How to Get Into Cybersecurity: A 90-Day Learning Plan

A 90-day plan can organize your first cybersecurity learning projects. It is not a promise of employment: the starting point, study time, local market and employer requirements all affect progress.

Practical evidence can help explain your skills, but this guide does not establish that self-taught candidates have a higher placement rate than graduates.

Use the following schedule as an adaptable learning plan, with salary context and three portfolio exercises you can perform in an isolated lab.

Begin with systems and networking fundamentals. Our cybersecurity tools for beginners guide provides context. Test only systems you own or are explicitly authorized to assess.

In This Tactical Guide:

• 1. Education and Experience Requirements
• 2. A 90-Day Learning Plan
• 3. U.S. Salary Context and Certification Choices
• 4. Documenting a Home Lab for Job Applications
• 5. Practicing Technical Interview Scenarios
• 6. Frequently Asked Questions (2026 Career Guidance)

1. Education and Experience Requirements

Requirements vary. BLS describes a bachelor’s degree and related experience as typical for information security analysts, while some workers enter through other training and experience. A portfolio or certificate does not automatically replace a vacancy’s stated qualifications.

Compare the requirements of several suitable vacancies before choosing a training path.

Academic study and hands-on practice can complement each other. Demonstrate how you understand a system, investigate a problem and document your reasoning.

The NIST NICE Framework describes cybersecurity work through tasks, knowledge and skills. It does not abolish degree requirements or guarantee hiring outcomes.

Use role descriptions to identify what to practice next.

Practice command-line operations, networking and log analysis, then explain your findings clearly. Employers still evaluate experience and other qualifications.

2. A 90-Day Learning Plan

Spend the first month on systems and networking, the second on security fundamentals, and the third on a small lab and write-up. Extend each phase if needed; 90 days is a planning period, not a job-placement deadline.

Adapt the following phases to your available study time and current knowledge.

Phase 1: Days 1–30 (The Core Infrastructure Bootcamp)
Do not jump directly into penetration testing or hacking tools. You cannot secure a network or isolate an attacker if you do not understand how data packets traverse physical hardware and virtual cloud interfaces. Spend your first month mastering two foundational pillars:

• Networking Essentials: Subnetting, IPv4/IPv6 architectures, Domain Name System (DNS) querying, routing tables, and the OSI model layers.
• Linux & Windows Administration: Command-line navigation via Bash and PowerShell, user permission management, service configurations, and active log directory structures (such as /var/log/auth.log and Windows Event Viewer Security ID 4624/4625 records).

Phase 2: Days 31–60 (Security Fundamentals)
Study access control, network defense, risk and incident handling. If a certification fits your target vacancies, assess readiness before booking an exam; Security+ is not a universal hiring requirement.

Phase 3: Days 61–90 (Lab and Portfolio)
Build a small isolated lab and document its setup, observations and limitations. Publish sanitized diagrams and sample logs; remove passwords, API keys, personal data and employer information. A portfolio supports an application but does not guarantee an offer.

3. U.S. Salary Context and Certification Choices

BLS reports a $129,180 median annual wage for U.S. information security analysts in May 2025. This includes multiple experience levels and is not a starting salary, a guaranteed offer or a worldwide benchmark.

Let’s examine the actual U.S. market numbers:

The BLS occupational outlook projects 21% employment growth from 2025 to 2035. Projections describe an occupation, not an individual’s chance of getting hired.

Choose credentials based on target vacancies and readiness. CISSP requires qualifying professional experience; passing the exam alone does not grant full certification.

4. Documenting a Home Lab for Job Applications

Link a relevant, sanitized portfolio from your resume. It can demonstrate skills but cannot guarantee bypassing an applicant tracking system or an interview invitation.

Make each project understandable to a reviewer.

Replace vague skill claims with concise examples of what you configured, investigated and learned. State the lab’s limitations honestly.

Consider these three projects, adapting them to your experience and available equipment:

The 3-Step SOC Portfolio Checklist (Embed in Your Resume):

• Project 1: Monitoring lab. Install a monitoring system such as Wazuh in isolated virtual machines you own. Generate a few controlled failed logins, inspect the resulting alerts and document expected versus observed behavior. Do not test public systems.
• Project 2: Log-analysis script. Parse sample web logs and summarize unusual patterns in a report. A 403 response alone does not establish an attack. Keep the exercise in dry-run mode and review false positives instead of automatically blocking addresses.
• Project 3: Packet analysis. Examine a known training PCAP in an isolated lab. Explain the timeline and supporting packet evidence. Do not execute extracted files or contact suspicious destinations.

A useful write-up explains the question, setup, evidence, conclusion and remaining uncertainty. Reviewers can then assess your work without reproducing the entire lab.

5. Practicing Technical Interview Scenarios

Practice explaining how you investigate uncertain evidence. Interviews vary and may include fundamentals, scenarios, coding or discussion of prior work.

Here is an illustrative scenario to practice:

An interviewer might ask: “Monitoring shows an unexpected outbound SSH connection from a server. How would you investigate?” This is a practice example, not a prediction of every interview.

Explain assumptions, permissions and the evidence you would collect before making disruptive changes:

1. Verify the observation: Correlate network telemetry, process activity and the server’s approved jobs. An unfamiliar connection is a lead to investigate, not proof of compromise.
2. Consider containment: Follow the organization’s response procedure and approval process. Weigh active risk against service impact and preserve relevant evidence.
3. Correlate evidence: Review process and connection telemetry alongside authentication and system logs. SSH service logs alone do not establish which process initiated an outbound connection.

Describe concrete steps and acknowledge uncertainty or the need for escalation. Clear reasoning helps demonstrate your approach; it does not determine a salary offer.

6. Frequently Asked Questions (2026 Career Guidance)

Can I really get into cyber security with zero prior IT experience in 2026?

Some people enter through training and projects, while others first gain experience in IT support or administration. No universal timeline guarantees a cybersecurity role. Which certification should I choose?

Compare credentials requested by your target vacancies with your budget and skills. No single certificate guarantees automated screening success or eligibility for every government role. Is programming mandatory?

No, writing complex commercial application code from scratch is not mandatory for foundational defense roles. However, entry-level security analysts must possess reading fluency in administrative command scripts. You must understand how to read, modify, and execute basic automation scripts written in Python, PowerShell, and Bash to parse system log directories and block suspicious network IP addresses.

Correction — September 30, 2026: Removed unsupported placement rates, salary bands and guaranteed hiring claims. The BLS figure is dated May 2025 and describes a U.S. occupation-wide median.