20 God-Tier Cybersecurity Projects That Will Get You Hired

Summary of the video (cybersecurity project ideas + what makes them “hireable”)

The speaker argues that most cybersecurity project videos reuse the same few “standard labs,” which makes candidates blend in. Instead, they recommend building projects that produce real evidence of skills—especially write-ups, public contributions, automation, and real-world data.

They also mention ranking 20 projects from beginner to advanced and scoring them using “Mad Hat metrics”, aimed at what hiring managers notice.

Core evaluation themes the video emphasizes

• Write-ups over only building a lab: Walking through how you detected or investigated attacks matters more than the repo alone.
• Public artifacts beat tutorials: Strong signals include merged open-source commits, public detection rules, and responsibly disclosed vulnerabilities.
• Real-world data > toy datasets: Honeypots, live attacker traffic, and real malware/phishing samples are valued.
• Automation and “detection engineering” thinking: CI/CD for rules, SOC SOAR playbooks, and automation around threat intel are highlighted as modern hiring-relevant skills.
• Breadth + realism (“purple team”): Projects that both attack and defend (e.g., AD labs) are framed as especially impressive.

Selected project concepts highlighted in the subtitles (grouped by type)

1) Detection & investigation projects (resume-friendly)

• Home SIEM + investigation write-up (level: noob) Spin up a small free-tier SIEM using logs (e.g., Windows/Sysmon), simulate or catch attacks end-to-end, and—crucially—write an investigation report describing alert interpretation and evidence.

• SigmaHQ contribution (level: mad hat) Write a Sigma detection rule (real-world technique) and get it merged into the public SigmaHQ repo. Emphasis: the hard part is passing maintainer review, not writing the rule.

• Detection as code pipeline (level: black hat) Store detection rules in Git, use CI/CD to test detections on good/bad cases per commit, and auto-deploy if they pass. Framed as modern “detection engineering,” not “button clicking.”

2) Offensive security with analysis outputs

• Reverse engineer malware + write detections (level: mad hat) Detonate a malware sample in a sandbox, analyze (e.g., with Ghidra), then write YARA/Sigma rules or equivalent detection logic.

• Phishing email analysis using real samples (level: white hat) Analyze email headers (and common misconfiguration indicators), then produce an incident-focused analysis report (e.g., SPF/DKIM/DMARC).

• LLM prompt injection / red teaming mapped to OWASP LLM Top 10 (level: mad hat) Perform jailbreak/injection testing against an LLM app and document findings aligned to OWASP LLM Top 10. Mentions increased interest linked to the EU AI Act.

3) Threat intel & SOC automation

• STIX/TAXII + MISP/OpenCTI + AI-generated intel briefs (level: black hat) Set up threat feeds, automate intake, and generate daily summarized intelligence briefs via a local LLM. Hard parts: setup pain and acronyms/governance complexity.

• SOAR automation playbook (level: black hat) Build response automation (e.g., enrich alerts, contain hosts, open tickets). Positioned as valuable because SOCs drown in alerts; also tied to Python and optional SIEM integration.

4) Hands-on “real data” security engineering

• Honeypot + live attacker dashboard (level: gray hat) Deploy a cheap VPS honeypot to capture real internet attack traffic, log attacker IPs, and analyze behavior.

• Network traffic analysis from malicious PCAP (level: gray hat) Use Wireshark/Zeek to find beaconing/C2 patterns in PCAP and document indicators—teaching packet-level understanding.

5) Cloud/Identity security (modern breach paths)

• Cloud misconfiguration hunt (level: gray hat) Deliberately misconfigure Azure/AWS resources (e.g., overly permissive IAM, exposed keys), then detect and remediate. Framed as tied to jobs/money shifts.

• Least-privilege IAM design (level: gray hat) Design an IAM permission model from scratch and document the rationale (“identity is the new perimeter”).

• OAuth consent phishing demo in Entra ID (level: black hat) Demonstrate malicious app grant/consent flows, then show detection/hardening steps. Emphasis: niche and interview-relevant.

6) Enterprise & purple-team style labs

• Active Directory attack and defend lab (level: black hat) Build an AD environment; run attacks like Kerberoasting and pass-the-hash; detect and mitigate. Positioned as “purple team thinking.”

• Incident response playbook + tabletop exercise you actually ran (level: gray hat) Write a real IR playbook and conduct/document a tabletop exercise. Highlighted as rare proof of leadership and handling pressure.

7) Vulnerability research / credential-like public outputs

• Find, document, and disclose a real vulnerability (level: mad hat) Discover a vulnerability in an IoT device/small web app/exposed service and perform responsible disclosure. The strongest signal is a real CVE with your name/handled disclosure trail.

8) “Build the tooling” projects

• Automate a from-scratch security tool used by others (level: mad hat) Build an open-source tool (e.g., log parser, misconfig scanner, IOC enricher). Key signal: usefulness measured by external interest (GitHub stars/users) rather than course completion.

• Build your own vulnerability scanner (light version) (level: black hat) Implement port discovery/service detection/CVE mapping. Emphasis: parsing and implementing scanning mechanics is the hard part.

• Portfolio site (level: noob) A clean, curated resume-like project list is “almost mandatory” if you lack experience.

“Tutorial signals” the video warns against

• Pure labs without investigation write-ups.
• Projects that are just “follow the guide” and don’t show reasoning about evidence/alerts.
• Overly common, publicly duplicated lab ideas that don’t differentiate you.
• Treating phishing/email analysis as “cool” only—rather than focusing on operational details and reporting.

Main speakers / sources

• Primary speaker: The video narrator (“I made this video… I’ve been on the hiring side…”), who ranks and scores projects.
• Referenced/assumed sources (not speakers):
  • SigmaHQ (Sigma rule repository)
  • OWASP LLM Top 10
  • STIX/TAXII
  • MISP/OpenCTI
  • NIST/ISO (for GRC assessment mention)
  • Tools like Ghidra, Wireshark, Zeek
  • MITRE-aligned concepts (implied but not explicitly credited as subtitles sources)