kavklaw@llm ~ /learn/phase-7
← Back to Learning Path

Phase 7: Specializations & Career Paths

Certifications, career paths, home labs, CTF platforms, bug bounties, and what to do next.

07

Phase 7: Specializations & Career Paths

Which certs actually matter, what career paths exist, and how to turn CTF skills into a job.

🛤️ Career Paths in Cybersecurity

Here are the major career paths, what they involve, and which phases prepare you for each:

🔴 Penetration Tester / Red Teamer

Legally break into organizations to find vulnerabilities before criminals do. Conduct network, web, and social engineering assessments.

  • Key skills: Phases 0–5 of this path, report writing, communication
  • Certs: OSCP, PNPT, CPTS, CRTP, GPEN
  • Salary range: $85K–$160K (US)
  • Entry path: Start with bug bounties or junior pentest roles

🔵 SOC Analyst (Tier 1–3)

Monitor security alerts, triage incidents, investigate threats, and escalate confirmed incidents. The front line of defense.

  • Key skills: Phase 6 (SIEM, log analysis, IR), networking fundamentals
  • Certs: CompTIA Security+, CySA+, BTL1, GSOC
  • Salary range: $55K–$120K (US, varies by tier)
  • Entry path: Most common entry-level cybersecurity role

🟣 Incident Response / DFIR (Digital Forensics & Incident Response) Specialist

Respond to active security breaches. Perform digital forensics (recovering and analyzing evidence from computers), malware analysis, and lead remediation efforts.

  • Key skills: Phase 6 (IR, forensics), forensics, memory analysis
  • Certs: GCIH (GIAC Certified Incident Handler), GCFA (GIAC Certified Forensic Analyst), CHFI (Computer Hacking Forensic Investigator), EnCE (EnCase Certified Examiner)
  • Salary range: $90K–$170K (US)
  • Entry path: SOC analyst → IR team, or direct from forensics background

🟢 Malware Analyst / Reverse Engineer

Analyze malicious software to understand its capabilities, extract IOCs, and develop detections. Deep technical work.

  • Key skills: Assembly, C, reverse engineering, Phase 6 (malware analysis), buffer overflow
  • Certs: GREM (GIAC Reverse Engineering Malware), OSED (Offensive Security Exploit Developer), eMAL
  • Salary range: $100K–$180K (US)
  • Entry path: CTF binary/RE challenges, malware analysis practice

☁️ Cloud Security Engineer

Secure cloud infrastructure (AWS, Azure, GCP). Design secure architectures, detect misconfigurations, and respond to cloud-specific threats.

  • Key skills: Cloud platforms, IaC (Infrastructure as Code — managing servers via config files instead of manual setup), Docker/K8s security, networking
  • Certs: AWS Security Specialty, AZ-500, GCP Security, CCSP
  • Salary range: $120K–$200K (US)
  • Entry path: Cloud admin/DevOps → cloud security, or security engineer → cloud

📋 GRC (Governance, Risk & Compliance)

Ensure organizations meet security regulations and standards. Risk assessments, policy writing, audit management.

  • Key skills: Frameworks (NIST, ISO 27001, SOC2, PCI-DSS), risk management, communication
  • Certs: CISSP, CISM, CRISC, CISA, CompTIA Security+
  • Salary range: $80K–$180K (US)
  • Entry path: Less technical, more organizational — great for career changers

📜 Certifications Roadmap

Certifications validate your skills and open doors. Here's a realistic progression path:

Beginner (0–1 years experience)

  • CompTIA Security+ — The industry baseline. Required for many DoD and government positions. Covers breadth of security topics. Good first cert for any path.
  • CompTIA Network+ — If your networking fundamentals (Phase 1) need strengthening. Not security-specific but valuable foundation.
  • Google Cybersecurity Certificate (Coursera) — Free/cheap, beginner-friendly, gets you job-ready for SOC roles.
  • TryHackMe certificates — Complete the Pre-Security, Jr Penetration Tester, or SOC Level 1 paths for structured learning with certifiable completion.

Intermediate (1–3 years experience)

  • OSCP (Offensive Security Certified Professional) — The gold standard for pentesters. 24-hour practical exam. Hard but incredibly respected. Everything in Phases 0–5 prepares you for this.
  • PNPT (Practical Network Penetration Tester) — From TCM Security. Practical exam like OSCP but more realistic (includes OSINT and report writing). Good alternative/stepping stone.
  • CPTS (Certified Penetration Testing Specialist) — From HackTheBox. Practical exam with emphasis on AD attacks.
  • CompTIA CySA+ — Blue team equivalent of Security+. SOC analysis, threat detection, IR.
  • BTL1 (Blue Team Level 1) — Practical blue team cert. Phishing analysis, SIEM, forensics, threat intel.
  • eJPT / eCPPT — From INE. Junior and intermediate pentesting certs with practical exams.

Advanced (3+ years experience)

  • OSEP/OSED/OSWE — Offensive Security's advanced certs: OSEP (evasion and breaching defenses), OSED (exploit development), OSWE (web application expert). Extremely challenging.
  • CRTP/CRTE — Certified Red Team Professional/Expert from Pentester Academy. Focus on Active Directory attack chains and domain dominance.
  • CISSP — Certified Information Systems Security Professional. Management-focused, broad scope, highly valued for senior roles.
  • GIAC certs (SANS) — GIAC (Global Information Assurance Certification) certs from SANS Institute: GCIH (incident handler), GCFA (forensic analyst), GPEN (pentester), GREM (reverse engineering malware). Gold standard but expensive ($8K+ per course).
💡 Cert advice: Certifications complement experience, they don't replace it. An OSCP with no practical experience is less valuable than someone who's solved 50 HTB machines and has a portfolio of writeups. Get hands-on experience first, use certs to validate and formalize your knowledge.

🏠 Building a Home Lab

A home lab is where you practice freely. No rules, no scope limitations, full control. Here's how to build one:

# Minimal Home Lab (runs on any modern laptop):
# ─────────────────────────────────────────────
# 1. Kali Linux VM (attacker)
# 2. Vulnerable VMs:
#    - Metasploitable 2/3 (intentionally vulnerable Linux)
#    - DVWA (Docker: docker run -d -p 8080:80 vulnerables/web-dvwa)
#    - VulnHub machines (download OVAs from vulnhub.com)
#    - HTB/THM (via VPN from your Kali VM)
# 3. Windows VM (if you have a license):
#    - Windows 10/11 evaluation (free 90-day trial from Microsoft)
#    - Install Sysmon for enhanced logging
#    - Disable Windows Defender for testing

# AD Lab (needs 16GB+ RAM):
# ─────────────────────────────────────────────
# 1. Windows Server 2019/2022 (evaluation, free 180 days)
#    - Install Active Directory Domain Services
#    - Create domain: lab.local
#    - Add users, groups, misconfigured ACLs
# 2. Windows 10/11 workstations (2x, joined to domain)
# 3. Kali Linux (attacker, separate network)
# 
# Automated setup:
# - DetectionLab (https://github.com/clong/DetectionLab)
#   Pre-built AD lab with logging, Splunk, Fleet, Velociraptor
# - GOAD (Game of Active Directory) — multiple misconfigured domains
# - PurpleCloud — Terraform-based Azure AD lab

# Blue Team Lab additions:
# ─────────────────────────────────────────────
# - ELK Stack (Docker) — SIEM for log aggregation
# - Wazuh — Open-source XDR/SIEM
# - Security Onion — Full NSM (Network Security Monitoring) platform
# - Sysmon on Windows VMs — Enhanced process/network logging
# - pfSense/OPNsense — Firewall/IDS between network segments

🎮 CTF Platforms — Where to Practice

These platforms provide legal, safe environments to practice everything you've learned:

HackTheBox

The gold standard for pentesting practice. Realistic machines, challenges, and Prolabs (enterprise-scale networks). Active machines = no writeups allowed (learn independently). Retired machines = writeups available.

Best for: Phases 2–5, OSCP prep

TryHackMe

Guided, beginner-friendly learning paths. Structured rooms with instructions. Great for following this learning path — they have rooms for almost every topic we cover.

Best for: All phases, structured learning, beginners

OverTheWire

Classic wargames focused on Linux command line, networking, and binary exploitation. Bandit (beginner) through Vortex (advanced). Free, SSH-based.

Best for: Phase 1 (Linux CLI, networking), binary exploitation

PicoCTF

Carnegie Mellon's beginner-friendly CTF. Jeopardy-style challenges: web exploitation, reverse engineering, forensics, crypto. Great for students.

Best for: Beginners, students, CTF introduction

PortSwigger Web Academy

The absolute best free resource for web application security. Interactive labs for every web vulnerability type. Created by the makers of Burp Suite.

Best for: Phase 3 (Web Exploitation), deep web security

CyberDefenders

Blue team CTF challenges. PCAP analysis, memory forensics, log analysis, malware triage. The best free resource for defensive skill practice.

Best for: Phase 6 (Blue Team), DFIR practice

🐛 Bug Bounty Programs

Bug bounty programs pay you to find vulnerabilities in real-world applications. They're the bridge between CTF practice and professional pentesting:

  • HackerOne — Largest platform. Companies like GitHub, Shopify, GitLab, PayPal, Uber. Start with their "Hacker101" training.
  • Bugcrowd — Second largest. Good "vulnerability rating taxonomy" that helps you learn severity assessment.
  • Intigriti — European platform, growing fast. Regular "bug bounty tips" content.
  • Direct programs: Google, Apple, Microsoft all have their own bug bounty programs with potentially massive payouts.
💡 Bug bounty tips for beginners:
• Start with programs that have a wide scope (e.g., *.company.com)
• Focus on one vulnerability class at a time — get really good at XSS before moving to SSRF
• Read published reports (HackerOne Hacktivity) to learn what real findings look like
• Subdomain enumeration and recon are your competitive advantage — find targets others miss
• Write clear, reproducible reports — a well-written report is more likely to be accepted and rewarded
• Our guides are directly applicable: Burp Suite, Web Enumeration, API Testing, OSINT

🔧 Contributing to Open Source Security

Contributing to security tools builds your skills, your reputation, and your portfolio. Great projects to contribute to:

  • Nmap — Write NSE (Nmap Scripting Engine) scripts for new service detection or vulnerability checks
  • Metasploit — Write exploit modules for published CVEs (Common Vulnerabilities and Exposures — the standard IDs for known security bugs, like CVE-2024-1234)
  • Sigma — Write detection rules for new attack techniques
  • Nuclei — Write templates for vulnerability scanning (Nuclei is a fast, template-based scanner that checks for thousands of known issues)
  • OWASP projects — ZAP proxy, Juice Shop, Testing Guide, Cheat Sheet Series
  • BloodHound — Custom queries, attack path analysis, documentation
  • Write your own tools — Solve a problem you've encountered, publish it on GitHub, write about it

📝 Building Your Portfolio

In cybersecurity, your portfolio matters more than your resume. Here's what to build:

  • CTF writeups — Document every box you solve. Explain your thought process, not just the commands. This proves you can think and communicate.
  • Blog posts — Write about techniques, tool comparisons, vulnerability research. Teaching others demonstrates mastery.
  • GitHub presence — Custom tools, scripts, Sigma rules, nuclei templates. Shows you can code and contribute.
  • Certifications — OSCP, Security+, BTL1 — formal validation of your skills.
  • Bug bounty findings — Even low-severity findings on public programs demonstrate real-world impact.
  • Home lab documentation — Detailed setup guides for your AD lab, SIEM, etc. Shows initiative and technical depth.

🗺️ Where to Go From Here

You've completed the learning path. Here's what to do next, in order:

  1. Practice daily. Solve at least one box or challenge per week. Consistency beats intensity.
  2. Build your lab. Set up an AD environment and a SIEM. Break things, detect things, fix things.
  3. Get your first cert. Security+ if you're starting out. OSCP if you're going offensive. BTL1 if you're going defensive.
  4. Write writeups. Document everything you learn. Publish them. Get feedback.
  5. Join communities. Discord servers (HackTheBox, TryHackMe, InfoSec Prep), Reddit r/netsec, Twitter/X InfoSec community.
  6. Apply for jobs. Don't wait until you feel "ready" — junior roles exist for a reason. You know more than you think.

🏋️ Practical Exercises

  1. Career research: Pick 2 career paths from the grid above. Find 5 job postings for each on LinkedIn/Indeed. Note the required skills, certifications, and experience levels.
  2. Home lab: Build a minimal home lab with Kali + one vulnerable VM + DVWA in Docker. Document your setup process as a blog post.
  3. CTF challenge: Complete 5 challenges on PicoCTF or CyberDefenders. Write up each one with your methodology.
  4. Bug bounty recon: Pick a bug bounty program on HackerOne. Perform full reconnaissance (subdomains, ports, technologies) without testing for vulnerabilities. Document your findings.
  5. Cert study plan: Choose one certification to pursue. Create a 3-month study plan with weekly goals, resources, and practice exercises.

📚 Complete Resource Index

Everything on this site, organized by category:

Guides (All 22)
Cheat Sheets (All 12)
📝

Phase 7 Checkpoint

0 / 4
Which certification is widely considered the gold standard entry-level certification for penetration testers?
The OSCP is widely regarded as the gold standard for proving hands-on pentesting skills. Its 24-hour practical exam requires you to compromise multiple machines — no multiple choice. Security+ is a great foundation but covers breadth, not depth. CEH is mostly theoretical. CISSP is management-focused. OSCP proves you can actually hack.
Scenario: You're a junior security professional trying to break into the industry. You have limited budget and 6 months to prepare. Which combination of activities would best prepare you for your first cybersecurity job?
The best approach combines practical hands-on work (boxes/challenges), a foundational certification (Security+), portfolio building (writeups, blog, GitHub), and active job hunting. SANS is excellent but extremely expensive ($8K+ per course). CISSP requires 5 years of experience. Theory without practice won't convince employers. The balanced approach shows both knowledge and initiative.
Match the career path to its primary focus area:

A SOC Analyst primarily focuses on:
A SOC Analyst is the front line of defense — they monitor SIEM dashboards, triage security alerts (true/false positive determination), investigate suspicious activity, and escalate confirmed incidents to the IR team. It's the most common entry-level cybersecurity role and builds foundational skills for many other paths. Breaking into systems = pentester. Policies = GRC. Malware RE = malware analyst.
Why is writing CTF writeups valuable for your cybersecurity career? (Select the BEST answer)
Writeups serve multiple purposes: (1) Teaching forces deeper understanding — if you can't explain it, you don't fully understand it, (2) They demonstrate communication skills — critical for pentesting reports and SOC documentation, (3) They build a public portfolio that employers can review, (4) They contribute to the community and establish your professional presence. The ability to document and communicate technical findings is as important as the technical skills themselves.

🎓 End of the Learning Path

You've covered offensive security, defensive security, and career fundamentals. Now go build experience. Solve boxes. Write reports. Break things. Detect things.

The material is here. The practice is on you.

← Phase 6: Blue Team All Phases