Hack your cyber
career

Pick your lane

The fastest way to stall a security career is to stay a generalist for too long. "Cybersecurity" is not a job. It is a dozen trades that happen to share a conference circuit. Hiring managers do not hire people who are interested in security. They hire people who already do a specific thing.

You do not have to commit forever. You have to commit for the next nine months, because that is roughly how long it takes to get good enough at one thing to be worth paying for.

How to tell which one fits

Not by vibes. By a trial run. Spend one weekend on each side and pay attention to which one you keep thinking about on Monday.

• Red trial: take one vulnerable box you have never seen. Give yourself four hours and no walkthrough. Note how you feel at hour three.
• Blue trial: take a public dataset of auth logs or a captured pcap. Find the one thing that is wrong in it. Write the alert rule that would have caught it.
• Purple trial: run one known attack technique on a box you own, then go find it in the logs, then write the detection. The full loop is the job.

The lane you choose gets a bias toward the money and the openings, so be honest about both. There are far more blue roles than red ones, and blue is the more common route into a first job. Red is smaller, louder, and more competitive. Purple usually wants a couple of years somewhere else first.

The skills that get you hired

A job ad is two documents stapled together. There is the list HR copied from the last ad, and there is the actual problem the team needs solved. You are being hired for the second one. Your job is to work out what it is.

Read job ads like an analyst

Take the five ads you saved. Put every requirement into three buckets:

1. Repeated in all five. This is the real job. Learn it properly.
2. In one or two. This is that team's stack. Learn the concept, not the product.
3. In none, but implied. Writing, ticket hygiene, explaining a finding to someone who is annoyed with you. Never listed, always tested.

Do this once and you stop guessing what to study. The bucket one list is your syllabus for the next six months.

The base layer nobody lets you skip

Whatever lane you picked, these turn up every day and they are what interviews probe when they want to find the bottom of your knowledge:

• Networking. What actually happens when a packet leaves your machine. DNS, TCP, TLS, HTTP, proxies, NAT. If you cannot explain a three way handshake and why it matters to a scan, start here.
• Operating systems. Processes, permissions, the filesystem, how a service starts. Both Linux and Windows. Windows internals and Active Directory are where most corporate attacks and defences actually live.
• Identity. Authentication vs authorisation, tokens, sessions, Kerberos, OAuth. Most breaches are a login problem wearing a costume.
• Scripting. Enough Python to parse a file, call an API and automate the boring part. Of everything in this list, it is the one that pays back fastest, and it costs nothing to learn.
• Writing. A finding nobody understands does not get fixed. A report is the product.

Where to get the code part, for nothing

Scripting is the one on that list you can close entirely for free, and it is the one that pays back fastest.

• freeCodeCampFREEFull curricula in Python and JavaScript with a certificate at the end of each. The YouTube channel carries multi hour courses on top.
• Automate the Boring Stuff with PythonFREEReadable free online, and the closest thing to a security scripting primer that is not aimed at security people.
• Python for EverybodyFREEUniversity course, free materials and video. Slower and more thorough than the tutorials you will find on YouTube.
• CS50PFREEAUDIT / AIDHarvard's Python course. Free to take, paid certificate optional. Harder than it looks and worth finishing.
• The Missing Semester of Your CS EducationFREEMIT's course on the shell, git, and the command line tooling nobody teaches you. If you are weak in a terminal, start here.
• Codecademy: computer scienceFREEFree tier covers the fundamentals. Useful if you learn better by typing into a browser than by reading.
• Hacker's PythonFREEOurs. Four sections, thirty two lessons, four working security tools at the end. Runs in the browser, nothing to install.

Depth beats breadth, every time

Ten tools you have opened once is worth less than one tool you know cold. The candidate who can explain precisely how their one tool works, where it lies to you, and what they do when it fails, reads as senior. The candidate with a long tool list reads as a course completer.

Certs, honestly

Certifications do one job well: they get you past the filter. They do not make you good, and everyone in the interview room knows it. Buy them for what they do, not for what the marketing says.

The three reasons to buy one

• The filter. Some HR systems and most government or contractor roles will not surface you without a specific cert. If your target ads keep naming one, that is a real cost of entry.
• The curriculum. A good cert gives you a syllabus and a deadline, which is worth a lot when you are self teaching and drifting.
• The proof of effort. A hard, hands on cert tells a hiring manager you can sit down and finish something difficult. That signal is real.

Notice that none of those is "it teaches you the job". The job is taught by doing the job, or by labs that look like it.

How to sequence them without wasting money

1. One foundational cert, maybe. If you are changing careers and have nothing on paper, one broad entry cert gets you through automated screening. If you already have an IT background or a degree, you can often skip this rung entirely.
2. One hands on cert in your lane. This is the one that matters. Practical, proctored, you break in or you detect it or you fail. It is the only cert type that consistently changes how interviews go.
3. Stop. Go get experience. Collecting a third and fourth cert instead of building anything is the most common way people stall for a year.

Where the training lives

By lane and by price. Almost nobody exhausts the top row before they start paying, which is the single most common way to waste money in this field.

The whole library, by lane

Everything below is a real provider with a working link. Start in the free rows. Between them they cover more ground than most paid syllabuses, and several end in a certificate that costs nothing.

Blue defensive: detection, response, forensics, GRC

• ISC2 Certified in Cybersecurity (CC)FREEFREE CERTSelf paced training and the exam, both free, from the body behind CISSP. If you do one thing on this page, do this one. No other free credential is recognised as widely.
• Centri (formerly Security Blue Team)FREEPAID TIERSame team and same BTL1 certification under a new name, so search for both. Free quiz based courses sit alongside the paid path. BTL1 is one of the few certs SOC hiring managers know by name.
• Picus Purple AcademyFREEFREE CERTShort CPE bearing courses on threat hunting, vulnerability management, digital forensics, network analysis and OSINT. An hour each, so good for sampling which speciality grabs you.
• Google Cybersecurity Professional CertificateAUDIT / AIDPAID TIEREight courses, roughly 170 hours. Coursera lets you audit the material and offers financial aid, but the certificate itself needs a subscription. Not deep, and it fills the gaps a self taught background leaves.
• Splunk free trainingFREEPAID TIERFilter the catalogue to free. Query fluency in a SIEM is the most transferable blue team skill there is, and the thinking survives a change of vendor.
• AttackIQ AcademyFREEFREE CERTFree adversary emulation and threat informed defence curriculum built on ATT&CK, with free certificates and CPE credits on completion.
• Flare AcademyFREECPE CREDITSResearcher led sessions on dark web investigation, deanonymising threat actors, ransomware and CTI, with CPE credits toward renewals. The Discord carries the replays.
• Fortinet Training InstituteFREEFREE CERTFree self paced training and several free certification paths. Vendor flavoured, and the network security fundamentals carry over.
• Cisco Networking AcademyFREEFREE CERTFree networking and cybersecurity courses with badges. The best free route to the packet level knowledge every interview probes.
• Qualys TrainingFREEFREE CERTFree vulnerability management training and certifications. VM is the least glamorous blue skill and one of the most hireable.
• OPSWAT AcademyFREEFREE CERTFree critical infrastructure and OT security courses with certifications. A small field with real demand.
• Microsoft Learn: security pathsFREEFree role based learning paths. Most corporate estates are Microsoft, so Entra, Defender and Sentinel knowledge converts directly into job requirements.
• AWS Skill BuilderFREEFree tier covers cloud security fundamentals. Cloud is where the workloads already moved.
• IBM SkillsBuildFREEFREE CERTFree courses and credentials aimed at people entering the field.
• Palo Alto Networks Learning CenterFREEFree courses across network security and SOC operations.
• OpenSecurityTraining2FREEFree, deep, university grade material on architecture, reverse engineering and exploitation. Nothing else free goes this low level.
• Malware Unicorn: RE101 and RE102FREEThe reverse engineering workshops a lot of malware analysts actually started on.
• CybraryFREEPAID TIERFree tier plus paid paths. Uneven quality, and worth filtering for the specific course you need.
• EC-Council AcademiaFREEFree essentials series covering network defence, ethical hacking and digital forensics.
• DFIR DivaFREEA curated index of free and low cost training, kept current by someone who does the work. Use it as a second opinion on anything here.
• Black Hills InfoSec webcastsFREEFree recorded webcasts and workshops, consistently practical rather than promotional.
• CISA free services and toolsFREEThe US government's index of free security tooling. Useful for building a home lab on nothing.
• Class Central: blue teamFREEAggregator across providers, filtered to free. Good for finding university courses that were quietly published for nothing.

Blue worth paying for, in this order

• Antisyphon: SOC Core SkillsCHEAPJohn Strand's pay what you can model. Genuinely low cost, taught by working practitioners.
• TCM SecurityCHEAPCheap defensive courses and a practical certification track. Good value per hour.
• SANS Cyber DefenseCOSTLYThe most expensive training in the field and the most recognised. Ask an employer to fund it before you fund it yourself.
• HTB AcademyCOSTLYStructured coursework with the CDSA defensive certification at the end. A meaningful slice of the catalogue is free.
• OffSec SOC-200 / OSDACOSTLYThe defensive counterpart to their offensive line. Practical, proctored exam.

Red offensive: pentesting, red teaming, research

• PortSwigger Web Security AcademyFREEPAID TIERThe best free web hacking curriculum there is. Written material paired with graded labs, and deeper than most paid courses. If you do one thing in this module, do this.
• APIsec UniversityFREEFREE CERTFree API security courses with free certificates. APIs are the fastest growing attack surface and the one most testers are weakest at.
• Hacker101FREEHackerOne's free course, video and written, with a CTF attached. Clearing flags earns private programme invitations, and access to targets worth testing is the beginner's real problem.
• Bugcrowd UniversityFREEFree modules covering the methodology Bugcrowd's own triage team wants to see. Read it as a specification for what makes a report get accepted.
• HTB Academy: free modulesFREEA real slice of the catalogue is free, including the fundamentals tiers. Structured coursework rather than machines, so it fills the gap the lab platforms leave.
• OWASP MASTG / MASVSFREEThe free mobile testing standard and guide, effectively a textbook. Mobile roles get fewer applicants than demand justifies.
• PortSwigger ResearchFREEWhere new attack classes get invented. Read it and you stop reporting the same three bugs as everyone else.
• Pentester Land write-upsFREEAn index of bug bounty write-ups. Shows what people are finding in the field right now, not in 2016.
• Class Central: free cybersecurityFREESurfaces free university MOOCs on cryptography, systems and software security.

Red worth paying for, in this order

• Antisyphon: Intro to PentestingCHEAPAgain John Strand, again pay what you can.
• TCM Security: PNPTCHEAPA practical, proctored pentest certification at a fraction of the usual price. Increasingly recognised.
• SANS Offensive OperationsCOSTLYExpensive, well taught, widely recognised. Employer funded or not at all, for most people.
• OffSecCOSTLYOSCP and the courses around it. Still the cert most red team ads name.
• Zero-Point Security: CRTOCOSTLYRed team operations with a practical exam. Cheaper than SANS and well regarded for adversary simulation.
• Altered SecuritySPECIALISTActive Directory and Azure attack specialisation. Narrow and deep.
• XINTRASPECIALISTAdversary emulation and detection engineering labs.
• Sektor7 InstituteSPECIALISTMalware development and evasion, for people going into red team tooling.
• Red SiegeSPECIALISTShort, focused offensive courses from a working consultancy.
• The Bug Hunter's Methodology (Live)SPECIALISTHaddix's own course, and the origin of the class this roadmap follows.

Purple appsec, secure code, threat modelling

• Snyk LearnFREEFree secure coding lessons organised by vulnerability class, with fixes in the language you actually write.
• Secure Code WarriorFREEPAID TIERGamified secure coding with a free tier. Built for developers, which is the point.
• KontraFREEFree interactive OWASP Top 10 walkthroughs. Short and genuinely well made.
• HacksplainingFREEFree lessons explaining each vulnerability class to developers, in plain language.
• CodebashingFREEFree secure coding exercises in the browser.
• Contrast Developer CentralFREEFree developer security resources and labs.
• AvataoFREEHands on secure coding exercises with a free tier.
• Veracode Security Labs CommunityFREEFree community edition of their hands on secure coding labs.
• OpenSSF: Developing Secure Software (LFD121)FREEFREE CERTFree Linux Foundation course with a free certificate. The closest thing to a standard AppSec grounding.
• Semgrep AcademyFREEFree static analysis and secure code review training. Writing your own rules is a differentiator on a resume.
• OWASP Cheat Sheet SeriesFREEThe reference AppSec engineers actually keep open. Free, maintained, and the answer to most design questions.
• OWASP ASVSFREEThe verification standard. Read it once and you will know what a security requirement is supposed to look like.
• Security Knowledge FrameworkFREEFree training and requirements tooling built around the standards above.
• Threat Modeling ManifestoFREEShort, free, and the fastest way to understand what threat modelling is before you pick a methodology.
• SANS posters and cheat sheetsFREEFree reference posters across both sides of the house. Print the ones for your lane.

Purple worth paying for

• AppSecEngineerCHEAPCloud, Kubernetes, DevSecOps and threat modelling paths. The main paid AppSec option that is not enterprise priced.

Before you pay

Run this check on any cert, every time, because the market moves and the price does not:

• Search your five saved job ads for it. Zero mentions means zero filter value for you.
• Search it on LinkedIn against people who hold the job you want. Do they have it, or something else?
• Is the exam practical or multiple choice? Practical exams carry more weight with technical interviewers.
• Total the real cost: exam, retake, lab time, and the hours. Then ask if that money buys more signal as a home lab or a conference ticket instead.

Employer funding is more common than people assume and almost nobody asks. Ask in the offer conversation, not after you start.

Labs that count as experience

"No experience" is a solvable problem. Experience is not the same as employment. It is having done the work and being able to talk about it in detail. Labs can give you both, but only if you treat them as work rather than as entertainment.

The difference between practice and proof

Two hundred completed lab boxes with no notes is practice. It vanishes the moment you close the tab. Twenty boxes with a written record of what you tried, what failed, and what you would do differently is proof, and you can talk about any one of them under pressure a year later.

Write as you go. Not a polished blog post, a working log: the target, the goal, each thing you tried, the output that made you change direction, the fix you would have recommended. Fifteen minutes of writing per session is the whole trick.

Build the lab that mirrors the job

Platform boxes teach you technique. A home lab teaches you environments, which is what the job actually is. Aim for something that looks like a small company, because that is what you will be defending or attacking:

• A Windows domain controller with two or three joined machines, some users, and a couple of deliberately bad configurations.
• A Linux server running something real: a web app, a database, SSH exposed to your own network.
• Central logging, so you can see what your own attacks look like from the other side.
• An attacker box you rebuild occasionally, so you learn your own tooling from scratch more than once.

Old hardware, a spare laptop, or free tier cloud credits are all fine. The lab being scrappy is not a problem. The lab not existing is.

Attack it, then catch it

The highest value exercise available to you for free, in any lane: run one known technique against your own lab, then go into your logs and find the evidence it left, then write the rule that would have alerted on it. Do that thirty times and you understand security better than most people two years into the industry, because you have seen both ends of the same event.

Where to practise

Grouped by lane, and mapped onto the ladder above. The free ones are marked, and most of the platforms with a paid tier give you enough for nothing to find out whether you like it.

Blue ranges, SOC simulators, detection tooling

• LetsDefendFREEPAID TIERA simulated SOC with real alerts to triage. The closest thing to doing the job before you have the job.
• Blue Team Labs OnlineFREEPAID TIERInvestigation challenges and defensive labs with a free tier.
• CyberDefendersFREEFree blue team CTF challenges built on real artifacts: memory images, pcaps, disk. Write these up.
• KC7FREEFree threat hunting game built on a realistic dataset. Teaches query thinking rather than tool clicking.
• Malware-Traffic-Analysis.netFREEYears of free pcap exercises with answers. Work through these and packet analysis stops being scary.
• Security OnionFREEFree monitoring platform you can run at home. Gives you a SIEM, IDS and full packet capture in one install.
• WazuhFREEFree open source SIEM and EDR. This is the one to build your home detection lab on.
• DetectionLabFREEScripted Windows domain with logging pre wired. Saves you a weekend of setup so you can spend it on detections.
• Atomic Red TeamFREESmall, safe tests mapped to ATT&CK techniques. This is how you run an attack and then go find it in your logs.
• Elastic Security LabsFREEFree detection research and rules. Read the rules, not just the blog posts.
• VelociraptorFREEFree endpoint visibility and DFIR tooling. Worth knowing by name in an incident response interview.
• ZeekFREENetwork security monitoring. Turns traffic into logs you can actually hunt in.
• WiresharkFREEThe packet analyser. Free, and there is no defensive role where it does not come up.

Red machines, CTFs, cloud and AD

• TryHackMeFREEPAID TIERGuided rooms and learning paths. Rung one of the ladder above: good for fluency, weak as evidence on its own.
• Hack The BoxFREEPAID TIERUnguided machines. Harder, and the write-ups you produce are worth more than the flags.
• PentesterLabFREEPAID TIERFocused exercises on specific vulnerability classes, with real CVEs to reproduce.
• OverTheWireFREEFree wargames. Bandit is still the best introduction to working in a shell that exists.
• pwn.collegeFREEFree university level binary exploitation and systems security. Deep end, fully free.
• ROP EmporiumFREEFree, focused return oriented programming challenges.
• picoCTFFREEFree beginner CTF with a permanent practice gym. Built for people who have not done this before.
• Root-MeFREEHundreds of free challenges across every category.
• VulnHubFREEFree downloadable vulnerable machines you run locally. No subscription, no queue.
• CTFtimeFREEThe calendar of live CTFs. Playing with a team beats grinding alone.
• flaws.cloudFREEFree AWS security challenge. Cloud misconfiguration is where a lot of real findings live now.
• flaws2.cloudFREEThe sequel, with attacker and defender tracks.
• CloudGoatFREEDeliberately vulnerable AWS environments you deploy yourself.
• Pwned LabsFREEPAID TIERCloud attack labs with a meaningful free tier.
• GOAD: Game of Active DirectoryFREEA full vulnerable AD lab you build yourself. Building it teaches you as much as attacking it, which is the point of rung four.

AppSec vulnerable apps and secure code practice

• OWASP Vulnerable Web Applications DirectoryFREEThe index of deliberately vulnerable apps. Start here rather than guessing.
• OWASP Juice ShopFREEThe modern vulnerable app. Realistic stack, and a scoreboard to work through.
• WebGoatFREELesson based vulnerable app, with the teaching built in.
• crAPIFREEDeliberately vulnerable API. Pair it with APIsec University above.
• GitHub Secure Code GameFREEFree, in browser secure code review practice. Review is a skill you can demonstrate cheaply.
• OWASP Secure Coding DojoFREEFree secure coding training platform you can self host.
• SEED LabsFREEFree university lab exercises across systems, network and software security.
• Kubernetes GoatFREEVulnerable Kubernetes cluster. Container security is under supplied relative to demand.
• OWASP Threat DragonFREEFree threat modelling tool. Model one of your own labs and put the diagram in your portfolio.

AI security the newest lane, and the least crowded

• Arcanum AI Security Resources HubFREEHaddix's own collected AI security material. The newest lane in the field and the least crowded.
• Arcanum prompt injection taxonomyFREEA structured taxonomy of prompt injection techniques. Free, and current.

The reading list

Courses give you a syllabus and labs give you reps. Books are where the model in your head gets built, and a few of the best ones are free in full because their authors wanted them read.

You do not need all of these. Pick the one for your lane, finish it, then pick another. A book you finished beats four you own.

Red offensive

• Linux Basics for HackersOccupyTheWeb, No Starch. Where to start if the terminal still feels foreign. Second edition is current.
• Bug Bounty BootcampVickie Li, No Starch. The best single book on going from zero to a submitted report.
• The Web Application Hacker's HandbookStuttard and Pinto, Wiley. Historically the web testing bible, now dated. The authors' Web Security Academy is the living version and it is free.
• Evading EDRMatt Hand, No Starch. How endpoint detection actually works, which is as useful to blue as it is to red.
• The Pentester BluePrintWylie and Crawley, Wiley. A career book rather than a technical one. Overlaps this roadmap and is worth it if you want the longer form.

Blue defensive

• Practical Packet AnalysisChris Sanders, No Starch. Pair it with the free pcaps from Malware-Traffic-Analysis and you have a course.
• 11 Strategies of a World-Class Cybersecurity Operations CenterFREEMITRE. Free in full as a PDF. How a SOC is supposed to be run, from the organisation that publishes ATT&CK.
• Security EngineeringFREERoss Anderson. Free in full. The third edition is the closest thing the field has to a standard text, and it is a genuinely good read.

Purple appsec and design

• Web Security for DevelopersMalcolm McDonald, No Starch. Written for the people you will be advising, which makes it the right book for learning to advise them.
• Threat Modeling: Designing for SecurityAdam Shostack. The reference on the practice. Read it before you claim threat modelling on a resume.
• Building Secure and Reliable SystemsFREEGoogle SRE. Free in full online. Security and reliability as one engineering problem, at a scale most books never reach.

If you want the field guide version of the technical side, The Hacker's Notes is ours: command line syntax and real tool usage per chapter rather than theory.

Build proof

Every applicant claims they are passionate and a fast learner. The only thing that separates you is evidence that someone can click. A portfolio is not vanity, it is the answer to the only question a hiring manager has: can this person do the work?

What counts as evidence

• Writing. A handful of posts explaining something technical, clearly, in your own words. This doubles as proof you can write a report, which is most of several jobs.
• Tools. Small scripts that solve a real annoyance. A log parser, a triage helper, an API client for a service you use. Quality over count. A clean README matters as much as the code.
• Write ups. Retired boxes, CTF challenges, your own lab work. The thinking is the point, not the flag. Show the dead ends.
• Contributions. Documentation fixes, a detection rule submitted to an open ruleset, a bug report with a good repro. Small, real, and dated.
• Disclosure. A responsibly reported and fixed finding, with permission to talk about it, outweighs almost everything else on this list.

Rules that keep it useful

• Only publish what you are authorised to publish. Never write up a target you did not have permission to test, never post a client detail, and honour disclosure timelines. One bad post ends a career before it starts.
• Show the reasoning. A write up that says "I ran the tool and got a shell" proves nothing. One that says "the tool said X, I did not believe it because Y, so I checked Z" proves you think.
• Keep it current. Three things from this year beat twelve things from four years ago.
• Make it findable. One page with your name, your lane, and links. That page goes on your resume and your profiles.

The four surfaces

Each one does a different job for a different reader. The site is the anchor and the rest point back to it.

• Website. Three pages is enough: home, blog, contact. Name, photo, one line of positioning, two short paragraphs on who you are and what you do. Anything more elaborate is what stops people shipping.
• LinkedIn. The profile most hiring managers read, whatever you think of the platform. Headline and About should carry the same positioning as your site. Use Featured to pin your best work above your job history.
• GitHub. Treat the profile README as a landing page. A handful of small, useful tools beats forty forks.
• Offensive specific. Bug bounty profiles are public and rankable, which is an advantage the defensive side does not have. Points, rank, accuracy and a hall of fame read in five seconds.

• GPRM: GitHub Profile ReadMe MakerFREEGenerates a profile README with badges and stats instead of you hand writing markdown. Ten minutes, and it looks like a day.
• BugcrowdFREEFor offensive roles the receipts are public: points, rank, submission accuracy, priority percentiles and a hall of fame. A hiring manager can read those in five seconds without trusting your self assessment.
• Oracle security alertsFREEAn example of vendor credit pages. A named acknowledgement from a large vendor is third party evidence you cannot fake.
• LinkedIn PremiumPAID TIERThe free trial is usually enough to see who viewed you and to message outside your network during an active hunt. Cancel it after.

Explain it to an outsider

For each piece of work, write two sentences a non technical person would understand. "I found a way to read other users' files on a test server, and wrote up how to fix it." You will use those exact sentences in the interview and on the resume, and being able to produce them is itself a senior signal.

Resume ops

Your resume has two readers: a keyword matcher and a tired human with about eight seconds. You have to satisfy both, and you have to do it without inventing anything.

Get past the machine

• One column, standard headings, no text inside images, tables or headers. Fancy layouts get parsed into nonsense.
• Use the words from the job ad, where they are true of you. If the ad says "SIEM" and you wrote "log platform", you lose a match you had earned.
• Spell out the acronym and the expansion once, because different systems index different ones.
• Send a PDF unless they ask otherwise. Name it with your actual name.

Get past the human

The eight seconds go on the top third of page one. Put your strongest evidence there, not your education, and not a paragraph about being a passionate professional.

Write every bullet as action, thing, result. Most people write only the first two.

• Weak: "Responsible for monitoring security alerts."
• Strong: "Triaged around 40 alerts a day in a SOC lab environment, tuned three noisy rules and cut false positives on them by roughly half."

Numbers do the work, even approximate ones, even from lab and volunteer settings, as long as you label them honestly. "Lab environment" or "personal project" in the line costs you nothing and protects you completely.

Career changers

Do not hide the old career. Mine it. Helpdesk is ticket discipline and user empathy. Sysadmin is the infrastructure you now defend. Military is process under pressure and clearance. Teaching is explaining hard things to people who do not want to hear them, which is half of security. Name the transferable skill in the bullet, then attach the security context.

Things that quietly cost you interviews

• Listing every tool you have ever opened. You will be asked about the weakest one on that list.
• Claiming a cert you are "currently studying for" without saying so. Say "in progress, exam booked for March". That is fine and honest.
• Three pages. Two if you have a decade of work. One is fine early.
• The same resume for every application. Reordering your bullets per ad takes ten minutes and changes outcomes more than any other ten minutes you will spend.

Be visible

A resume says you sat through some training. A published write up says you spent a Saturday on something nobody paid you for, and it says which corner of the field you spent it on. Hiring managers read the second one differently.

It is also the cheapest edge on this page, because hardly anyone does it. Sixty applicants hold the same cert. One of them has a page explaining the box they rooted, including the two hours they lost to the wrong port. That is the name the panel remembers on Friday.

You do not have to pick a single format. Write, record, speak, or be a useful presence in other people's threads. Most people who are good at this do several of them at once, and none of it replaces the labs in module 04 or the resume in module 07. It sits alongside them.

Find the subject before you find the format

Open a blank file and list everything you have learned. Every tool, every concept, every thing that confused you until it did not. Do it properly, forty or fifty lines, no editing as you go.

Two things fall out of that list. The dense clusters are what you know well enough to explain to somebody else. The gaps you feel embarrassed about are usually the same gaps everybody else has, which makes them the most useful thing you could possibly write about.

Content types

Start where the friction is lowest for you. Writing is where most people begin because the only cost is time. If you talk better than you write, record instead. If you would rather answer questions than produce essays, do only that and you will still build standing.

Stay on one branch for three months before you decide whether it suits you. Four weeks is not enough to tell the difference between a format that does not fit and a format you have not got good at yet.

It is social media, not content media

The word people drop out of "social media" is the first one. The job is replying, quoting, boosting other people, being present in threads that are not yours. A hundred useful replies build more network than ten polished posts, and the replies are how anyone finds the posts in the first place.

Things that cost almost nothing:

• Answer a beginner's question in a Discord or a subreddit. You only need to be one week ahead of them.
• Post what you learned this week in three sentences.
• Share someone else's work with a line on why it is worth reading. Collecting good things and giving them away outperforms almost anything original you will post in your first year.
• Write up a lab or a box, however short.
• Hold an opinion you can defend, and be willing to be wrong about it in public.

Personal lands fine. Funny lands fine. Openly beginner level lands fine. None of it requires you to have authority first.

Do not let a model write it

Detection tooling flags generated prose, and hiring managers increasingly run candidate writing through it. The larger problem is that people now recognise the cadence without any tooling at all. The moment your writing reads as generated, the thing it was there to prove is gone, and what it demonstrates instead is that you went looking for a shortcut. That is difficult to walk back.

Use a model to think. Argue with it. Ask it to attack your explanation and find the hole in it. Then close the tab and type the thing yourself.

What gives it away

Any one of these is survivable on its own. The density is what convicts you.

Eight passes on your own draft

Write first, then hunt. Each pass is fast.

1. Read it aloud. Generated prose is smooth and forgettable. Your own voice has bumps in it, and the bumps are the point.
2. Count the em dashes. More than one every couple of paragraphs and you are performing. Commas, full stops and brackets all still work.
3. Find every triad and break one. Make it two items, or four. Triads are the strongest rhythmic tell there is.
4. Delete every closing aphorism, then put back only the one you meant.
5. Break the paragraph rhythm. Drop in a one sentence paragraph. Let another run long.
6. Cut the decorative intensifiers. Search for genuinely, actually, truly, really. Most of them are doing nothing.
7. Add one thing only you could know. A number, a name, a date, a specific failure. This is the fastest way to sound like a person.
8. Keep your rough edges if they are yours. A clumsy sentence in your voice beats a polished one in nobody's.

Run the list against something you wrote a year ago and something a model wrote this morning. The difference shows up in about thirty seconds.

Tools, briefly

Anything you publish has to look slightly professional or people bounce before they read a word. That is the only reason this list exists. None of it needs design skill.

• CarbonFREEBeautiful code screenshots. Free, and the single cheapest thing that makes a technical post look deliberate.
• Napkin.aiFREETurns plain text into diagrams. Useful when a concept needs a picture and you cannot draw.
• CanvaFREEPAID TIERSocial graphics and one page sites from templates. Haddix built the original class in it.
• SnagitPAID TIERScreenshot annotation with callouts that look intentional. Matters more than it sounds for write-ups.
• XMindFREEPAID TIERMind mapping, for the listing exercise at the top of this module. A text file does the same job.
• GitHub PagesFREEFree hosting that keeps the SEO on a domain you own. This site runs on it.
• beehiivFREEPAID TIERNewsletter platform. An owned list is the one piece of distribution an algorithm cannot take away overnight.
• HypefuryPAID TIERScheduling and recycling for X. What makes consistency survive a busy month.
• BlackMagicPAID TIERAnalytics layered onto X. Tells you who engaged, which is how you find people worth replying to.
• StreamYardFREEPAID TIERMulti guest browser streaming to every platform at once, nothing to install.
• TrelloFREEA content pipeline you can see beats one you remember. Asana does the same job.
• GumroadFREEPAID TIERSell something without building a storefront. Payhip is the alternative.

Find the openings

By the time a role is on a big job board it may have hundreds of applicants and an internal favourite. Public boards are worth working, but they should not be the whole strategy, because the response rate is brutal and it is nobody's fault but the format's.

Work the boards properly anyway

• Set alerts, apply early. Applications in the first couple of days get read differently from ones in week three.
• Apply on the company's own careers page where you can. Fewer layers between you and a human.
• Ignore the years of experience line as a hard rule. It is a wish, not a gate. If you hit most of the real requirements, apply.
• Track everything in one sheet: company, role, date, contact, status. Job hunting without a tracker turns into despair with no data.

The channels that actually convert

• People who have seen your work. This is why modules 06 and 08 exist. Publishing turns strangers into people with a reason to reply.
• Communities. Local meetups, security Discords and Slacks, conference volunteering. Volunteering at a conference puts you in the room with the people hiring, at a fraction of the ticket price, with a legitimate reason to talk to everyone.
• Weak ties. Former colleagues, classmates, the person who answered your question last year. Most jobs come through people you know slightly, not people you know well.
• Recruiters, selectively. A good specialist security recruiter will tell you what the market pays, which is information you cannot get anywhere else for free. A volume recruiter will spam you. Learn the difference quickly and stay in touch with the good ones between jobs.
• Adjacent entry. IT support, NOC, junior sysadmin, or QA at a security vendor. An internal move into the security team is one of the most reliable routes in, and it is badly underrated because it does not feel like a win at the time.

Where to look

• LinkedIn: cyber security jobsThe biggest pool and the most competition. Set alerts and apply in the first two days.
• Indeed: cyber securityBroad aggregation. Filter hard and apply on the company's own site where you can.
• ZipRecruiter: cyber securityWorth having as a third alert. Heavier on recruiter listings than direct ones.
• InfoSec MapFREEConferences, meetups and local groups by location. This is the one that actually converts, because it puts you in rooms.
• r/netsec hiring threadsFREEMonthly hiring threads where the rules encourage realistic requirements and direct contact rather than an HR portal. Read the old ones for the pattern.

Places that hire, and communities attached to them

Smaller consultancies hire more often than their size suggests and read applications properly. Their communities are a hiring channel in their own right.

• Red SiegeOffensive consultancy. Small, respected, hires.
• SpecterOpsAdversary simulation and detection research.
• PreludeSecurity testing and validation.
• AntisyphonTraining arm of Black Hills. Their community is a hiring channel in its own right.
• Blue Team Village DiscordFREEDefensive community with an active jobs presence.
• Arcanum DiscordFREEHaddix's community, attached to the class this roadmap follows.

Jason Blanchard's job hunt playbook

Blanchard runs community at Black Hills InfoSec and has given the same talk, refined, many times. It is the single best free resource on the hunt itself, and all of it is on YouTube for nothing.

• Job Hunt Like a HackerFREEThe core talk. If you watch one thing in this module, watch this.
• Job Hunting in the Age of AIFREEThe updated version, on what changed once everyone started generating applications.
• How to Hunt for Jobs Like a HackerFREELonger form treatment of the same playbook.
• Locating the workFREEFinding roles that are not advertised where you are looking.
• Reverse engineering job descriptionsFREEThe same exercise as module 02, done live.
• OSINT for internal advocatesFREEFinding the person inside the company who can put your name forward.
• Staying organisedFREEThe tracker discipline, which is the part people drop first.
• How to Social Engineer Your Way Into Your Dream JobFREEApplying the skills you are learning to the hunt itself.
• Non-Linear Paths into CybersecurityFREEFor career changers. Worth it for morale as much as tactics.

Reaching out without being ignored

Cold messages work when they are short, specific and ask for something small. Reference something real the person did. Say what you are working on. Ask one question you could not have answered with a search. Do not attach your resume to a first message and do not ask them to find you a job. You are asking for five minutes, not a favour.

Follow up once, a week later, then let it go. Most silence is workload, not rejection.

The interview

Technical interviews in security are not really testing whether you know the answer. They are testing how you behave when you do not. Interviewers deliberately push past the edge of your knowledge, which means everyone hits a question they cannot answer. That moment is the actual exam.

The only script you need for a question you cannot answer

Say what you do know, say plainly where your knowledge stops, then say how you would find out. "I have not worked with that directly. I know it is related to X because of Y. If I hit it on the job I would start by reading the documentation and testing it in a lab." That answer is respected. Bluffing is not, and experienced interviewers spot it instantly, because they ask a follow up and the story collapses.

Say the reasoning out loud

For any scenario question, narrate your thinking. Say what you would check first and why, what would change your mind, and what you would escalate. A candidate who reaches a wrong conclusion through visible, sound reasoning often scores above one who states the right answer with nothing behind it. They are hiring your process, because your process is what turns up on Monday.

Question bank

Prepare an answer for each of these out loud, not in your head. Out loud is a different skill and it is the one being assessed.

Fundamentals

• Walk me through what happens when you type a URL and press enter. They are testing depth and how far you can go before you stop. Go further than you think you should.
• Explain TLS to a developer, then to a CFO. Two audiences, one concept. This is the communication test in disguise.
• What is the difference between authentication and authorisation, and where do teams get it wrong?
• How does DNS work, and what can go wrong with it from a security point of view?
• What is the difference between hashing, encoding and encryption?

Lane specific

• Red. You have a foothold on a workstation in a Windows domain. What do you do first, and what are you careful not to do? Answering with care about scope and noise separates a professional from a hobbyist.
• Red. Explain a vulnerability you understand deeply, including how the fix actually works.
• Blue. An alert fires for impossible travel on a user account. Walk me through the triage. They want a process, not a verdict. Say what you check and in what order.
• Blue. You have a detection rule producing 200 false positives a day. What do you do?
• Purple. How would you prove that a detection actually works?

Behavioural, and they matter more than people expect

• Tell me about a time you were wrong about something technical. Have a real one ready. "I cannot think of one" is the worst possible answer.
• Tell me about a time you had to tell someone something they did not want to hear. Security is mostly this. Show that you did it without making an enemy.
• How do you keep up with the field without drowning in it?
• Why this company, specifically? The one question you have no excuse to fumble. Spend twenty minutes on their product, their blog and their recent news.

Bigger banks, maintained by other people

Ours above is the short version. These are longer and kept current.

• Security architect and principal engineer questionsFREEA maintained list aimed well above entry level. Useful early because it shows you where the ceiling is.
• Daniel Miessler: infosec interview questionsFREEA long standing question bank covering both sides of the house.
• Tib3riusFREEFree practice material and question sets, heavier on the offensive side.

Your questions for them

Being asked "any questions for us?" and having none reads as indifference. Ask things that tell you whether the job is survivable:

• What does the first ninety days look like for whoever takes this role?
• What does the on call rotation actually look like in a bad week?
• How does the team decide what to work on next?
• What happened to the last person in this seat?
• What would make you glad you hired me, a year from now?

Leverage and pipelining

Companies stall even with a position open. Slow replies, a hiring manager on holiday, silence for three weeks. Work at least two opportunities at once so a stall costs you time rather than the whole month, and so you have something to say when you need to push one of them to a decision.

On the offer

Find out the market range before the conversation, from recruiters, salary surveys and people doing the job. Let them name a number first where you can. Negotiate once, politely, and on the whole package: training budget, cert funding, conference days, on call pay, remote arrangement. Most first offers have room in them and most candidates never check.

Keep going

None of this works as reading. It works as a schedule. Pick module 01, do the actions at the bottom of it, then move down. Ten modules at one a week puts you somewhere different by about the tenth week. The links are the part to actually use, so open them rather than reading past them.

When you want the technical side to catch up with the career side, the Hacker's Python course is free and runs in your browser, and The Hacker's Notes is the field guide version of everything else.