Cyber security roadmap for beginners in India

Most beginner roadmaps fail for the same reason: they list everything. You end up months in, having watched a hundred hours of video, with nothing you can show and no role you are actually applying for. This roadmap is deliberately narrow.

Step 0: choose a destination first

Cyber security has at least six realistic entry doors in India: SOC operations, network security, identity and access management, GRC, cloud security and application security. Pick one now. You can change later — but a roadmap without a destination is a reading list.

Which door fits depends on your background and constraints: what you already know, how many hours you have each week, and whether you can take shift work. SOC analyst is often a practical first door for people starting from zero, because it exposes you to many other areas — but it is one option, not a default. If you are unsure, use the starting-point check to compare paths against your situation.

The month-by-month plan below is an adaptable example, not an expected employment timeline. Some people need longer, some move faster, and job offers depend on factors no plan controls. Stretch or compress the stages to fit your weekly hours.

Months 1–2: fundamentals you will use every day

• Networking: OSI and TCP/IP, the handshake, DNS, HTTP/S, ports, NAT, VPNs, proxies. Be able to describe what happens when you type a URL and press enter.
• Operating systems: Windows processes, services, the event log, Active Directory basics; Linux file system, permissions, processes, /var/log.
• Security concepts: CIA triad, authentication vs authorisation, encryption at rest and in transit, hashing, least privilege, defence in depth.

Study out loud. After each topic, explain it to an empty room in two minutes. If you cannot, you have not learned it.

Month 3: attacks and how they look in logs

Learn the common attack patterns — phishing, credential stuffing, privilege escalation, lateral movement, ransomware staging, data exfiltration — and for each one ask the only question that matters in a job: what evidence would I see?

Bring in MITRE ATT&CK here, as a map rather than a memorisation exercise. Practise mapping a described incident to tactics and techniques.

Month 4: build a lab

This is the month that separates candidates. Set up:

• A small virtual environment (two VMs is enough — one Windows, one Linux).
• A SIEM: Microsoft Sentinel on an Azure free tier, Splunk Free, or the Elastic stack locally.
• Log forwarding from both machines into the SIEM.

Then simulate activity you can safely generate on your own machines — repeated failed logins, an unusual scheduled task, a suspicious PowerShell one-liner — and hunt for it.

Month 5: one certification, and only one

For most entry paths in India, one foundational certification is enough to get past resume filters:

• CompTIA Security+ — broadest, vendor-neutral, widely recognised.
• Microsoft SC-200 — strong signal for Sentinel-based SOCs.
• Entry blue-team certifications — practical, hands-on formats favoured by some MSSPs.

Verify current objectives and pricing on the vendor's own site before booking. Do not stack certifications instead of applying — the second certificate rarely beats the first job offer.

Month 6: portfolio, resume, applications

• Publish five triage or lab write-ups. Half a page each. Real reasoning, not tutorial screenshots.
• Rewrite your resume so the top third is your target role, your tools and your write-ups — not your objective statement.
• Apply to thirty targeted roles, not three hundred generic ones. MSSPs, GCCs and IT services security practices are the highest-volume employers of freshers.
• Show up in the places hiring managers read: post one write-up a week on LinkedIn.

Detours that cost beginners months

• Collecting courses. Three complete courses beat twelve started ones.
• Chasing offensive security first. Pentesting roles are fewer and mostly want experience. Blue team is the wider door.
• Learning tools without concepts. A tool changes every two years; how DNS works does not.
• Skipping communication practice. Interviews are spoken, not written. Freshers with equal knowledge get different outcomes because of how they explain it.
• Waiting until you feel ready. You will not. Apply while you learn.

What "ready" actually looks like

You are ready to apply when you can, without notes:

• Walk through one alert you triaged end to end.
• Explain the incident response lifecycle and where an L1 fits in it.
• Describe how you would investigate a reported phishing email.
• Talk about one thing you built and what went wrong while building it.

Next step

Test all four out loud. The free 5-question AI mock interview asks exactly this class of question and gives you a readiness score in about eight minutes — a much faster signal than another course.

Related reading

• Best certifications for freshers: CEH vs Security+ vs SC-200
• Cyber security fresher salary in India
• How to get your first SOC analyst job with no experience