Как начать карьеру в кибербезопасности: с чего начать и что учить?

Main Ideas

Entering cybersecurity can feel overwhelming because the field has many specializations and learning resources are scattered. The speaker’s central advice is to build strong fundamentals, follow a structured path, and practice consistently rather than jumping between topics.

Recommended Learning Approach

• Keep up with security developments. Follow news about attacks, vulnerabilities, and emerging techniques. Focus on how attacks work and which technologies or weaknesses are involved, rather than on which country or group is responsible. Read write-ups by penetration testers and bug bounty hunters to learn how they approach problems and discover issues.
• Research unfamiliar terms yourself. When a video, command, or article mentions something you don’t understand, look it up instead of relying only on someone else to explain it. Independent research helps you retain information and build the ability to investigate technical problems.
• Learn networking fundamentals. Understand the OSI model, basic Wi-Fi, internet cabling, firewalls, and how networks work. The speaker says neglecting networking cost him about two years and emphasizes its importance across cybersecurity specialties and system administration.
• Learn programming basics. Start with Python and stick with it long enough to understand how code works; the speaker suggests roughly a month of focused study. You do not need to become a professional software developer, but you should be able to read code and understand the tools and scripts you use. Once comfortable with Python, consider Bash, PowerShell, and Go for scripting and automation. The speaker also mentions C for learners who want to study programming more deeply. Avoid repeatedly switching languages before learning the basics of one.
• Understand operating systems. Get hands-on experience with Linux and Windows, including the command line and basic system administration. The speaker says deep macOS study is not essential for most beginners, noting its Unix relationship to Linux.
• Build a home lab. Use virtualization software such as VirtualBox to run several virtual machines on one computer. Set up systems such as Linux and Windows Server, then use the lab to test tools and practice safely on private networks. According to the speaker, a powerful computer is not necessary.
• Study in sequence and balance theory with practice. Focus on one subject or module at a time, finish it, and revisit earlier material rather than scattering your study across unrelated topics. The speaker recommends roughly 20–25% theory, with the rest devoted to practice. Watching someone run a command is not enough: reproduce the work yourself, such as by opening a lab machine, running Nmap, and testing its options.

Career and Professional Skills

• Develop professional connections, even if you are introverted. Attend cybersecurity events, take part in CTF competitions, and join online or in-person communities. Make your interest and effort visible; contacts may lead to internships or junior opportunities. The speaker credits networking with helping his own job search and career progression.
• Use a clear learning plan. A structured curriculum can help organize subjects and set a progression, preventing you from getting lost among disconnected resources. The speaker promotes his own cybersecurity course as one possible option. He also mentions SOC analysis, cybersecurity engineering, and system administration as potential career paths, and suggests moving into DevOps may be easier after gaining related experience.

Speaker and Sources

Speaker: David, who says he has around seven years of cybersecurity experience and has worked with large companies in Europe and the United States.

Learning and information sources mentioned: Reddit, Hacker News, Google, PentesterLab, and security or bug bounty write-ups and blogs.

Tools and platforms mentioned: Nmap, Metasploit, VirtualBox, Python, Bash, PowerShell, Go, C, Linux, and Windows Server.