Cyber Security Roadmap for India
Cyber Security Roadmap for India
The working sequence is: networking and Linux fundamentals for two to three months, web fundamentals and the OWASP Top 10 hands-on for two to three months, then specialise into offensive or defensive security for three to four months, then build a public portfolio, then certify. Most people invert this by buying a certification first, which is why they finish courses without becoming employable.
This roadmap assumes twelve to fifteen hours a week, which is realistic alongside college or a job. Compress it if you have more time, but do not reorder it. Every stage depends on the one before.
Months 1 to 3: Fundamentals
Boring, unskippable, and the stage most people rush. You cannot exploit what you cannot describe.
| Area | What you need to actually be able to do |
|---|---|
| Networking | Explain the TCP handshake, read a packet capture, understand NAT, DNS, HTTP and TLS well enough to know what broke |
| Linux | Live in the terminal. Permissions, processes, services, cron, users and groups, file system layout |
| Windows | Basic administration, the registry, services, and enough Active Directory concept to know what a domain is |
| Scripting | Python at the level of reading and modifying an existing exploit. Bash for automation |
Checkpoint: set up a home lab with a Linux VM and a Windows VM on a shared network and get them talking. If that took you a week of frustration, that week was the lesson.
Months 4 to 6: Web fundamentals and OWASP
Web is where most Indian entry-level work sits, so this is the highest-return stage.
- How the web actually works. HTTP methods and headers, cookies, sessions, CORS, same-origin policy, how authentication is implemented and where it fails
- OWASP Top 10, hands-on. Not reading. Exploiting. Fifty SQL injections teach you the pattern; one article teaches you the definition
- Burp Suite properly. Proxy, Repeater, Intruder, Comparer, Decoder. Most people learn Proxy and stop
- Manual before automated. Find things by hand first. Tooling makes a skilled tester faster and an unskilled one confidently wrong
Checkpoint: find and exploit a SQL injection and a stored XSS on a deliberately vulnerable application without a walkthrough. If you need the walkthrough, stay here.
Months 7 to 10: Pick a side
This is the fork. Both are legitimate, they hire differently, and pretending you can do both at this stage produces someone who does neither.
Offensive path
- Network penetration testing, service enumeration and exploitation
- Privilege escalation on Linux and Windows, both taken seriously
- Active Directory: enumeration, Kerberoasting, lateral movement
- API testing, since it is where the volume is growing fastest
- Report writing, which almost nobody practises. See how to write a VAPT report
Defensive path
- SIEM operations and query languages
- Log analysis, especially Windows event logs
- Detection engineering, writing rules rather than consuming alerts
- Incident response process and evidence handling
- Threat hunting, which requires understanding offensive technique
Entry is easier on the defensive side and there are more openings in India. Pay starts lower and the ladder is clearer. Compare SOC analyst salary against VAPT engineer salary before choosing.
Months 10 to 12: Portfolio
This stage is what actually gets you hired, and it is the one people skip in favour of another course.
In our experience placing students, a candidate with three well-documented pieces of public work and no certification outperforms a candidate with a certification and nothing to show, consistently, in the technical interview. Specific project ideas are in cyber security projects that get you interviews.
Minimum viable portfolio:
- Three to five technical writeups, published somewhere public
- One full penetration test report on a lab machine, properly formatted
- A documented home lab build
- One tool or script you wrote, however small
- A resume built for the ATS, because most rejections happen before a human reads it. See cyber security resume guide
Month 12 onward: Certification, if it fits
Certify to prove what you can already do, not to learn it. Check twenty real job listings for the roles you actually want before spending anything. If a certification does not appear in them, it is not buying you access to that market.
Comparison of the main options is in OSCP vs CEH, the honest case for and against OSCP in is OSCP worth it, and cost against realistic salary impact in certifications ranked by ROI in India.
The India-specific parts
Three things that change the calculation here compared to generic international roadmaps:
Compliance drives the market. CERT-In, RBI and SEBI requirements mean a large share of Indian security work is mandated rather than discretionary. This makes hiring steadier than most engineering roles, and it also means a lot of the work is repetitive checklist testing. Detail in CERT-In VAPT requirements.
Remote hiring has flattened the city premium. A tester in a tier-two city working remotely for a Bangalore product company earns metro compensation at local cost of living. That is the best arbitrage available in this field and it did not exist five years ago.
Certifications carry more HR weight here. Large Indian employers filter resumes on certification keywords more than product companies elsewhere do. This does not make the certification a skill signal; it makes it an access signal. Treat it accordingly.
What to skip
- Buying a certification first. The most common and most expensive mistake.
- Course collecting. Ten unfinished courses is not a portfolio. One finished project is.
- Tool memorisation. Knowing forty tools and no methodology makes you slower, not better.
- Waiting to feel ready. Nobody feels ready. Apply while you are still learning; interviews are the fastest feedback loop available.
- Skipping fundamentals to get to the exciting part. Every person who does this hits a ceiling around month eight and has to come back.
Practise this
Every stage above needs a lab, not a video. Hacklido is our free CTF and lab platform with a progression path from zero, open to anyone with no payment.
If you want the same sequence with a live mentor and a schedule that forces consistency, the Techonquer programs follow this structure.
Frequently asked questions
How long does it take to learn cyber security in India?
Roughly twelve months at twelve to fifteen hours a week to reach entry-level employability, assuming you build a portfolio rather than only completing courses.
Can I learn cyber security without coding?
Yes, at entry level. You need to read code and modify existing scripts more than write applications. Python at a basic level is enough to start, and you can build from there.
Should I get a certification first?
No. Certifications prove ability rather than build it. Build fundamentals and a portfolio first, then certify to access employers who filter on it.
Is cyber security a good career in India in 2026?
Yes, and unusually stable, because a large share of demand comes from CERT-In, RBI and SEBI compliance requirements rather than discretionary budgets.
Which is easier to enter, SOC or penetration testing?
SOC. There are more openings, the hiring bar at L1 is lower, and progression is more structured. Entry pay is lower and shift work is common in the first years.