cornerstone of your cybersecurity journey and what is necessary for establishing a rock-solid foundation for your career.
This foundation isn't just about learning a few tools or memorizing some concepts—it's about cultivating a comprehensive understanding that will act as the launch pad for your entire cybersecurity career path.
Think of it as laying the groundwork for a house; nothing else you build will stand securely without a proper foundation. So, let's approach this first step with the focus and dedication it deserves: methodically constructing a solid foundation for your cybersecurity career.
The Cybersecurity Quintet
There are five core foundational cybersecurity skills that every professional should possess, regardless of their specialization within the field:
1. IT Fundamentals
While cybersecurity may seem purely technical, a solid foundation in IT basics is essential. This includes understanding computer hardware components, basic troubleshooting, and system administration tasks.
Think of IT fundamentals as the building blocks that support everything else in cybersecurity.
You can learn these fundamentals by studying the core topics covered in the CompTIA A+ certification—even if you don't take the exam. I took this exam when starting my journey to test my knowledge, and you might find it helpful, too.
If you just want to learn the material, you can watch free courses on YouTube that cover all the details, like Professor Messer's free course (on YouTube)—which I used for my own studies.
My first ever YouTube video on how I passed the CompTIA A+:
2. Understanding of Networking and Protocols
Most cybersecurity issues stem from how devices and systems communicate over networks. Understanding data flow is crucial for identifying anomalies, securing configurations, and troubleshooting vulnerabilities.
You'll need to master the TCP/IP and OSI models, the UDP protocol, and standard protocols (HTTP/S, DNS, FTP, SMTP, etc.). It's also essential to learn about networking devices (firewalls, routers, switches) and practice protocol analysis using tools like Wireshark.
I'll be releasing my fundamental networking mini-course with everything you need to know for free on YouTube—keep an eye out for it (you’ll wanna stay subscribed for that).
Also, keep in mind that similar to the CompTIA A+, a certification like CompTIA Network+ can help you gain this knowledge.
I also recommend reading "Practical Packet Analysis" by Chris Sanders and practicing with Wireshark as you read. This hands-on approach will help you turn theoretical knowledge into practical skills as you analyze network protocols at the packet level.
Another one of my first few YouTube videos on how I passed the CompTIA Network+:
3. Basics of Operating Systems (Windows, Linux, macOS)
Attackers frequently target operating system vulnerabilities. A deep understanding of operating system internals is crucial for using these systems in your cybersecurity work and detecting and mitigating security breaches.
Key areas to focus on for operating systems at a high level include:
Understanding file systems and permissions
Basic command-line skills in PowerShell or Bash (nothing too advanced yet)
Operating system architecture fundamentals
Configuring and setting up various operating systems in a virtualized environment
Basics of file, process, memory, and network management
General operating systems hardening techniques like disabling unused services.
Many of these concepts overlap with what you'll learn in IT fundamentals, which you can build upon for this skill.
Understanding operating systems is vital because they serve as the foundation of modern computing and are frequent targets for cyberattacks. Knowing how they work—including their security features and potential vulnerabilities—is essential for detecting, preventing, and responding to security incidents.
Each operating system also has unique security architectures and management tools that security professionals need to understand to protect their organization's assets effectively.
I'll get into how you can learn these skills in a bit, but let's move on to the fourth core skill.
4. Basic Programming and Scripting
While programming might seem intimidating some some, it's become essential in today's job market. Most cybersecurity roles now require basic knowledge of languages like Python, Go, Java, and or SQL.
Without these skills, you'll likely find yourself at a disadvantage in the industry.
Python has been invaluable in my daily work. I use it for everything, from API interactions and data analysis to building automated security incident response workflows in SOAR platforms. Whether I'm automating CI/CD or creating simple scripts for daily tasks, the applications are limitless.
Understanding code isn't just about automation—it also helps you perform security assessments on code repositories and identify malicious scripts.
I strongly recommend starting with Python for beginners. My top three learning resources are :
5. Basics of Cybersecurity
Risk is where security meets the business.
Organizations understand risk and impact, and this is how you communicate the value of cybersecurity efforts to stakeholders.
What's the impact of a vulnerability or attack?
What's the likelihood of it occurring?
How does it affect the business, customers, and reputation?
These considerations are crucial for any security professional, whether you're a SOC analyst, penetration tester, or other professional.
Cybersecurity isn't just about reacting to threats—it's about proactively assessing, managing, and mitigating risks.
Beyond this, you need to understand fundamental security concepts, security controls, how business processes align with security operations, encryption, obfuscation, and general cryptographic concepts.
You should also learn about threat actors and their motivations, threat vectors and attack surfaces, security architecture, data protection, basic vulnerability management, identity and access management, incident response, policies, compliance, and security awareness practices.
After mastering the basics of IT, Networking, and Operating Systems, you should pursue these topics, as those provide the foundation for this core skill.
Now let’s go over how to learn these essential skills. I have two excellent resources to recommend.
The Google Cybersecurity Professional Certification
This program is a game-changer for beginners. It’s affordable, self-paced, and gives you hands-on experience with tools like Linux, Python, and MySQL. These are foundational skills you’ll use in almost every cybersecurity role. Plus, when you finish, you get a discount on the CompTIA Security+ exam, which is our next stop.
Here’s my breakdown of this program:
CompTIA Security+
CompTIA Security+ is like your golden ticket to the cybersecurity world. It’s widely recognized and introduces you to key concepts like security policies, risk management, cryptography, and network security. Employers love seeing this on resumes at the entry level.
Another one of my earliest videos about this certification:
Stage 3: Experimentation
Now that we've covered the foundational skills, it's time to get hands-on experience through experimentation. This is where theory meets practice, and it's crucial for your cybersecurity success.
First, set up a home lab environment. This doesn't need to be expensive—you can start with a basic setup using:
Virtual machines running different operating systems (Windows, Linux)
Basic networking tools and security software
Security monitoring and analysis tools like Wireshark or Splunk
Next, start practicing with hands-on platforms. Here are some excellent resources to begin with:
TryHackMe: Perfect for beginners, offering structured learning paths and practical exercises
Hack The Box: More challenging platform focusing on penetration testing and offensive security but recently including defense based labs
Blue Team Labs Online: Excellent for defensive security practice
CyberDefenders: Focus on blue team scenarios and threat hunting
LetsDefend: Simulated SOC for investigating real cyber attacks
Document everything you learn. Keep detailed notes of your experiments, successes, and failures. This documentation will be invaluable for your resume and future job interviews.
Remember, experimentation isn't just about following tutorials—it's about understanding what you're doing and why. Try to break things (in your lab environment, of course), fix them, and learn from the process.
Here’s how to get started with brainstorming cybersecurity project ideas during your experimentation phase:
Stage 4: Certifications
Let's dive deep into certifications.
I'll divide them into Offensive and Defensive Security. I’ll also focus on practical certifications since hands-on skills are what matter most in the 2025 job market.
Defensive Security Certifications
This section will be broken down into foundation certifications, advanced certifications, and specialized certifications.
Foundational + Advanced
For those just starting in defensive security, I recommend two excellent entry-level options, depending on your budget:
The Practical SOC Analyst Associate Certification from TCM Security
The Blue Team Level 1 from Security Blue Team.
If you want to push your skills further, consider the:
Practical Malware Research Professional from TCM Security
Blue Team Level 2 from Security Blue Team
Certified Cyber Defender from Cyber Defenders
Hack The Box Certified Defensive Security Analyst
And for those looking to specialize even further, check out the;
I've created detailed videos about OffSec's training within this playlist. At this advanced level, OffSec's training is my personal recommendation.
Advanced + Specialized
Beyond foundational skills, let's explore additional advanced defensive skills for those who want to go even deeper.
Starting with Enterprise Security and Digital Forensics Incident Response (DFIR), Blue Cape Security offers training to help you develop these advanced defensive capabilities.
Another advanced skill focuses on Linux and Windows investigation techniques. The platform 13cubed offers in-depth training on memory investigation and advanced forensic analysis.
Finally, for those interested in Linux security—which is becoming increasingly important—the Linux attack, detection, and live forensics course from defensive securityDefensive Security covers hands-on analysis of user-space and kernel-space Linux rootkits, C2 frameworks, and tools.
Through this course, you'll master low-level Linux attack paths, deepen your understanding of Linux internals, enhance your detection capabilities, learn about Linux telemetry, and prepare for emerging Linux threats.
Offensive Security
Now, for those starting in offensive security, you have several excellent options depending on your budget.
Foundational + Advanced
I recommend either the:
Practical Junior Penetration Tester (PJPT) from TCM Security to get started.
To advance your skills further, consider intermediate certifications, including the:
Practical Network Penetration Tester from TCM Security
OSCP from OffSec
CPTS from Hack The Box
Certified Red Team Operator from Zero Point Security
eCPPT from eLearnSecurity.
Advanced + Specialized
For advanced specialization, consider the:
Hack The Box Certified Bug Bounty Hunter
Red Team Ops 2 from Zero Point Security
Certified Web Exploitation Expert from Hack The Box.
Keep in mind—you don't need to get all these certifications.
If you can, that's great for your knowledge base (and more power to you, lol), but this overview is meant to help you choose what's available at different difficulty levels based on your budget and learning goals.
Apply this information strategically to your situation.
Quick reality check on certifications
Now, it's important to recognize that certifications alone won't land you the job. Employers want to see practical skills—and here's where you can get ahead of the pack:
Build a home lab using virtualization software like VirtualBox or VMware to create isolated environments for testing security tools, practicing incident response, and experimenting with different operating systems and network configurations.
You should be practicing on platforms like TryHackMe, Hack The Box, CyberDefenders, LetsDefend, and Blue Team Labs Online.
The combination of certifications, hands-on practice, and a home lab will be your secret weapon. Trust me, it works.
Stage 5: Crafting Your Cybersecurity Resume
Crafting a killer resume.
This is where so many people drop the ball. They spend months studying and earning certifications but then throw together a resume in 10 minutes. Don’t be that person.
Your resume needs to do three things:
Highlight your certifications and skills up front. Use action verbs like ‘analyzed,’ ‘triaged,’ ‘investigated,’ or ‘automated.’
Include a projects section. This is where you showcase the hands-on labs and personal projects you’ve completed. For example:
Configured Splunk to analyze network logs
Conducted Research on new malware samples from the recent Redline InfoStealer campaign
Built a home lab to simulate privilege escalation attacks and created detection rules.
Tailor it to the role you’re applying for. If the job requires experience with SIEM tools, make sure your experience with Splunk or Microsoft Sentinel is front and center.
And don’t forget—less is more. Keep it concise but impactful.
Oh, and if you’re not sure how to structure your resume, linked here’s our cybersecurity resume template, which you can customize.
Quick reality check on resumes
Now let’s be honest: If you’re just getting started in cybersecurity, your resume will initially be very blank and filled mostly with your coursework, but as you progress with classes, projects, labs, and CTFs, you start to fill in.
If you need any help getting started, you can check out our entry-level cybersecurity resume specifically crafted for this or reach out in the discord for resume help.
We offer this service at the cost of a latte or maybe even cheaper, depending on where you live. So, if you can spare the cost of your Starbucks latte for a day, we can help you out :)
Your resume is fundamental in this process because every applicant has one. However, most resumes are subpar because they aren’t optimized.
It doesn’t matter how skilled you are if your resume fails to communicate your abilities clearly.
Elements of a Good Resume
First and foremost, use a clean, professional template. You can get my recommended template here or find suitable ones on platforms like Overleaf or even Google Docs.
I've seen too many resumes ruined by distracting colors, unnecessary graphics, symbols, or even photos of candidates. These elements don't add value—they detract from it. Stick to a simple, professional design that shows you mean business.
Next, lead with your most relevant experience. I know many of you are students without much professional experience yet. That's okay—focus on highlighting any technical or cybersecurity-related experience you do have.
Employers want to see demonstrable skills, so prioritize your labs, projects, certifications, and volunteer work. Have you participated in a cybersecurity club, competed in CTF (Capture the Flag) events, or worked on independent projects? That's gold. Put it front and center.
For example, if you've set up a small-scale security monitoring system using open-source tools, that's incredibly relevant—similar to my cybersecurity detection and monitoring lab that helped launch my career.
Be specific about the tools you used, the outcomes you achieved, and the skills you gained. Did you analyze logs for suspicious activity? Perform vulnerability scans? Conduct penetration testing? Spell it out clearly.
Your resume should showcase your technical abilities even without formal job experience. Use strong action verbs like "conducted," "developed," "analyzed," and "implemented" to describe your experiences.”
Finally, cut the fluff. Skip the unrelated hobbies—save those for the interview, where you can show your personality. I've seen countless resumes listing hobbies like tennis or gaming. These details only distract from your technical skills and dilute the recruiter's focus on your strengths as a cybersecurity candidate.
Keep it technical. Keep it focused.
Everything you need to know about Cybersecurity Resumes:
Stage 6: Applying Strategically
Now comes the grind: applying for jobs.
Let me be real with you—this is a numbers game. For every 100 applications you submit, you might get two to three interviews. So, if you've only applied to 10 jobs and haven't heard back yet...well, that's why.
Chancemaxing
Here's how to maximize your chances:
Be consistent. Spend 30 minutes every day applying for jobs. Use LinkedIn, Indeed, or even Google to search for roles like SOC analyst, cybersecurity analyst, or a variation of whatever interests you.
Network. Attend meetups, conferences, and local BSides events. Many people land jobs through connections, so don't hesitate to ask for advice or even a referral when you meet industry professionals. I've personally landed interviews and jobs through referrals.
Referrals
Here's the truth: referrals are king in today's competitive market. If you're serious about landing an internship, you need to leverage your network. If you don't have a network? Build one! Start attending industry events, join our Discord community—we have multiple people offering referrals—and connect with professionals on LinkedIn.
The biggest mistake people make is relying solely on online applications. While applying online is necessary, the most effective strategy is to get your resume directly into the hands of a decision-maker.
Be flexible. Stay open to relocating or taking roles slightly outside your dream job. For example, an IT support or help desk role can be a great stepping stone into cybersecurity.
There's more I could dive into, but these three principles sum it up nicely.
Stage 7: Becoming the Best Candidate
Let’s face it, employers want the best candidate, so let’s make you that person.
Here’s what makes you stand out beyond the certifications and training we’ve talked about.
Technical Skills and Projects
You need to build technical skills—not just collect certifications and theoretical knowledge. Document everything you do on GitHub or a personal portfolio site.
Unlike software engineering, where platforms like LeetCode dominate, cybersecurity internships require a broader skill set.
You can expect assessments that test your log analysis, scripting, malware analysis, deobfuscation, and CTF-style challenge-solving abilities.
It's not just about knowing what the CIA triad is—it's about thinking like both a defender and an attacker.
Start preparing now. Don't wait until you're applying for jobs, because these skills take time to develop.
You should spend time on platforms like Hack The Box, TryHackMe, LetsDefend, CyberDefenders, and Blue Team Labs Online and engage in real CTF events on sites like PicoCTF.
If you'd like to join our CTF team, we've got one on Discord. Join us.
Each platform exposes you to practical scenarios that mirror what you'll face in the field.
For example, in many of my interviews, including for my current and previous roles, I had to demonstrate abilities like analyzing security logs, writing Python scripts, threat modeling cloud environments, and hypothesizing detection strategies.
I couldn't learn this overnight, but thankfully, I already had experience with Splunk and other SIEM tools.
That's what you need to aim for: proficiency built over time, not crammed into a weekend.
Pareto’s Principle
80% of results come from 20% of causes.
Focusing on core skills is the key to becoming the best candidate, but knowing what to prioritize may be difficult. This is where the 80/20 principle (Pareto’s Principle) comes in.
In cybersecurity, this means prioritizing essential skills: network security, scripting (specifically in Python, Bash, or PowerShell), basic penetration testing, and log analysis.
There are several platforms with structured labs and courses to guide your learning, but you need to be strategic.
If you're not proficient at the basics, make it a priority to get hands-on experience.
You and only you are responsible for your education. Not school, not your professor, not your mentor, not your course advisor, not your manager, not your parents. You.
Blaming your lack of education on someone else is lazy and disrespectful to the free knowledge available today.
There are so many resources out there—pick one and learn the basic skills.
Spend time learning how to analyze network packets with Wireshark, run vulnerability scans, learn Splunk, and write basic scripts.
These are foundational skills, and once you have them, your ability to tackle more complex tasks will improve dramatically.
Projects
The other crucial aspect of this principle is building projects. Those who follow my content know that I've been a strong advocate for cybersecurity projects for years.
These projects aren't just resume fillers—they're practical demonstrations of your skills and initiative.
They show potential employers that you're not just learning theory but applying your knowledge in real-world scenarios.
Whether it's setting up a home lab, creating a network monitoring system, or developing a custom security tool, these projects can set you apart from candidates who only have theoretical knowledge.
I've had several interviews, including one that landed me a cybersecurity engineering internship at Intel, turn into conversations about my technical projects. This happened because I worked hard on these projects and showcased them on my online portfolio.
The bottom line is that you're putting yourself way ahead of your peers by getting these hands-on skills.
This is how you'll stand out in interviews: by showing that you have hands-on experience, not just theoretical knowledge, and by taking the initiative for your career and education.
Here’s a video covering a good amount of training resources for building your skills and supporting your project development:
Soft Skills / Interviewing Skills
Having technical skills is not enough—you need to know how to communicate effectively in an interview. Too many candidates focus solely on technical expertise while neglecting soft skills, which are equally crucial.
You must learn to explain technical concepts simply. During interviews, you'll often present your thought process to non-technical stakeholders, which will shape their impression of your communication abilities, critical thinking, and cultural fit for the role.
Employers want to see that you can both solve problems and clearly explain your solutions while working well with others.
During interviews, don't just answer questions—walk through your reasoning. Employers value candidates who can explain their problem-solving approach, solution choices, and implementation plans. Remember to use the STAR format.
Practice verbalizing your approach while solving problems, even when alone. The more you practice, the more natural it will feel in actual interviews.
I know it sounds crazy, but if you're like me when I struggled with social and conversation skills, practice in front of a mirror, while driving, or under your breath.
Winston Churchill, one of history's greatest orators, spent hours rehearsing his powerful speeches—perfecting every pause and inflection—in front of a mirror for years. So, what makes you think it's not worth the effort?
Just practice!
Being personable is just as important. Connect with your interviewers. Show genuine enthusiasm for the role and company. Research beforehand to ask thoughtful questions.
When interviewers mention security incidents or tools they use, show genuine interest and share relevant experiences. This demonstrates engagement and proactivity—qualities that help you stand out.
Now, I know some interviewers can be stuck up, and that's fine. They're probably someone you wouldn't want to work with anyway. So, chalk it up to the game.
If interviews challenge you, try mock sessions with friends, mentors, or professionals. Again, join our Discord—we can help with that.
Beyond our free tier, we offer paid coaching sessions. For a small fee, I will personally guide you through cybersecurity interview preparation. Some of my recent clients have shown remarkable improvement in their interviewing abilities over just a few weeks.
Success depends on mastering two key skills: staying composed under pressure and clearly explaining technical concepts. I'm here to help you develop both.
Stage 8: College
Let's talk about something that is sometimes the elephant in the room: Do you need a college degree for cybersecurity?
The short answer is no. I've seen many successful professionals in cybersecurity without degrees. However, a degree can provide certain advantages:
Structured Learning Path: College programs offer a comprehensive curriculum covering the fundamentals of computing, networking, and security principles.
Internship Opportunities: Many top companies recruit directly from universities for internship programs that can lead to full-time positions.
If you're particularly interested in a Cybersecurity Internship, I made a video about it and I've received so much great feedback about the actionable advice it covers:
Network Building: College environments provide opportunities to connect with peers, professors, and industry professionals.
But here's the truth: what matters most is your skills and practical experience, not your credentials. If you choose not to pursue a degree, focus on the things we’ve already talked about in this video so far:
Building a strong portfolio of projects
Obtaining industry-recognized certifications
Gaining hands-on experience through labs and CTF competitions
If you do decide to pursue a degree, consider programs in:
Cybersecurity (if available)
Computer Science
Information Technology
Information Systems
Remember: Whether you choose college or not, your success in cybersecurity depends more on your dedication to continuous learning and practical skill development than on formal education.
If you need help deciding on a specific school, I also made a video about that:
Chapter 9: Specialization
Once you’ve landed your first role and you want to consider specializing, here are some high-demand paths to consider once you’re starting to build experience in your first year:
Threat Detection Engineering
This focuses on mastering industry-standard Security Information and Event Management (SIEM) and threat detection tools, such as Splunk, Elastic, and Microsoft Sentinel (amongst many others).
You’ll need to learn how to develop, implement, and fine-tune detection rules while continuously monitoring the organization's infrastructure for potential security threats. This role involves security research, analyzing security logs, creating custom correlation rules, managing a detection platform, and maintaining a robust threat detection framework.
Cloud Security
This specialization involves mastering the intricacies of major cloud platforms like AWS, Azure, or Google Cloud. You'll learn to architect and implement robust security controls, manage identity and access management (IAM), configure security groups and network ACLs, monitor cloud resources for vulnerabilities, and ensure compliance with industry standards and regulations.
Cloud security professionals also need to understand containerization security, serverless security, and cloud-native security tools while staying current with evolving cloud security best practices and compliance frameworks.
I'm working on a Cloud Security Engineer roadmap video,, so watch for it in a few weeks.
Application Security
This domain involves mastering OWASP’s Top vulnerabilities and becoming proficient with methodologies and tools for secure code analysis, including static and dynamic application security testing (SAST/DAST) solutions.
You’ll also need to learn how to conduct thorough code reviews, identify potential security flaws, and implement secure coding practices throughout the software development lifecycle. Understanding common web application vulnerabilities and their mitigations is essential for this role.
There are several other paths out there, but these are some of the more common ones.
The Generalized Specialist
Ultimately, you’ll need to pick the path that excites you most and become a specialist or a generalized specialist. This is someone who has deep expertise in a specific area but also maintains broad knowledge across related domains. They specialize in one particular aspect of cybersecurity while still understanding how it connects to and impacts other areas of the field.
For example, I consider myself a generalized specialist. Although I have expertise in security operations, I have specialized skills in threat detection engineering, detection platform management, cloud security, incident response, and security architecture.
This allows me to understand how my specialized skills relate to and influence other critical areas of cybersecurity, making me more effective in cross-functional projects, strategic planning, and career flexibility.
As a personal example, I started in cloud and SaaS threat detection at Datadog (after various SOC roles) and then transitioned to Amazon, where I took on diverse responsibilities. Throughout last year, I was deeply involved in incident response, handling complex cases involving fraud investigations, platform abuse, espionage, and investigating data exfiltration attempts. This role was exciting as it also involved working within a specialized organizational structure and even a custom operating system environment.
Now, in an exciting career progression this year, I'm transitioning to a new team where I'll be focusing on threat intelligence operations, threat-hunting initiatives, and adversarial emulation. This career progression clearly demonstrates how being a generalized specialist has allowed me to adapt and grow across different cybersecurity domains.
Starting with threat detection in cloud & SaaS environments, moving to incident response, insider threat,, and fraud investigations, and now focusing on threat intelligence and adversarial emulation, each role has built upon my core expertise while allowing me to develop new specialized skills. This versatility is increasingly valuable in cybersecurity, where threats and technologies are constantly evolving.
Stage 10: Learn How To Be Consistent and Build Effective Habits
Let me be straight with you: success in any field requires the right habits and consistency.
You have to show up, especially on days when your motivation is low. The journey is challenging, but I promise you it's worth every step.
In cybersecurity, success isn't about sporadic bursts of effort—it's about consistency. You can't just cram technical skills or prepare only when interviews are on the horizon.
You need a daily or weekly routine that strengthens your learning and keeps your skills sharp. This field moves fast, and you need to move with it.
Set aside dedicated time for different aspects of your cybersecurity journey. For example, dedicate Monday evenings to networking fundamentals, Tuesdays to scripting practice, and Wednesdays to hands-on labs on TryHackMe or Hack The Box.
This kind of routine doesn't just build competence—it makes the whole learning process feel more manageable.
Building effective habits means embracing continuous improvement. Review your progress regularly and actively seek feedback.
Think of it like getting fit: Consistent training in cybersecurity leads to lasting results. This steady approach builds confidence and expertise, valuable assets for interviews and your future career.
Charting Your Own Path and Next Steps
Cybersecurity is an incredible field with endless opportunities, but breaking in requires strategy, persistence, and a willingness to learn. The steps I’ve shared today—from certifications to hands-on labs to applying strategically—will set you up for success.
Ultimately, understand that breaking into cybersecurity requires leverage. You can leverage with depth of knowledge, depth of credentials, and depth of a network.
Remember, this is a journey. You’ll face challenges, rejections, and moments of self-doubt. But if you stay consistent, keep building your skills, and believe in yourself, there’s no reason you can’t land your first cybersecurity role in 2025.
Cyberwox Resources
Resources for your career
🔹Join the Cyberwox Academy Discord!!
🔷 Check out the episodes of the Cyberstories Podcast on your favorite platform
🔹Cyberwox Cybersecurity Notion Templates for planning your career
🔹Cyberwox Best Entry-Level Cybersecurity Resume Template
🔹Learn AWS Threat Detection with my LinkedIn Learning Course
Closing
Once again, you made it this far :)
Thanks for reading. If you so desire, subscribe. If not, I’ll see you around…somewhere on the internet!
Disclaimer: This newsletter contains some affiliate links, and I may receive a small commission (at no extra cost to you) for purchases made through these links. I appreciate your support!