Most people learning cyber security waste months collecting courses and certificates in no useful order, then find they cannot read a packet capture, explain a Kerberos ticket or write a ten-line script. This guide sets out a staged roadmap: foundations first (networking, operating systems, scripting), then core security concepts, then one specialisation track chosen deliberately. It uses the NICE Framework (NIST SP 800-181 Rev. 1) and the UK Cyber Security Council's specialism structure as anchors, so the skills you build line up with how employers describe real jobs. It is written for career starters, career changers from IT or development, and managers building training plans for junior staff. It deliberately does not repeat our certification and career guides: it links them where they fit.
Key takeaways
- Foundations decide your ceiling. Networking, Windows and Linux internals and basic scripting underpin every specialism; skipping them is the most common reason learners stall at intermediate level.
- Anchor on a recognised framework. The NICE Framework describes cyber security work as Task, Knowledge and Skill statements grouped into work roles, which gives you a checklist that employers also use.
- Pick one track after the core stage, not before. SOC and detection, cloud, application security, GRC, identity and NHI, OT and offensive testing each need different depth; a deliberate choice beats sampling all of them.
- Certifications validate, they do not teach the job. Use them at stage boundaries to prove a level, and choose them for the track you picked.
- Evidence beats claims. A home lab, written-up investigations, detection rules and small tools show what you can do far better than a list of courses.
Using the NICE Framework and UK specialisms as anchors
A roadmap needs a reference point outside any one training provider. Two public frameworks work well because employers, educators and government bodies use them to describe jobs.
- NICE Framework (US, NIST): NIST SP 800-181 Rev. 1, the Workforce Framework for Cybersecurity, was published in November 2020 and describes cyber security work through Task statements, with Knowledge and Skill statements describing what a person needs to perform them. NIST now publishes the detailed components (work roles, TKS statements and competency areas) separately on its Current Versions page; the version shown there when this guide was checked was 2.2.0. The NICCS summary of Components v1.0.0 (March 2024) lists 7 Work Role Categories, 52 Work Roles, more than 2,200 TKS statements and 11 Competency Areas.
- How to use NICE as a learner: pick the work role that matches your target job (for example Defensive Cybersecurity, Security Control Assessment, Privacy Compliance or Systems Security Management), download the components, and turn its Knowledge and Skill statements into a personal checklist. Mark each statement as not started, learning, or demonstrated with evidence.
- UK Cyber Security Council: the Council's professional standards define three professional titles, Associate, Principal and Chartered, aligned to sixteen cyber security specialisms, with registration assessed by licensed bodies (The Cyber Scheme, for example, assesses the Security Testing specialism). Use the specialism names when you describe your target role on a CV in the UK, and check the Council's current list before applying for registration, because the scheme is still developing.
- What the frameworks are not: neither is a syllabus. They tell you what a competent person can do; you still need hands-on practice to get there.
The NICE work role categories include Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation. The table maps the roadmap's tracks to those categories so you can find the matching work roles.
| Roadmap track | Closest NICE work role category | Typical first job titles | NHI Mgmt Group career guide |
|---|---|---|---|
| SOC and detection | Protection and Defense | SOC analyst, junior detection engineer | SOC Analyst Career Guide, Detection Engineer Career Guide |
| Incident response and forensics | Investigation, Protection and Defense | DFIR analyst, incident responder | DFIR Analyst Career Guide |
| Cloud security | Implementation and Operation, Design and Development | Cloud security engineer | Cloud Security Engineer Career Guide |
| Application security | Design and Development | AppSec engineer, security champion | Application Security Engineer Career Guide |
| GRC and assurance | Oversight and Governance | GRC analyst, control assessor | GRC Analyst Career Guide |
| Identity and NHI | Implementation and Operation, Design and Development | IAM engineer, identity analyst | IAM Engineer Career Guide |
| OT security | Protection and Defense, Design and Development | OT security engineer | OT Security Engineer Career Guide |
| Offensive testing | Protection and Defense (vulnerability assessment work) | Penetration tester | Penetration Tester Career Guide |
The category mapping is a guide to where to look, not an official crosswalk: several tracks span more than one category, and NIST revises roles between component versions. See the Cybersecurity Careers Guide for the full role landscape.
Stage 1: Foundations
Expect this stage to take longest if you come from outside IT. The test of completion is practical: can you explain and demonstrate each item without notes? The NHI Mgmt Group foundations explainers form a learning path in the order below.
| Area | You should be able to | Learning path |
|---|---|---|
| Security concepts | Explain confidentiality, integrity and availability with a real example of each failing | CIA Triad Guide |
| Networking models | Place a protocol on the OSI and TCP/IP layers and say what a firewall or proxy at each layer can see | OSI and TCP/IP Models Guide |
| Networking practice | Read IP addressing and subnets, follow a TCP handshake, explain DNS resolution, DHCP, NAT and common ports (22, 53, 80, 443, 445, 3389) | Networking Fundamentals for Defenders Guide, DNS Security Guide |
| Windows | Explain processes, services, the registry, local and domain accounts, tokens and where security events are logged | Windows Internals for Defenders Guide, Windows Event Log Guide |
| Linux | Navigate the file system, manage users, groups and permissions, read systemd units and journald, use SSH keys safely | Linux Fundamentals for Defenders Guide, Linux Logging and auditd for Defenders Guide |
| Cryptography basics | Tell hashing from encryption, explain symmetric and asymmetric keys, salts and why MD5 and SHA-1 are retired for integrity | Hashing Guide, Cryptography Basics Guide |
| PKI | Read a certificate chain, explain what a CA vouches for, and why expiry and revocation matter | PKI Basics Guide, Certificate Transparency Guide |
| Scripting | Write short Python, PowerShell or Bash scripts that parse a log file, call a REST API and output CSV or JSON | Practise in the lab from the Building a Cybersecurity Home Lab Guide |
- Scripting choice: learn one language well before a second. PowerShell is a cross-platform shell and scripting language that returns .NET objects rather than text, which makes it the natural choice for Windows and Microsoft cloud work; Python dominates data handling, automation and most security tooling; Bash is unavoidable on Linux hosts.
- Exit test for stage 1: capture your own traffic, explain every protocol in a five-minute sample, and write a script that summarises failed logons from a log file.
Stage 2: Core security
Core security is the shared language of every track. Learn it before specialising, because the specialisms assume it.
- Identity and access: authentication factors, MFA and phishing resistance, authorisation models, Active Directory basics (Kerberos, groups, Group Policy), and the difference between human and non-human identities. See the MFA Guide and Kerberos Security Guide.
- Attacker behaviour: read MITRE ATT&CK as a catalogue of behaviours. Start with a handful of techniques you can observe in a lab: PowerShell (T1059.001), Scheduled Task (T1053.005), Valid Accounts (T1078), Password Spraying (T1110.003) and LSASS Memory (T1003.001). Know what each looks like in logs, not how to perform it outside an authorised lab.
- Logging and monitoring: what a SIEM does, what endpoint telemetry adds (Sysmon event ID 1 process creation, 3 network connection, 22 DNS query), and how network telemetry such as Zeek connection logs differs from packet capture. See the SIEM Guide.
- Vulnerabilities and hardening: CVE and CVSS, exploited-in-the-wild prioritisation (CISA KEV), baselines such as CIS Benchmarks and Microsoft security baselines, patching. See the Risk-Based Vulnerability Management Guide.
- Web basics: HTTP, cookies and sessions, and the OWASP Top 10 categories. See the OWASP Top 10 Guide.
- Governance basics: what NIST CSF 2.0, ISO/IEC 27001 and CIS Controls are for, and what a risk register records. See the CIS Controls Guide.
- Incident handling: the incident lifecycle, evidence handling and why you never "clean up" before collecting. See the Incident Response Guide.
Exit test for stage 2: given a short scenario (a phishing email, a suspicious logon, an exposed storage bucket), you can say which logs to check, which ATT&CK technique it resembles, which control should have prevented it and who you would tell.
Stage 3: Specialisation tracks
Choose one track and go deep for six to twelve months. The table lists what "deep" means at junior specialist level and a first project that produces evidence.
| Track | Skills to build | First evidence project | Tool and topic guides |
|---|---|---|---|
| SOC and detection | Alert triage, log query languages, detection logic, false positive tuning, ATT&CK mapping | Write and test five Sigma rules against your own lab telemetry, with a false positive note for each | Sigma Rules Guide, Detection Engineering Guide, KQL for Threat Hunting Guide |
| Incident response and forensics | Triage collection, timeline building, Windows artefacts, memory basics, report writing | Investigate a simulated intrusion in your lab and write a timeline report | Windows Forensic Artefacts Guide, Sysinternals for Incident Responders Guide |
| Cloud security | Cloud IAM, logging (CloudTrail, Activity Log, Cloud Audit Logs), network controls, posture checks, infrastructure as code | Build a small workload with infrastructure as code, then review its IAM and logging against a benchmark | Cloud Security Guide, AWS Security Guide |
| Application security | Secure code review, threat modelling, SAST and dependency scanning, OWASP ASVS requirements | Fix and document findings in an intentionally vulnerable training application inside your lab | Application Security Guide, DevSecOps Guide |
| GRC and assurance | Control frameworks, risk assessment, policy writing, audit evidence, supplier assessment | Map a small organisation's controls to NIST CSF 2.0 and write the gap list | ISO 27001 Certification Guide, NIST CSF to ISO 27001 Mapping Guide |
| Identity and NHI | Federation (SAML, OIDC, OAuth 2.0), directory services, privileged access, service accounts, API keys and workload identity | Inventory every service account, token and key in your lab, assign owners and rotate them | Human vs Non-Human Identity, Secrets Management Guide |
| OT security | Industrial protocols, Purdue-style zoning, safety constraints, passive monitoring | Document a segmented reference architecture and its monitoring points | OT Security Guide, NIST SP 800-82 OT Security Guide |
| Offensive testing | Methodology, scoping and rules of engagement, reporting, privilege escalation concepts | Complete authorised labs on a legal training platform and write a professional report | Kali Linux for Authorised Testing Guide, Cyber Ranges, CTFs and Hands-On Training Guide |
Choosing a track
- From IT operations or service desk: SOC and detection or identity are the shortest routes, because you already know the systems that generate the logs and the accounts.
- From software development: application security or cloud security reuse your code and pipeline skills.
- From audit, legal, risk or project roles: GRC builds on what you have, but still complete stages 1 and 2: assessors who cannot read a technical control are easy to mislead.
- From engineering or industrial settings: OT security values plant and safety knowledge that pure IT candidates lack.
- Offensive testing: attractive but crowded at entry level, and it depends on strong defensive foundations; many testers start in operations or SOC roles.
- Small vs large employers: small organisations need generalists who cover several tracks lightly; large organisations and consultancies hire specialists. If your target is a small employer, broaden stage 2 rather than going very deep in one track.
Where identity and NHI fit
Identity is not just one track: it runs through every other one. SOC analysts investigate account misuse, cloud engineers spend much of their time on IAM policies and roles, AppSec engineers review how applications store API keys, and OT engineers manage shared and vendor accounts. Non-human identities (service accounts, API keys, OAuth applications, certificates and workload identities) are a growing share of that work, and learners rarely meet them in introductory courses.
- Minimum for every track: know what a service account, an OAuth client, an access token and a client secret are, and why long-lived static keys are risky.
- Worked example: the Microsoft Midnight Blizzard breach combined a password spray against a legacy test tenant account without MFA with a test OAuth application that had elevated access. Understanding that chain needs identity, cloud and detection knowledge together.
- Going deeper: see the NHI Authentication Guide and the Identity Certifications Guide.
How certifications fit
Certifications are checkpoints on the roadmap, not the roadmap itself. Use them to show an employer that you have reached a stage, and choose the next one only after you have picked a track.
| Roadmap point | What a certification should prove | Where to compare options |
|---|---|---|
| End of stage 2 | Broad entry-level knowledge across core security | ISC2 Certified in Cybersecurity (CC) Guide, Cybersecurity Certifications Guide |
| Early in a defensive track | Hands-on triage and investigation | Blue Team Certifications Guide |
| Cloud track | Provider-specific security configuration | AWS Certified Security Specialty Guide, Microsoft Security Certifications Guide, CCSK Certification Guide |
| Offensive track | Practical, exam-under-time testing skill | OSCP Certification Guide, Practical Red Team Certifications Guide |
| GRC and audit track | Assurance and governance knowledge | CISA Certification Guide, CRISC Certification Guide |
| Several years in | Broad management-level competence with experience requirements | CISSP Certification Guide, CISM Certification Guide |
Exam formats, fees, experience requirements and renewal rules are in each linked guide, checked against the certifying body's own pages.
A phased plan and how to measure progress
The plan below assumes roughly ten hours a week alongside other work. Adjust the pace, not the order.
- Baseline (week 1): choose a target NICE work role or UK specialism, download the NICE components, and score yourself against the Knowledge and Skill statements. This is your starting measurement.
- Build the lab (weeks 1 to 3): set up an isolated virtual lab with snapshots before you study anything that needs one. See the Building a Cybersecurity Home Lab Guide.
- Foundations (months 1 to 4): work through the stage 1 table in order, with one lab exercise per topic. Pass the stage 1 exit test before moving on.
- Core security (months 4 to 7): cover the stage 2 list, add logging to the lab, and reproduce and detect at least three ATT&CK techniques against your own machines.
- Checkpoint: take an entry-level certification if you need one for applications, and rescore yourself against your chosen work role.
- Specialise (months 7 to 12 and beyond): complete the first evidence project for one track, then two more of increasing difficulty. Publish write-ups that contain no real organisation's data.
- Course correction: if a track is not working after about three months, return to the stage 2 checkpoint and choose again. Skills from stages 1 and 2 transfer completely, so little is lost.
Metrics that show the plan is working
- Statement coverage: percentage of your target work role's Knowledge and Skill statements marked "demonstrated with evidence".
- Lab output: number of documented lab exercises per month, each with a written result.
- Detection or finding quality: for defensive tracks, rules written and tested with a false positive rate noted; for AppSec and testing, findings reported with a reproducible fix.
- Explain-back rate: topics you can explain aloud without notes in five minutes, tested monthly.
- Scripting reuse: scripts you have written and used more than once.
Framework mapping for managers and training leads
If you are building this roadmap for a team rather than yourself, it sits under the workforce and training controls of the main frameworks.
| Framework | Reference | How the roadmap supports it |
|---|---|---|
| NIST CSF 2.0 | PR.AT-01, PR.AT-02 | General training for all staff, role-based training for specialists (stages 2 and 3) |
| NIST CSF 2.0 | GV.RR-04 | Cyber security included in human resources practices: hiring and development plans tied to work roles |
| NIST SP 800-53 Rev. 5 | AT-2, AT-3 | Literacy training and awareness, role-based training |
| NIST SP 800-53 Rev. 5 | PM-13, PM-14 | Security and privacy workforce development; testing, training and monitoring activities |
| ISO/IEC 27001:2022 | Annex A 6.3 | Information security awareness, education and training |
| CIS Controls v8.1 | Control 14 | Security awareness and skills training, including role-specific training |
| NICE Framework | Work roles and TKS statements | Defines the target competencies for each job and the evidence of progress |
Common failure patterns
- Tool-first learning: learning a product's buttons without the protocol or operating system underneath. When the tool changes, the skill disappears. Fix: every tool exercise starts with the raw log or packet.
- Certificate collecting: stacking entry-level certificates instead of moving to a track. Employers read three foundation certificates as one level of skill. Fix: one certificate per stage boundary.
- Jumping straight to offensive content: exploit tutorials without networking, Windows and identity foundations produce people who can follow walkthroughs but cannot explain results. Fix: complete stages 1 and 2 first.
- Ignoring identity: treating identity as someone else's speciality, then missing that most cloud and SaaS incidents begin with credentials, tokens or misused applications, as the Midnight Blizzard case shows.
- No written evidence: months of labs with nothing to show. Fix: write up each exercise in a page: goal, set-up, what you saw, what you would detect or fix.
- Unsafe practice: testing systems you do not own or authorise, or publishing write-ups containing employer data. Unauthorised access is a criminal offence in the UK under section 1 of the Computer Misuse Act 1990, and in most other jurisdictions. Keep all practice inside your own lab or on platforms that grant explicit permission.
Practitioner checklist
- Choose one target NICE work role or UK Cyber Security Council specialism and record it.
- Score yourself against its Knowledge and Skill statements and repeat the scoring every quarter.
- Build an isolated home lab with snapshots before starting hands-on topics.
- Complete the stage 1 foundations path in order and pass its exit test.
- Learn one scripting language to the point of parsing logs and calling APIs.
- Cover the stage 2 core topics, including identity and non-human identities.
- Reproduce and detect at least three ATT&CK techniques against your own lab machines.
- Pick one specialisation track deliberately and complete three evidence projects.
- Add certifications only at stage boundaries, chosen for your track.
- Keep a portfolio of write-ups with no real organisation's data in them.
Standards and references
- NIST: SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework)
- NIST: NICE Framework Current Versions
- CISA NICCS: NICE Framework
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- The Cyber Scheme: UK Cyber Security Council Professional Registration
- Microsoft Learn: What is PowerShell?
- legislation.gov.uk: Computer Misuse Act 1990, section 1
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · Cybersecurity Certifications Guide · Building a Cybersecurity Home Lab Guide · Cyber Ranges, CTFs and Hands-On Training Guide