
Three entry tracks
1. SOC / Blue team — monitoring, SIEM, incident response 2. Pentest / Red team — OWASP, Burp, controlled lab exploits 3. GRC / compliance — policies, audits (less coding)
Free lab ideas
- TryHackMe / HTB starting paths (document write-ups)
- Home lab with VirtualBox + Kali + vulnerable DVWA
- Wireshark capture analysis on your own Wi‑Fi
Certifications (optional, not mandatory)
- CompTIA Security+ for breadth
- CEH or PNPT for offensive lean (check employer preference)
First resume line
“Built a lab report demonstrating SQLi mitigation on a sample e-commerce app” beats listing tools you never used.


