A free, open-source handbook covering 36 cybersecurity roles across offensive security, defensive security, and GRC. Each role comes with the skills, tools, certifications, a real-world scenario, and the career progression you can expect.
Second Edition · Written for students, career changers, and junior security professionals
→ Read the interactive book & PDF edition on Vault Reader
🔴 Offensive Security (12 Roles) | 🔵 Defensive Security (24 Roles) | ⚖️ GRC (Chapter 4)
🧭 Find Your Path | 📋 Career Tracker | 🗺️ Certification Roadmaps | 🛠️ Tools Reference | ❓ FAQ | 🤝 Contributing
Important
The offensive techniques in this handbook are for authorized, ethical security testing only. Testing systems without written permission from the owner is illegal in almost every jurisdiction. Read the full disclaimer before you practice anything.
This edition is a ground-up rewrite, not a patch on the original. Here is what changed:
- 36 roles (up from 35), with the addition of AI and ML Penetration Testing to reflect the rapid growth of adversarial AI
- 150+ curated tools (up from 100+), verified for current relevance and mapped to skill levels
- 50+ certifications organized into three-tier roadmaps (Beginner, Intermediate, Advanced) per domain
- 10 architecture diagrams covering attack lifecycles, defense-in-depth, DevSecOps pipelines, and GRC frameworks
- Interactive Career Tracker with a forkable checklist you can use as a public study log
- Modular chapter structure, so each chapter lives in its own file for easier navigation and contribution
- "Find Your Path in 60 Seconds" table for quick role matching based on your interests
- Community templates for role proposals, resource updates, and structured pull requests
Every role in this handbook, grouped by pillar and experience tier. Click the diagram to read the overview.
A lot of people get into cybersecurity with a vague goal like "learn hacking" or "work in security". Months later, plenty of them find out the job they pictured looks nothing like the real thing. Someone aiming for red teaming discovers they love the analytical side of threat intelligence. Someone who started in compliance ends up obsessed with malware analysis.
This handbook is meant to help you figure that out before you commit a year of study. It splits the field into three pillars and 36 roles, and it walks through every role the same way, so you can compare them side by side and choose based on how the work actually looks day to day.
It's written for:
- 🎓 Students who want a clear map of the field before picking a direction
- 🔄 Career changers coming from IT, development, networking, law, or something unrelated
- 🛡️ Junior security professionals deciding where to specialize next
- 🧑🏫 Mentors and educators who need a structured, free reference to point people to
Pick the row that sounds most like you. Each starting point and first milestone below comes straight from that role's certification roadmap in the handbook.
| If you enjoy... | Start with | Tier | First milestone | Read |
|---|---|---|---|---|
| Finding hidden flaws and thinking like an attacker | Network Penetration Testing | Baseline | CompTIA Security+ | 2.1.1 |
| Breaking web apps and hunting bugs for bounties | Web App Pentesting or Bug Bounty Hunting | Baseline | PortSwigger Web Academy | 2.1.3 · 2.1.2 |
| Testing AI systems and LLM applications | AI and ML Penetration Testing | Baseline | Google ML Crash Course | 2.1.4 |
| Watching for attacks and responding fast | Security Operations (SOC) | Baseline | CompTIA Security+ | 3.1.5 |
| Writing code and shipping secure software | Application Security (AppSec) | Baseline | CompTIA Security+ | 3.1.1 |
| Building and securing cloud infrastructure | Cloud Security | Specialized | AWS Cloud Practitioner | 3.2.5 |
| Reconstructing exactly what happened after a breach | Digital Forensics | Specialized | GCFE (GIAC) | 3.2.1 |
| Digging up information from public sources | Open Source Intelligence (OSINT) | Advanced | OSINT Fundamentals (TCM Security) | 3.3.6 |
| Policy, risk, and how security fits the business | Governance, Risk, and Compliance | GRC | CompTIA Security+, then CISA | Ch. 4 |
Still not sure? Take the five-question self-assessment in Chapter 5.1, then compare the pillars in the path comparison table.
Every one of the 36 roles follows the same structure, so comparing two careers is a matter of reading two sections side by side.
| Section | What you get |
|---|---|
| Definition | What the job involves day to day, in plain language |
| Why It Matters | The real-world impact and business value of the role |
| Skills Table | Key skills, expected proficiency (Foundational, Intermediate, Advanced), and why each one matters |
| Tools Table | The tools practitioners actually use, what they're for, and the skill level they need |
| Real-World Scenario | A realistic incident or engagement that shows the role in action |
| Certification Roadmap | Beginner, intermediate, and advanced certifications in a grid |
| Career Progression | A typical path from entry level to senior roles |
| Key Takeaway | The single most important thing to remember about the role |
| Track & Pillar | Scope | Core Focus & Highlighted Roles | Direct Link |
|---|---|---|---|
| 🔴 Offensive Security | 12 Roles | Network Pentesting, Bug Bounties, Web Apps, AI/ML Pentesting, Cloud, Mobile, IoT/OT, Wireless, ICS, Exploit Dev, Malware & C2, Red Teaming | Explore Chapter 2 → |
| 🔵 Defensive Security | 24 Roles | AppSec, SOC Operations, Incident Response, Digital Forensics, DevSecOps, Cloud Security, ICS Security, Cryptography, Detection Engineering, Malware Analysis, Threat Hunting, OSINT | Explore Chapter 3 → |
| ⚖️ Governance, Risk & Compliance | 7 Topics | Governance Frameworks, Risk Management, Compliance, Risk Assessments, GRC Tooling, Regulatory Frameworks, GRC Career Strategy | Explore Chapter 4 → |
| 🧭 Career Journey & Roadmaps | Foundations | Self-Assessment, Path Comparison, Month-by-Month Learning Roadmaps, Home Lab Guide, Shared Core Skills | Explore Chapter 5 → |
| 📚 Reference Appendices | 4 Guides | Certification Matrix by Domain, Consolidated Tools Reference, Recommended Learning Platforms & Reading, Glossary | Explore Appendices → |
Click to expand or collapse the complete 36-role Table of Contents
- Foreword: Why This Handbook Exists and Who It Is For
- How to Use This Handbook: Navigation Guide and Reading Conventions
- Chapter 1: Understanding the Cybersecurity Landscape
- Chapter 2: The Offensive Security Path (12 Roles)
- Chapter 3: The Defensive Security Path (24 Roles)
- Section 3.1: Baseline Defensive Operations
- Section 3.2: Specialized Defensive Operations
- 3.2.1 Digital Forensics
- 3.2.2 Incident Response
- 3.2.3 DevSecOps
- 3.2.4 Secure Coding
- 3.2.5 Cloud Security
- 3.2.6 Cloud Security Engineering
- 3.2.7 Cloud Security Operations
- 3.2.8 Cloud Digital Forensics and Incident Response
- 3.2.9 ICS Security Operations
- 3.2.10 ICS Digital Forensics and Incident Response
- 3.2.11 Cryptography
- Section 3.3: Advanced Defensive Operations
- Chapter 4: Governance, Risk, and Compliance (GRC)
- Chapter 5: Charting Your Cybersecurity Journey
- Appendix A: Certification Roadmap by Domain
- Appendix B: Consolidated Tools Reference
- Appendix C: Recommended Learning Resources
- Appendix D: Glossary of Key Terms
The handbook includes ten diagrams that show how the work actually flows. Each link opens the section where the diagram appears.
| # | Diagram | Read it in |
|---|---|---|
| 1 | Cybersecurity Career Paths: The Complete Landscape | 1.4 Career Paths Overview |
| 2 | Offense and Defense Collaboration: The Purple Team Model | 1.5 Offense and Defense Relationship |
| 3 | The Attacker Lifecycle: 12 Phases Based on MITRE ATT&CK | Chapter 2 Introduction |
| 4 | Network Penetration Testing Workflow | 2.1.1 Network Penetration Testing |
| 5 | Red Team Operation Lifecycle | 2.3.3 Red Teaming |
| 6 | The Incident Response Lifecycle | Chapter 3 Introduction |
| 7 | Defense-in-Depth Network Architecture | 3.1.3 Network Security Engineering |
| 8 | Secure DevSecOps CI/CD Pipeline | 3.2.3 DevSecOps |
| 9 | The Threat Intelligence Production Lifecycle | 3.3.4 Threat Intelligence |
| 10 | The GRC Framework: From Board Strategy to Operational Control | Chapter 4 Introduction |
Reading about a career is the easy part. The Career Readiness Tracker turns this handbook into a checklist you can actually work through:
- Phase 0: Core technical foundations (operating systems, networking, scripting)
- Phase 1: Home lab setup and practice platforms
- Phase 2: Pick a pillar and go deep, with target certifications for each path
- Phase 3: Portfolio and professional presence
How to use it: fork this repository, open TRACKER.md in your fork, and change [ ] to [x] as you finish each item. Your fork becomes a public record of your progress, which is handy to share with mentors or recruiters.
Is this cybersecurity handbook really free?
Yes. Everything here is released under the Creative Commons Attribution 4.0 License. You can read it, share it, translate it, or adapt it, including for courses and study groups, as long as you give attribution. An interactive edition is also available on Vault Reader.
I have no IT background. How do I start a career in cybersecurity?
Start with Chapter 1 to understand the landscape, then go to 5.5 Foundation Skills Every Path Shares and 5.4 Building Your Home Lab. Networking, Linux, and basic scripting come before any specialization. The Career Readiness Tracker breaks this into concrete steps.
Which cybersecurity path has the most job openings?
According to the handbook's path comparison, defensive security has the largest volume of open roles, and SOC analyst positions are among the most accessible entry points. Offensive security is more competitive at entry level, but specialized skills command a premium. GRC is growing quickly, especially in regulated industries.
Do I need to know programming to work in cybersecurity?
It depends on the path. Offensive security needs programming, especially at advanced levels. Defensive security needs a moderate amount, mostly scripting for automation. GRC needs very little, since the work is analytical, legal, and advisory. See the path comparison for details.
Which cybersecurity certification should I get first?
CompTIA Security+ is the beginner credential listed for all three domains in Appendix A, and both the defensive and GRC roadmaps start with it. The offensive roadmap starts with networking fundamentals such as Network+, then moves to eJPT and later OSCP. Check the certification roadmap inside the specific role you're targeting before you pay for an exam.
How long does it take to become job-ready?
There's no fixed answer, since it depends on your background and how much time you put in. The learning roadmaps in 5.3 are laid out as months 1-3 for foundations, months 4-8 for core skills, months 9-15 for specialization, and year 2 onward for advanced work. Treat that as a pace guide, not a deadline.
Is it legal to learn ethical hacking and offensive security?
Learning is legal. Practicing on systems you don't own, or don't have written permission to test, is not. Use your own home lab and legal practice platforms such as TryHackMe, HackTheBox, and PortSwigger Web Security Academy. A full list is in Appendix C.
Can I translate this handbook or suggest a missing role?
Yes, both are very welcome. Translations, new roles, and tool or certification updates are all covered in the contribution guide. You can also open a Role Proposal directly.
This handbook is a living open-source project maintained for the global cybersecurity community.
- Found a broken link or outdated tool? Report it through the Resource Update Form.
- Want to propose an emerging role or specialization? Submit a Role Proposal.
- Want to contribute directly? Read the contribution guide for the role format and submission workflow.
- Career questions and mentorship: Join the conversation on GitHub Discussions.
- Security concerns? See the security policy for responsible disclosure.
- Community standards: Read the code of conduct.
- Support the project: If this handbook helped you, starring the repository helps more aspiring professionals find it.
More free resources from the same author, if you want to keep going after you've picked a path:
| Project | What it is | Stars |
|---|---|---|
| 🥷 The BlackHAT Roadmap | An in-depth hacking and penetration testing roadmap from beginner to elite, with 150+ visual diagrams | |
| 🎯 Penetration Testing Roadmap | A structured 60-week curriculum for penetration testing and ethical hacking, with 500+ free TryHackMe rooms | |
| 📚 Awesome Cybersecurity Books | A curated shelf of 70+ security and fundamentals books, organized by domain and difficulty | |
| 📓 Research Notebooks & Field Manuals | Technical notebooks and field manuals on security, networking, and programming, with an in-browser reader | - |
The easiest way to help this project grow is to share it with someone who is figuring out their next step in cybersecurity. Here are some quick share links:
This handbook is intended for educational and professional development purposes only. All information presented is based on publicly available knowledge, industry standards, documented real-world incidents, and established cybersecurity frameworks including MITRE ATT&CK, NIST, OWASP, and GIAC.
The tools, techniques, and methodologies described in the offensive security chapters are presented solely in the context of authorized, ethical security testing. Unauthorized testing of computer systems, networks, or applications is illegal in virtually all jurisdictions regardless of intent. Readers are solely responsible for ensuring that any security testing activities they undertake are conducted with explicit, written authorization from the system owner.
All trademarks, product names, and company names mentioned in this handbook are the property of their respective owners. Mention of a product or organization does not constitute endorsement.
This work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). You are free to share, copy, and adapt the material with appropriate attribution.
If this handbook helped you choose a direction, a ⭐ helps the next person find it.