Breaking In 03 — First Moves

Part of the Breaking Into Security field guide.

You know the map (01) and you know what you're bringing (02). Here's the doing part. This is a months-long plan, not a weekend one — but every piece of it compounds.

1. Shore up the fundamentals

Security sits on top of three things. Be honest with yourself about each:

• Networking — TCP/IP, DNS, HTTP, TLS, firewalls, and reading a packet capture in Wireshark without flinching.
• Operating systems — comfortable at a Linux shell, and (for most corporate defense work) how Windows and Active Directory hang together.
• One scripting language — Python is the default; PowerShell if you lean Windows. Enough to parse a log file and automate something tedious.

From an IT background you likely have two of three. Fill the gap first; everything else builds on these.

2. Get hands-on immediately

Don't front-load months of reading. Labs teach faster, and they generate proof you can point at.

• TryHackMe — guided learning paths from zero; the SOC-analyst path maps straight to real Tier 1 work.
• Hack The Box — less hand-holding, more realistic; better once you have some footing.
• LetsDefend — the defense version: triage simulated alerts in a fake SOC. Closest thing to a day-one blue-team job preview.
• A home lab — even one old machine running VMs: a Windows domain, a SIEM ingesting its logs, you attacking one box and watching the alerts from the other. "I built a detection lab at home" is a great interview sentence.

Keep short notes on everything you do — a simple blog or GitHub repo of lab write-ups quietly becomes your portfolio.

3. Certifications — the honest version

Certs don't prove you can do the job. What they do is get you past HR filters, and early on that matters. The pragmatic path:

• CompTIA Security+ — the default first cert; a broad vocabulary pass over the whole field, and the one job filters most often ask for. With IT experience it's very reachable.
• ISC2 CC (Certified in Cybersecurity) — entry-level, frequently free or cheap to sit; low effort to add alongside Security+.
• Then go role-specific, not cert-collecting: CySA+ or a SANS/GIAC cert for defense, cloud security certs (or the cloud vendors' own security exams) for engineering, OSCP if and when offense calls — it's respected precisely because it's a hands-on gauntlet.
• CISSP — the management-track staple. It formally requires five years of paid experience in its domains, and broad IT experience often counts toward it — check the requirements before assuming you're years away. Worth knowing it exists; not a first move.

Rule of thumb: one broad cert to open doors, then let the target role — not the cert industry — pick the rest.

4. Plug into the community

Security is unusually community-driven, and most of it is welcoming to newcomers who show up curious.

• BSides — inexpensive, volunteer-run security conferences held in dozens of cities; the best first conference by a wide margin.
• Local meetups and DEF CON groups — recurring, informal, jobs-adjacent. Attend three times and you're a regular.
• Podcasts and newsletters — a couple of weekly staples (Risky Business and SANS's daily digest are safe picks) keep the vocabulary and current-events side building passively.

Half the value is learning; the other half is that security hiring runs heavily on "I met them at a meetup and they seemed sharp."

5. Land the first role

• Try the inside door first — security tasks at your current job, per part 02. Experience beats certificates.
• Search by skill, not just title — "security analyst" postings are a minority of security jobs. Hybrid roles (IT security administrator, systems engineer with security duties, GRC analyst) are more numerous, less contested, and count fully as security experience.
• Lean on the niche — healthcare IT background? Target hospital systems, health-tech companies, medical device makers, and healthcare- focused consultancies, and say the domain words in the résumé.
• Apply before you feel ready. Job postings are wish lists. An IT veteran with lab evidence, one cert, and genuine curiosity is a competitive candidate for every entry point in part 01 — the people reading the résumés came up the same way.

All the links from this guide in one place: resources.