Roadmap · Specialise
Cybersecurity (Application security)
Opens with creditsFor students and early-career engineers who want a first job in security, as a SOC analyst, in application security, in AI security or on the road to penetration testing. By the end you understand the foundations, run a safe home lab, have hands-on work in your chosen path to show, and know which certifications and entry routes are worth your time.
Curated by Tauseef Fayyaz8 stages, 55 topics~13 months at a few hours a weekBy the end, you will be able to
- Explain the CIA triad, risk, authentication, hashing and encryption in plain words, and the networking and Linux basics security work depends on
- Build and run a safe, isolated home lab with virtual machines and intentionally vulnerable practice apps, following each platform's rules
- Do the core work of your chosen path: triage alerts and handle an incident, prevent and review web weaknesses in code, plan an authorised test and write a clear professional report, or threat model and harden an LLM application
- Choose certifications in a sensible order for your path and budget, and avoid exam dumps and fee traps
- Show a portfolio of lab write-ups, rules, reports or secure code, and apply for SOC, junior AppSec or junior testing roles with a realistic plan
The path
8 stages, in the order to learn them. Open one to start.
1Security foundationsThe ideas every security role shares: the CIA triad, risk, the networking and Linux you need, authentication, hashing and encryption at a conceptual level, and the law and ethics of authorised testing.8 topics · ~6 weeks
- 1Confidentiality, integrity and availabilityThe CIA triad is the simplest way to say what security protects.
- 2Risk, threats and vulnerabilitiesA vulnerability is a weakness, such as a server that has missed its updates or a password that is easy to guess.
- 3The networking you needMost security work means reading what happens on a network, so the basics need to be solid.
- 4Linux and Windows for security workSecurity analysts and testers move between Linux and Windows all day.
- 5Authentication and access controlAuthentication proves who you are.
- 6Hashing and encryption, conceptuallyHashing turns data into a short, fixed-size fingerprint that cannot be turned back into the original.
- 7The law and ethics of authorised testingGetting into a computer system without permission is a crime in most countries.
- 8The map of security rolesSecurity is many jobs, not one.
8 in this stageOpen this stage2A safe home labBuild a place to practise that cannot hurt anyone: virtual machines, an isolated network, intentionally vulnerable apps and practice platforms used by their own rules, with notes you keep from the first day.7 topics · ~4 weeks
- 1Virtual machines and snapshotsA virtual machine (VM) is a whole computer running as a program inside your own computer.
- 2Isolated lab networksA hypervisor can connect a virtual machine to a network in several ways, called network modes.
- 3Intentionally vulnerable practice appsIntentionally vulnerable apps are built to be broken, so you can learn safely.
- 4Practice platforms and their rulesPractice platforms give you legal practice targets, guided lessons and machines you can use in the browser.
- 5Running targets in containersMany practice apps come as Docker images.
- 6Lab notes and documentationSecurity work is only as good as its notes.
- 7A little scriptingYou do not need to be a software engineer for a first defensive role, but small scripts save hours.
7 in this stageOpen this stage- Web and API weaknesses, from the defender's sideThe OWASP Top 10 and API Security Top 10 as a builder sees them: what each weakness is, why it happens in real code, and how to prevent and detect it.9 topics · ~2 monthsOpens with credits
- Threat modelling, secure coding and code reviewFind problems before code exists and while it is reviewed: threat modelling, secure coding principles, secrets handling, security code review and OWASP ASVS as the standard to check against.7 topics · ~7 weeksOpens with credits
- Security in the pipelineAutomate the checks: static analysis, dependency and container scanning, secret scanning and DAST in CI, then triage the results into fixes developers actually make.7 topics · ~6 weeksOpens with credits
- Certifications, honestlyWhich certifications help at entry level, which suit your path later, what they cost in time and money, and the dumps, fake vouchers and renewal rules to watch for.5 topics · ~3 monthsOpens with credits
- A portfolio that shows your workTurn your lab work into evidence an employer can check: write-ups, a lab repository, rules, reviews or reports for your path, a short public profile and a contribution to an open source security project.6 topics · ~6 weeksOpens with credits
- Your first security jobChoose a realistic entry route for your path, read job descriptions properly, apply with evidence, handle technical rounds calmly and avoid the fake jobs and fee traps that target security beginners.6 topics · ~5 weeksOpens with credits
6 more stages, 40 more topics, free with an account.
You have seen the open stages of the Cybersecurity roadmap. Every topic it covers is listed above, and an account opens the rest: what each topic means, a question to check yourself, the courses, the practice and Tauseef's advice for every stage. Early access is open: sign up and your account is active shortly after.
Everything here is free to learn from. A few things, like adding a roadmap, keeping a cheat sheet or asking Tauseef a question, use credits. You get 15 when you join, your first roadmap is free, and if you are learning seriously and run out, you can ask for more. Credits only make sure the platform goes to people who are actually learning.
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- Secrets Management Best PracticesKeep API keys, passwords and tokens out of git, logs and browser bundles: secret managers, scanning, rotation, OIDC in CI and leak response.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Secure Coding Best PracticesWrite code that resists attack: untrusted input, validation, parameterized queries, output encoding, safe parsing, uploads, SSRF and errors that fail closed.
Checklists
See all- Web Application Security ChecklistA practical web application security checklist built on the OWASP Top 10:2025 and ASVS 5.0, with a severity and a way to verify every check.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Linux Server Hardening ChecklistHarden an Ubuntu, Debian or RHEL server step by step: accounts and sudo, SSH, updates, firewall and open ports, permissions, logging and CIS benchmark scans.
Project structures
See all- Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks. - AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Terraform project structureAn infrastructure repository for a small app on AWS: reusable modules, one folder per environment with its own remote state, pinned providers, tests and security scans, with plan on every pull request and apply from CI. For students who have finished the Terraform tutorials and want to know how a real team lays out the files. The same layout works unchanged with OpenTofu.
Career questions
See all- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
- Where do I start if I want a career in cybersecurity or IT operations?Start with the foundations both fields share: networking, Linux, and how systems fail. Then choose an entry role such as SOC analyst, IT support or junior cloud operations, and prove it with hands-on labs and one documented project rather than a stack of certificates.
- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
Cheat sheets
See allWork with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com