Career paths and certificates
Lesson 5 of 6
5Career paths and certificates
The big pictureThe ISC2 2025 workforce study noted that the problem is no longer headcount so much as a skills gap. That is why hands-on projects and labs matter more than collecting certificates, and someone who can show their work beats someone holding only a piece of paper.
What the picture shows: The order matters: the role decides the skills, the skills show in your projects, and the certificate comes to prove what you built, not to replace it.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Cybersecurity is not one job but a city with districts: guards watch the cameras (SOC), detectives arrive after the crime (response and forensics), testers try to break in with the owner's permission to find the gaps (pen testing), engineers build the house safe from the start (application and cloud security), and regulators write the rules and check they are followed (GRC). Pick the district that fits you.
Security+ SY0-701: up to 90 questions in 90 minutes, pass mark 750 of 900, weights: concepts 12%, threats 22%, architecture 18%, operations 28%, programme management 20%. Its English version retires on 11 June 2027. SY0-801 launches on 17 November 2026 with announced weights of 16%, 24%, 19%, 27% and 14%. ISC2 CC: the free One Million programme closed to new sign-ups, and the exam is USD 199 with a USD 50 annual fee. After Security+: CySA+ for detection, eJPT, PNPT or OSCP for practical testing, BSCP for web, AWS or Microsoft certificates for cloud, and ISO 27001 Lead Implementer then CISM or CISSP for management (CISSP needs five years' experience).
Before You Start
🛡️The earlier lessons of this path
You know every area, so you choose knowingly.
The Core Idea
1Six roles: where do you want to stand?
| Role | What they do daily | Core skills | A good start? |
|---|---|---|---|
| SOC analyst | Triages alerts, investigates, escalates incidents | Networking, logs, SIEM, operating systems | Yes, the most common way in |
| Incident responder & forensics | Investigates breaches, collects evidence, contains damage | Memory and disk analysis, Windows in depth | Usually after SOC experience |
| Penetration tester | Attacks systems with permission to find flaws first | Web, networking, Linux, coding, report writing | Possible, but competitive |
| Application security | Reviews code and design, adds scanning to the pipeline | Coding, OWASP, threat modelling | Excellent if you already code |
| Cloud security | Sets up identities, configuration and monitoring in the cloud | AWS, Azure or GCP, IAM, infrastructure as code | After strong foundations |
| Governance, risk & compliance | Writes policies, assesses risk, prepares audits | Frameworks (NIST, ISO, ECC), communication and writing | Yes, especially for non-programmers |
2Security+: which version?
CompTIA Security+ is the most requested entry certificate. The current SY0-701 stays available until 11 June 2027, and the new SY0-801 launches on 17 November 2026. If you start the 20-week plan now you will be ready around March or April 2027, while SY0-701 is still available with mature, proven material, whereas SY0-801 material is still filling in and its date may slip.
Security operations is the biggest domain in both, and threats and attacks grew in the new one.
3After Security+
| Certificate | For whom? |
|---|---|
| CompTIA CySA+ | SOC analysts and detection |
| eJPT · PNPT · OSCP | Pen testing; hands-on exams, not multiple choice |
| Burp Suite Certified Practitioner | Web application security |
| AWS or Microsoft cloud security certificates | Cloud security |
| ISO 27001 Lead Implementer, then CISM or CISSP | Governance and management; CISSP needs several years of experience |
4Law and ethics first
Any test or scan of a system you do not own without written permission is a crime under Saudi Arabia's Anti-Cyber Crime Law and similar laws everywhere, even if you meant to learn or "help". Practise only in your own labs and on platforms built for it (TryHackMe, Hack The Box, PortSwigger, picoCTF), and in bug bounty programmes stick to their scope to the letter.
Worked example
The task: a business graduate who does not code wants into the field within a year. Which role, and what plan?
The answer: GRC is the best way in, because it rests on frameworks, writing and communication, with SOC as a second option. The plan: networking basics from Darb, then this path's basics, protective tools and defender lessons up to governance, then Security+ SY0-701, building a portfolio on the way of three documents: a risk register for a made-up company, a two-page security policy, and a comparison of ECC controls with NIST CSF. Then ISO 27001 Foundation or Lead Implementer after the first job.
Myth vs Reality
| Myth | Reality |
|---|---|
| I need to be a coding genius to start. | You need solid networking and operating system basics, curiosity and patience. Coding (Python, Bash) comes gradually. |
| The more certificates, the better my chances. | After the first one or two, hands-on projects and experience matter far more. |
| Pen testing is cybersecurity. | It is a small and very competitive part. Most jobs are defensive. |
Where you meet it at work
🎓Student
Picks a role early and points university projects at it.
🔁Career changer
Builds on past experience: accountants towards GRC, developers towards AppSec, IT support towards SOC.
Test your understanding
Until when does Security+ SY0-701 (English) stay available?
17 November 2026 is SY0-801's official launch; 701 stays until June 2027.
Which role suits someone who does not code and likes writing and organising?
GRC rests on frameworks, policies, risk assessment and communication.
When does Security+ SY0-801 launch?
Per CompTIA's official Security+ V8 page.
What is the largest domain in SY0-801?
Then threats, vulnerabilities and attacks at 24%.
An accounting graduate who does not code. Which role fits best to start?
GRC rests on frameworks and writing, and their background helps.
Quick review cards
Check Your Understanding
Why is collecting certificates not enough?
Because the market's problem is a skills gap, and interviews test what you can do; projects and labs prove it.
A friend says: "I will scan company X's site to help them". What do you tell them?
Without written permission it is a crime whatever the intent. If they have a bug bounty programme, read its scope and stick to it; otherwise practise in your own lab.
Why not run a scanning tool on a company's site "to help them"?
Because scanning without written permission is a crime whatever the intent. Use bug bounty programmes within scope, or your own labs.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.