Sefism Cybersecurity Roadmap

What this roadmap is

The Cybersecurity roadmap is Sefism's path for students and early-career engineers who want a first job in security. It does not try to teach every corner of the field. You choose one path, build hands-on work in it inside a safe and legal home lab, and finish with an honest plan for certifications, a portfolio and your first role.

When you set it up, you choose your path:

• Defensive (SOC): monitor, detect and respond to attacks.
• Penetration testing: find weaknesses before attackers do, legally.
• Application security: build and review secure software.
• AI security: secure LLM apps and agents.

Every path shares the first two stages and the last three. In between, each path has three stages of its own, so whichever you pick, your roadmap has eight stages.

What you can do at the end

• Explain the CIA triad, risk, authentication, hashing and encryption in plain words, and the networking and Linux basics security work depends on.
• Build and run a safe, isolated home lab with virtual machines and intentionally vulnerable practice apps, following each platform's rules.
• Do the core work of your path: triage alerts and handle an incident, prevent and review web weaknesses in code, plan an authorised test and write a professional report, or threat model and harden an LLM application.
• Choose certifications in a sensible order for your path and budget, and avoid exam dumps and fee traps.
• Show a portfolio of lab write-ups, rules, reports or secure code, and apply for SOC, junior AppSec or junior testing roles with a realistic plan.

Who it suits, and who should start elsewhere

It suits CS, IT and engineering students, support and IT operations staff moving towards security, and developers who want to specialise in secure software or AI security.

The roadmap is firm on ethics: practise only on labs, CTFs and programmes that invite you, because curiosity is not permission. The penetration testing path teaches the profession, the phases and the reporting, not attack techniques against real systems.

If you are new to the command line, the Linux, terminal and Git roadmap will make stage 1 much easier. If you would rather keep networks running than defend them, see Network engineering. If you want to build LLM products first and secure them later, AI engineering is the better start; the AI security path assumes you can read code.

Time and pace

Each path is eight stages and between 265 and 275 hours:

Stage 1 is a foundation you can skim if you already know the basics.

A student's week (10 to 12 hours): one session on concepts, two lab sessions with notes written as you go, and one session writing up what you did. Keep your lab notes from the first week: they become your portfolio.

Someone working full time (about 5 hours): one evening of reading and one weekend lab block. Use snapshots so a broken lab costs minutes, not an evening.

The shared stages

1. Security foundations (about 30 hours, foundation)

Confidentiality, integrity and availability, risk, threats and vulnerabilities, the networking you need, Linux and Windows for security work, authentication and access control, hashing and encryption at a conceptual level, the law and ethics of authorised testing, and the map of security roles. The AI security path adds just enough machine learning.

Milestone: a one-page notes document in your own words on the CIA triad, risk, how a web request travels, authentication versus authorisation, hashing versus encryption, and the rules you will follow on written authorisation.

2. A safe home lab (about 20 hours)

Virtual machines and snapshots, isolated lab networks, intentionally vulnerable practice apps, practice platforms and their rules, running targets in containers, lab notes, and a little scripting. The AI security path adds a local LLM lab of your own.

Milestone: a documented lab with a network diagram, at least two VMs on an isolated network with snapshots, a vulnerable app reachable only locally, one practice platform account and your first three lab-note pages.

Your path's three stages

Defensive (SOC)

• Logs and telemetry (about 30 hours): Windows event logs, Sysmon, Linux logs, network and cloud telemetry, collecting and normalising logs, and knowing what normal looks like. Milestone: Windows (with Sysmon) and Linux sending logs to one collector, with five searches documented.
• Detection, triage and threat intelligence (about 40 hours): what a SIEM does, MITRE ATT&CK, detection rules and Sigma, alert triage, tuning, threat intelligence, phishing analysis and blue-team labs. Milestone: three Sigma rules tested on your own logs and mapped to ATT&CK, plus five triaged alerts with ticket-style notes.
• Incident response (about 30 hours): the lifecycle, playbooks and runbooks, containment, eradication and recovery, evidence handling, escalation and the post-incident report. Milestone: a tested playbook for a compromised account and a full incident report for one investigation lab.

Application security

• Web and API weaknesses, from the defender's side (about 40 hours): the OWASP Top 10, broken access control, injection and parameterised queries, XSS and output encoding, authentication failures, supply chain failures and the OWASP API Security Top 10. Milestone: one notes page per category, plus your own app with an access control check and parameterised queries, each covered by a test.
• Threat modelling, secure coding and code review (about 35 hours): data flow diagrams and STRIDE, secure coding principles, secrets, security code review, OWASP ASVS and security logging. Milestone: a threat model for your own project and an ASVS-based review of one pull request, with the fixes merged.
• Security in the pipeline (about 30 hours): SAST, dependency and container scanning, secret scanning, DAST and triaging findings. Milestone: a public repository whose CI runs these checks and a ZAP baseline scan, with a triage note on every finding.

Penetration testing

• How penetration testing works (about 25 hours): what testers do day to day, pentests versus red teams, scans and bug bounties, the phases of a test, scoping, rules of engagement and written authorisation. Milestone: a one-page plan for a fictional engagement.
• Practising legally: labs, CTFs and bug bounties (about 60 hours): guided platforms, CTFs, bug bounty scope, safe harbour, coordinated disclosure and realistic expectations. Milestone: one finished guided learning path, one CTF write-up, and a summary of a real programme's scope and safe harbour.
• Reporting and retesting (about 25 hours): the report's shape, the executive summary, writing findings, rating severity honestly, remediation advice, retesting and handling client data. Milestone: a complete sample report on a lab target such as OWASP Juice Shop in your own lab.

AI security

• How LLM apps work and where they break (about 30 hours): why the model is not a security boundary, retrieval, tools, agents and MCP, the OWASP Top 10 for LLM Applications, MITRE ATLAS and threat modelling an LLM app. Milestone: a threat model of your own small LLM app.
• LLM attack classes and their defences (about 40 hours): direct and indirect prompt injection, data leakage, improper output handling, excessive agency, poisoning, the AI supply chain and more. Milestone: your app hardened against three risks, each covered by a test.
• Testing, guardrails and AI governance (about 35 hours): layered guardrails, securing agents, AI red teaming at a high level, security evals, monitoring, and the NIST AI Risk Management Framework. Milestone: guardrails, an approval step for an agent tool, a security eval suite in CI, and a short red team report on your own app.

The final three stages

• Certifications, honestly (about 60 hours): what certifications do and do not do, entry-level options, the right ones for your path, and how to avoid dumps and fee traps. Milestone: a 12-month certification plan with the current exam version from the official page, budget including renewal and a target date.
• A portfolio that shows your work (about 30 hours): what a security portfolio contains, write-ups you are allowed to publish, your path's main piece, a final year or side project, open source contributions and an honest profile. Milestone: three to six finished pieces with READMEs and one open source contribution.
• Your first security job (about 25 hours): realistic entry routes, what each junior role expects, applying with evidence, technical rounds, fake jobs and fee traps, and keeping up once you are in. Milestone: at least 15 tailored applications tracked, and a plan for your first six months in the role.

Projects by path

The roadmap links projects from the Sefism library to each path, for example Honeypot network with attack telemetry dashboard (defensive and testing), Dependency supply chain risk scanner (AppSec), Isolated security training lab with assessment reports (testing) and AI agent tool permission gateway with human approval (AI security). Each path gets two suggestions, and AI security gets four.

How it works on Sefism

The public page at /roadmaps/cybersecurity/ shows the full stage list, with the first two stages open to read. Everything on Sefism is free to learn from. A few actions use credits, such as adding a roadmap to your dashboard; new members get starting credits, your first roadmap is free, and anyone learning seriously who runs out can ask for more.

Adding the roadmap opens every stage in the member area. You choose your path, set your weekly hours, and track progress topic by topic; each topic has an explanation, a check question and a prompt that makes an AI assistant quiz you rather than doing the work. Following the roadmap also unlocks its companion cheat sheet. Unsure which path fits you? Send Tauseef a question or book a 1:1 session.

The companion cheat sheet

The Cybersecurity cheat sheet follows the same structure with an edition for each path. Use it to revise each idea and spot the classic mistake before you make it.

Related on Sefism

• Where do I start if I want a career in cybersecurity or IT operations?
• How do I get into AI security as a student or junior engineer?
• How do I choose between frontend, backend, mobile, cloud, cybersecurity, data and AI?
• OWASP Top Ten and OWASP Top 10 for LLM Applications, used across the AppSec and AI security paths.
• Wazuh for the defensive path's lab.

What you can do afterwards

You will have a working home lab, the core work of one security path done and documented, a certification plan you chose on purpose, a portfolio of three to six finished pieces, and a tracked set of applications. That is a realistic route into a SOC, junior AppSec or junior testing role, or into the newer AI security work.

Frequently asked questions

How long does it take to get into cybersecurity? Each path on this roadmap is about 265 to 275 hours: roughly 22 to 23 weeks at 12 hours a week. Finding the first role can take longer; the last stage is about realistic entry routes and applying with evidence.

Which cybersecurity path should I choose? Defensive suits people who like investigation and logs, AppSec suits developers, penetration testing suits people who enjoy breaking things within strict rules and writing reports, and AI security suits developers already building with LLMs.

Do I need certifications to get a security job? The certification stage covers what they do and do not do, the entry-level options and the right order for your path. It also warns against exam dumps and fake vouchers, and asks you to check the current exam version on the official page.

Is it legal to practise hacking? Only on systems you own or have written permission to test, such as your own lab, guided platforms, CTFs and bug bounty programmes within their scope. Stage 1 covers the law and ethics before any hands-on work.