FixTheVuln

Security Analyst Roadmap

← Back to Guides

Security Analyst Roadmap

A visual progression from foundational skills to advanced specializations. Certifications are milestones along the way — not the entire journey.

4 Phases 17 Topics 3 Cert Milestones 30+ Free Resources

How to Use This Roadmap

Required
Recommended
Optional
Guide
Tool
Quiz
Phase 1: Foundation (Months 1–2)
🌐 Networking Fundamentals

OSI model, TCP/IP, common ports, subnetting, DNS, DHCP. The backbone of everything in security.

OSI Layer Attacks Port Security Subnet Calculator
💻 Operating Systems

Linux and Windows fundamentals — file systems, user management, services, and command-line proficiency.

Linux Hardening Windows Hardening
🔒 Security Fundamentals

CIA triad, authentication vs authorization, symmetric and asymmetric encryption, hashing, and PKI basics.

Encryption Cheat Sheet Password Policy
🎯
Milestone: CompTIA Security+ (SY0-701)
Industry-standard entry point for security roles
Practice Quiz Study Planner
Phase 2: Core Analyst Skills (Months 3–4)
📊 Log Analysis & SIEM

Log formats, parsing, correlation rules, and SIEM platforms. The daily bread of SOC work.

Log Management Regex Tester
🔍 Vulnerability Management

Scanning, CVSS scoring, prioritization with EPSS, and remediation tracking at scale.

OWASP Top 10 CVE Reference Vuln Tracking CVSS Calculator
🎯 Threat Intelligence

Indicators of compromise, CISA KEV catalog, EPSS scores, and alert triage workflows.

CISA KEV Dashboard Version-Specific Alerting
🚨 Incident Response

NIST 6-phase IR framework — preparation, detection, containment, eradication, recovery, lessons learned.

IR Guide
📋 Security Frameworks

NIST CSF, CIS Controls — understanding how organizations structure their security programs.

NIST Framework CIS Controls
Phase 3: Technical Depth (Months 4–6)
🌐 Web Application Security

OWASP Top 10 in practice — injection flaws, XSS, broken authentication, and how to spot them.

OWASP Top 10 SQL Injection Sim XSS Playground
🛡️ Network Hardening

Security headers, SSL/TLS configuration, firewall rules, and defense-in-depth strategies.

Security Headers SSL/TLS Hardening
🔌 API & Database Security

OWASP API Top 10, authentication patterns, rate limiting, SQL injection prevention, and database hardening.

API Security Database Security
☁️ Cloud Security Basics

AWS, Azure, and GCP security controls — IAM, network isolation, encryption at rest and in transit.

Cloud Security Checklist
🔐 Secrets Management & Secure Config

Credential storage, environment variables, secrets managers, and secure configuration practices.

Secrets Management
🎯
Milestone: CompTIA CySA+ (CS0-003)
Validates threat detection, analysis, and response skills
Practice Quiz Study Planner
Phase 4: Advanced & Specialization (Months 6+)
🔎 Threat Hunting

Proactive detection, hypothesis-driven investigations, and behavioral analytics beyond automated alerts.

🦠 Malware Analysis Basics

Static and dynamic analysis, sandboxing, file hashing, and understanding common malware behaviors.

🔬 Digital Forensics

Evidence handling, chain of custody, disk imaging, memory forensics, and timeline analysis.

📜 Compliance Deep Dive

PCI DSS, HIPAA, GDPR, and SOC 2 — understanding regulatory requirements and audit readiness.

PCI DSS HIPAA GDPR
🎯
Milestone: CISSP
Gold standard for experienced security professionals (requires 5 years experience)
Practice Quiz Study Planner

Ready to Start Your Journey?

Explore certification paths for 9 IT roles, practice with free quizzes, or generate a personalized study plan.

View All Career Paths Practice Quizzes Browse All Guides

FixTheVuln Store

Study Planners Available for Both Certs

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA Security+ Planner ISC2 CISSP Planner

60+ certifications available — from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

CyberFolio

Choosing your next cert? Track them all in one place.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo