Security · Skills roadmap
What a Cybersecurity Engineer does
Detect, respond to and prevent attacks, and help every team build securely.
- 36 to 60 weeks to job-ready, part time
- 35 lessons across 18 skills
- 12 portfolio projects
The job
Cybersecurity engineers protect systems and data: they monitor for attacks, respond when they happen, find and fix weaknesses, and help engineering teams design securely. Most careers start in a security operations centre and branch into detection, cloud security, application security or testing.
This roadmap is built from 50 job descriptions posted in the last 90 days. It starts with security fundamentals, networking, Linux and log analysis, adds incident response, vulnerability management, identity and application security, and ends with threat modelling, detection engineering and secure delivery. Everything hands-on is defensive or done on targets built for practice.
At about 12 hours a week, most people reach Job-ready in 9 to 14 months, faster with an IT or networking background.
What employers look for
We read 50 Cybersecurity Engineer, Security Engineer and SOC Analyst job descriptions posted between July and September 2026: 32 in India and 18 global remote roles.
Operations and compliance lead. Compliance appears in 78% of postings, SIEM and security operations in 74% (91% of junior ones).
Fundamentals are non-negotiable. Security fundamentals in 70%, networking in 58%, identity and access management in 56%.
Respond and remediate. Incident response and vulnerability management in 60% each.
Testing is common. Penetration testing in 54% (82% of junior postings), application security in 30%, threat modelling in 26%.
People skills are Must-haves. Communication in 66% and stakeholder management in 52%.
Scripting and cloud help. Python in 48%, Bash in 42%, AWS in 34%.
Method, full frequency tables and every job link are in the research file linked from this page.
The skills you will learn
18 skills, about 36 to 60 weeks part time. Each one opens with its lessons split into Beginner, Intermediate and Advanced.
- Security fundamentals
- Networking fundamentals
- Linux and Bash
- SIEM and security operations
- Communication
- Python
- Vulnerability management
- Incident response
- Identity and access management
- Penetration testing
- Application security
- Applied cryptography
- Cloud platforms (AWS, Azure, Google Cloud)
- Stakeholder management
- Security compliance and data protection
- Threat modelling
- CI/CD
- Infrastructure as codeOptional
What most courses miss
Many security courses stop at tools and certifications. The job descriptions ask for judgement under pressure and fixes that stick. This roadmap adds:
Reproducible analysis: a log you can regenerate, triaged step by step, then turned into tested detections.
Risk-based prioritisation: EPSS and the CISA known-exploited catalogue instead of raw severity counts.
Incident method: timelines, evidence first, containment before eradication, blameless reviews.
Defence that ships: secure-code fixes with tests, guardrails in CI, signed artifacts.
Ethics and scope: authorised testing on practice targets only, with reports that get issues fixed.
50 current postings analysed (32 India, 18 global remote), collected 30 September 2026. Compliance in 78%, SIEM and security operations in 74%, security fundamentals in 70%, incident response and vulnerability management in 60%. Source