Aller au contenu

Le contenu principal de cette page est en anglais.Traduire cette page

Parcours métiers

Cybersecurity & Risk Management roadmap

Cybersecurity professionals defend organisations against attacks; risk managers decide which risks matter most and how to reduce them. This roadmap covers both: security fundamentals, networks and systems, security operations, cloud and application security, AI security, and governance, risk and compliance (GRC), including India's CERT-In rules and the DPDP Act.

Temps
⏱ 6–9 months
Level
Beginner
Steps
7 steps
Architecture ↓Cheat sheet ↓6 interview Q&As ↓
Partager

The roadmap

Click a step to open the full guide.

Best architecture: zero trust, defence in depth

Modern security architecture assumes attackers may already be inside, so every request is verified and every layer has its own protection.

Defence in depth (outside in)

  1. Governance: policies, risk register, training
  2. Identity: SSO, MFA, least privilege (zero trust)
  3. Network: segmentation, firewalls, WAF
  4. Endpoints: EDR, patching, device health
  5. Applications: secure code, secrets management
  6. Data: encryption, backups, access logs
  7. Detection & response: SIEM, SOC, incident plan

Why it's built this way

  • Never trust, always verify: every user, device and service proves who it is on every request.
  • Least privilege limits what a stolen account or hijacked AI agent can reach.
  • Segmentation stops one compromised machine spreading everywhere.
  • Immutable, offline backups are the last line of defence against ransomware.
  • Logging + SIEM + an incident plan turn attacks into contained incidents instead of disasters.

Cybersecurity & Risk Management cheat sheet

The essentials on one screen. Bookmark it for revision.

Key terms

CIA triadConfidentiality, integrity, availability
RiskLikelihood × impact
Zero trustNever trust, always verify
SIEM / EDRLog analysis / endpoint protection
MITRE ATT&CKCatalogue of attacker techniques
CVSS / KEVSeverity score / actively exploited list

Ports & outils

22 / 3389SSH / RDP (common attack targets)
53 / 443DNS / HTTPS
WiresharkPacket analysis
NmapNetwork discovery (only with permission)
Burp SuiteWeb app testing

India compliance

CERT-In (2022)Report many incidents within 6 hours; keep logs
DPDP RulesConsent Manager rules from Nov 2026; most duties from 13 May 2027
DPDP penaltiesUp to ₹250 crore per breach of security safeguards

Improve performance

  • Tune SIEM rules to cut false positives, so analysts focus on real threats.
  • Automate repetitive triage with playbooks (SOAR) and AI summaries.
  • Prioritise patching by real exploitation, not just severity scores.
  • Measure mean time to detect (MTTD) and respond (MTTR), and improve them.

Security checklist

  • Phishing-resistant MFA for everyone, especially admins.
  • Least privilege and regular access reviews.
  • Patch internet-facing systems fast, starting with actively exploited flaws.
  • Offline, immutable backups tested with real restores.
  • Security awareness training, including AI voice and deepfake scams.
  • Vendor risk reviews: many breaches come through third parties.

Most important interview questions

Click a question to see a strong answer. Each step also has its own questions.

1Explain defence in depth.

Using several independent layers of security (identity, network, endpoint, application, data, monitoring) so if one fails, others still protect you.

2Qu'est-ce que zero trust ?

A model where no user, device or network is trusted by default; every access request is authenticated, authorised and checked continuously, with least privilege.

3How would you protect a company against ransomware?

MFA and patching to block entry, EDR to detect it, segmentation to limit spread, offline immutable backups to recover, and a practised incident response plan.

4Qu'est-ce que the difference between a vulnerability assessment and a penetration test ?

A vulnerability assessment finds and lists weaknesses (often automated); a penetration test actively exploits them, with permission, to show real impact.

5What does a risk register contain?

Each risk's description, asset, likelihood, impact, score, owner, existing controls, treatment plan and review date.

6What are India's key cyber reporting rules?

CERT-In's 2022 directions require reporting specified incidents within six hours. The DPDP Rules add personal-data breach notification duties, most of which apply from 13 May 2027.

Related feuilles de route

6

Cloud Engineer

6 steps · 5–7 months · Intermediate

Design, build and run systems on AWS, Azure or Google Cloud.

View roadmap →
6

AWS

6 steps · 6–8 weeks · Intermediate

The most widely used cloud platform.

View roadmap →
6

System Design

6 steps · 8–10 weeks · Advanced

Design scalable, reliable systems and ace design interviews.

View roadmap →
6

AI Agents

6 steps · 3–4 weeks · Intermediate

Build AI that plans, uses tools and gets work done.

View roadmap →
1

Cybersecurity & Risk Management · Step 1 of 7 · 3 weeks

Security fundamentals

The core ideas every security role uses.

Security protects three things: confidentiality (only the right people see data), integrity (data isn't changed wrongly) and availability (systems work when needed). Every control you learn protects one of these.

Risk is the chance that a threat exploits a vulnerability and causes impact. Security work is mostly reducing that chance or that impact at a sensible cost.

What you'll learn

  • CIA triad
  • Threats, vulnerabilities and risk
  • Authentication and authorisation
  • Encryption and hashing basics
  • Common attacks (phishing, malware, ransomware)
  • Security frameworks overview

The CIA triad

Confidentiality

  • Only authorised access
  • Encryption, access control

Integrity

  • Data stays correct
  • Hashes, signatures, audit logs

Availability

  • Systems keep working
  • Backups, redundancy, DDoS protection

Key concepts

CIA triad
Confidentiality, integrity, availability: the three goals of security.
Vulnerability vs threat
A vulnerability is a weakness; a threat is someone or something that could exploit it.
Ransomware
Malware that encrypts or steals data and demands payment.

Step by step

  1. 1.1

    Learn the CIA triad

    Map every control to confidentiality, integrity or availability.

  2. 1.2

    Understand risk

    Threat + vulnerability + impact; practise rating risks.

  3. 1.3

    Know the attacks

    Phishing, credential stuffing, malware, ransomware, social engineering.

Notes

  • Most breaches start with phishing or stolen credentials, not clever hacking.
  • Hashing is one-way (passwords); encryption is reversible with a key.

Tips & tricks

  • Explain each concept with a real breach example.
  • Turn on MFA everywhere you can; you'll understand why it matters.

Interview questions

What's the difference between authentication and authorisation?

Authentication proves who you are (password, MFA). Authorisation decides what you're allowed to do once identified.

Hashing vs encryption?

Hashing is one-way and used to store passwords and check integrity. Encryption is reversible with a key and protects data you need to read later.

The quick way to study this

Learn the CIA triad, the risk formula and the top 10 attack types in two weeks of short daily sessions.

2

Cybersecurity & Risk Management · Step 2 of 7 · 5 weeks

Networks and operating systems

You can't defend what you don't understand.

Attackers move through networks and abuse operating systems, so defenders must know both deeply. Learn how traffic flows, what normal looks like and how Windows and Linux handle users, permissions, processes and logs.

Active Directory is at the heart of most company networks and a favourite attacker target.

What you'll learn

  • TCP/IP, ports and protocols
  • DNS, HTTP/HTTPS, TLS
  • Firewalls and network segmentation
  • Linux and Windows administration
  • Active Directory basics
  • Packet analysis with Wireshark

Segmented network

  1. Internet
  2. Firewall / WAF
  3. DMZ (public web servers)
  4. Internal app zone
  5. Database zone (most restricted)

Key concepts

Segmentation
Splitting a network into zones so attackers can't move freely.
Lateral movement
An attacker moving from one compromised machine to others.
Active Directory
Microsoft's directory for users and computers in most companies.

Step by step

  1. 2.1

    Networking

    OSI/TCP-IP layers, ports, DNS, TLS handshake.

  2. 2.2

    Operating systems

    Users, permissions, processes, services and logs on Linux and Windows.

  3. 2.3

    Active Directory

    Domains, users, groups, group policy and common attacks.

  4. 2.4

    Home lab

    Two or three VMs on an isolated network to practise safely.

Notes

  • Know common ports: 22 SSH, 53 DNS, 80/443 web, 3389 RDP, 445 SMB.
  • Logs are the defender's evidence; learn where each OS keeps them.

Tips & tricks

  • Capture your own traffic in Wireshark and identify each protocol.
  • Build a small home lab with virtual machines.

Interview questions

What happens during a TLS handshake (simply)?

Client and server agree on a protocol version and cipher, the server proves its identity with a certificate, and they create shared session keys so the rest of the traffic is encrypted.

The quick way to study this

Do a networking course plus daily Linux practice; build a two-VM lab.

Cloud Engineer roadmap →
3

Cybersecurity & Risk Management · Step 3 of 7 · 6 weeks

Security operations (SOC) and incident response

Detect attacks and respond fast.

A Security Operations Centre (SOC) watches for attacks around the clock. Analysts triage alerts from a SIEM (which collects logs) and EDR (which watches endpoints), decide what's real, and escalate incidents.

Incident response follows a lifecycle: prepare, detect, contain, eradicate, recover, and learn lessons. Speed matters; in India, CERT-In requires many incidents to be reported within six hours.

What you'll learn

  • SIEM and log analysis
  • EDR and alert triage
  • Threat intelligence and MITRE ATT&CK
  • Incident response lifecycle
  • Digital forensics basics
  • Writing incident reports

Incident response lifecycle

  1. Prepare
  2. Detect & analyse
  3. Contain
  4. Eradicate & recover
  5. Lessons learned

Repeats as a loop

Key concepts

SIEM
Collects and searches logs to detect suspicious activity.
EDR
Endpoint detection and response: watches and can isolate devices.
MITRE ATT&CK
A public catalogue of attacker tactics and techniques.
IOC
Indicator of compromise: evidence like a bad IP, hash or domain.

Step by step

  1. 3.1

    Collect logs

    Send endpoint, network, cloud and identity logs into a SIEM.

  2. 3.2

    Triage alerts

    Is it real? How bad? What's affected?

  3. 3.3

    Respond

    Contain, eradicate, recover; preserve evidence.

  4. 3.4

    Learn

    Post-incident review and improved detections.

Notes

  • MITRE ATT&CK is the shared map of attacker techniques.
  • Most alerts are false positives; good triage is a skill.

Tips & tricks

  • Practise with free SIEM labs and blue-team challenges.
  • Write a short incident report for every lab you complete.

Interview questions

You see a user logging in from two countries ten minutes apart. What do you do?

Treat it as possible impossible travel / account compromise: check MFA and session details, contact the user, revoke sessions and reset credentials if suspicious, review what the account accessed, and document it.

What's your first step when ransomware is detected?

Contain it: isolate affected machines from the network (without powering off, to preserve evidence), protect backups, follow the incident plan, and escalate to the response team and leadership.

The quick way to study this

Learn one SIEM's query language and work through 20 alert-triage exercises.

4

Cybersecurity & Risk Management · Step 4 of 7 · 5 weeks

Application, cloud and identity security

Secure the software and cloud that businesses run on.

Most modern breaches involve web apps, stolen identities or cloud misconfigurations. Learn the OWASP Top 10, how cloud permissions work, and why zero trust (never trust, always verify) has replaced the old 'trusted internal network' idea.

Vulnerability management means finding, prioritising and fixing weaknesses, starting with those known to be actively exploited.

What you'll learn

  • OWASP Top 10
  • Secure coding and code review
  • Cloud security (IAM, misconfigurations)
  • Identity, MFA and zero trust
  • Secrets management
  • Vulnerability management and patching

Vulnerability management

  1. Discover assets
  2. Scan
  3. Prioritise (exploited? exposed?)
  4. Patch / mitigate
  5. Verify
  6. Report

Key concepts

Zero trust
Never trust, always verify, even inside the network.
Broken access control
Users reaching data or actions they shouldn't; #1 in OWASP Top 10.
CVSS / KEV
CVSS scores severity; CISA's KEV list shows flaws actively exploited.

Step by step

  1. 4.1

    Web app security

    OWASP Top 10: access control, injection, misconfiguration, auth failures.

  2. 4.2

    Cloud security

    IAM least privilege, no public buckets, logging on, guardrails.

  3. 4.3

    Identity

    SSO, phishing-resistant MFA, conditional access.

  4. 4.4

    Vulnerability management

    Scan, prioritise by exploitation and impact, patch, verify.

Notes

  • Prioritise vulnerabilities that are exploited in the wild (e.g. CISA KEV list).
  • Over-permissive cloud roles are a top cause of cloud breaches.

Tips & tricks

  • Run a vulnerability scanner on your home lab and fix what it finds.
  • Review the IAM policies of a practice cloud account.

Interview questions

How do you prioritise thousands of vulnerabilities?

Focus first on those actively exploited (e.g. on the KEV list) and exposed to the internet on important systems, then by severity and business impact; don't just sort by CVSS score.

The quick way to study this

Study the OWASP Top 10 with one hands-on lab each.

AWS roadmap →
5

Cybersecurity & Risk Management · Step 5 of 7 · 2 weeks

AI security

Defend against, and with, artificial intelligence.

AI creates new attack surfaces. Prompt injection hides instructions in text an AI reads, trying to make it leak data or misuse tools; experts still describe it as unsolved, so defences focus on limiting what a hijacked AI can do. Attackers also use AI for convincing phishing and voice or video deepfakes.

Defenders use AI too: summarising alerts, writing detection rules and investigating faster.

What you'll learn

  • Prompt injection (direct and indirect)
  • Securing AI agents and outils
  • Data leakage through AI
  • Deepfakes and AI-powered phishing
  • AI for defenders
  • AI governance basics

Indirect prompt injection

  1. Attacker hides text in a web page
  2. AI agent reads the page
  3. Agent follows hidden instruction
  4. Misuses a tool / leaks data

Key concepts

Indirect prompt injection
Malicious instructions hidden in content the AI reads (web pages, emails, files).
Deepfake fraud
Fake voice or video of a real person used to trick staff into payments.

Step by step

  1. 5.1

    Know AI attacks

    Prompt injection, data leakage, poisoned tools, deepfakes.

  2. 5.2

    Secure AI apps

    Least-privilege tools, approvals, output checks, logging.

  3. 5.3

    Use AI defensively

    Alert summaries, detection drafting, faster investigation.

Notes

  • Give AI agents least-privilege access and human approval for risky actions.
  • Verify unusual payment requests by a second channel, even if the voice sounds right.

Tips & tricks

  • Try prompt-injection challenges to see how easily models can be tricked.

Interview questions

How would you secure an AI agent that can send emails?

Least-privilege tools, human approval before sending, treat retrieved content as untrusted, restrict recipients, rate-limit, and log every action.

The quick way to study this

Read our AI agents and MCP security sections, then test a chatbot with injection examples.

AI agents roadmap →
6

Cybersecurity & Risk Management · Step 6 of 7 · 4 weeks

Risk management and GRC

Decide which risks matter and prove you're managing them.

Governance, risk and compliance (GRC) connects security to the business. A risk register lists risks with their likelihood, impact, owner and treatment. Frameworks such as ISO 27001 and the NIST Cybersecurity Framework give a structured way to choose and audit controls.

In India, CERT-In's 2022 directions require reporting of many cyber incidents within six hours, and the Digital Personal Data Protection (DPDP) Rules bring duties on consent, security safeguards and breach reporting, most of which apply from May 2027.

What you'll learn

  • Risk assessment (likelihood × impact)
  • Risk treatment: avoid, reduce, transfer, accept
  • Frameworks: ISO 27001, NIST CSF
  • Policies and controls
  • Third-party / vendor risk
  • Indian rules: CERT-In directions, DPDP Act

Four ways to treat a risk

Avoid / Reduce

  • Stop the risky activity
  • Add controls (MFA, backups)

Transfer / Accept

  • Insurance, contracts
  • Accept if cost > benefit (documented)

Key concepts

Risk register
A table of risks with likelihood, impact, owner and treatment.
Residual risk
Risk left after controls are applied.
Third-party risk
Risk from vendors and suppliers who access your data or systems.

Step by step

  1. 6.1

    Identify assets and risks

    What's valuable, what could go wrong, how likely, how bad.

  2. 6.2

    Treat risks

    Avoid, reduce (controls), transfer (insurance/contracts) or accept.

  3. 6.3

    Pick a framework

    ISO 27001 for certification; NIST CSF for structure.

  4. 6.4

    Comply locally

    CERT-In 6-hour reporting; DPDP Act duties (most from May 2027).

Notes

  • Risk = likelihood × impact; you can't remove all risk, only manage it.
  • Vendors are part of your attack surface (many 2026 breaches came through third parties).

Tips & tricks

  • Build a sample risk register for a small company.
  • Map five controls to ISO 27001 and NIST CSF.

Interview questions

How do you calculate and prioritise risk?

Rate likelihood and impact (e.g. 1–5 each), multiply for a score, then prioritise high scores, considering existing controls, business priorities and regulatory obligations.

What does ISO 27001 require?

An information security management system (ISMS): defined scope, risk assessment and treatment, selected controls (Annex A), policies, internal audits, management review and continual improvement.

The quick way to study this

Learn the risk formula, four treatments and one framework; write a 10-row risk register.

7

Cybersecurity & Risk Management · Step 7 of 7 · 4 weeks

Certifications and career

Choose a track and get hired.

Pick a track that suits you: SOC analyst (detect and respond), penetration tester (find weaknesses legally), cloud security or GRC (risk, policy and audits). An entry-level certification helps you pass HR filters; hands-on proof gets you hired.

Document your labs and capture-the-flag write-ups in a portfolio.

What you'll learn

  • Entry certifications (e.g. CompTIA Security+, ISC2 CC)
  • Tracks: SOC, pentesting, cloud security, GRC
  • Home lab and portfolio
  • CTFs and write-ups
  • Interview preparation

Cybersecurity career tracks

  • Cybersécurité
  • Blue team: SOC analyst → incident responder → threat hunter
  • Red team: pentester → red teamer
  • Cloud & app security: cloud security engineer, AppSec
  • GRC: risk analyst → auditor → CISO path

Key concepts

CTF
Capture the flag: legal hacking challenges for practice.
Rules of engagement
Written permission and scope before any security test.

Step by step

  1. 7.1

    Choose a track

    SOC, pentesting, cloud security or GRC.

  2. 7.2

    Get certified

    One entry-level certification for your track.

  3. 7.3

    Show proof

    Home lab, CTF write-ups, GitHub, a blog.

Notes

  • Only test systems you own or have written permission to test.

Tips & tricks

  • Publish short write-ups of labs you complete.
  • Network at local security meetups and online communities.

Interview questions

Why do you want to work in cybersecurity?

Give a genuine reason and proof: a lab you built, a CTF you solved or an incident you analysed, and what you learned from it.

The quick way to study this

Book an entry-level exam date, then study toward it with daily labs.

Partager cette page