Not sure where you fit in security?

Look around. Here’s what different roles actually do day to day, what certifications are worth your time, which tools people actually use, and where to keep learning once the basics feel easy.

Career paths

Five common starting points. Click one to see what the day-to-day actually looks like.

SOC Analyst

You watch alerts come in from across a company’s systems and work out which ones are real. It’s the most common first job in security, and the fastest way to see a huge range of attacks up close.

Networking · Log analysis · SIEM tools · Shift work

Typical day: Triaging alerts, escalating real incidents, writing short reports.

Good first job?: Yes, often the most common entry point into security.

Common tools: Splunk, QRadar, Wireshark

Penetration Tester

Companies pay you to break into their own systems before someone else does, then write up what you found and how to fix it. More independent work, usually project-based rather than shift-based.

Web apps. Scripting. Report writing. Self-directed

Typical day:Testing a target system, documenting findings, client calls.

Good first job?: Usually a second role, after some hands-on practice.

Common tools: Burp Suite, Metasploit, Nmap

Cloud Security

You secure systems that live on AWS, Azure or Google Cloud instead of physical servers, things like access permissions, storage buckets, and how services talk to each other. Growing fast as more companies move off their own hardware.

AWS/Azure/GCP · IAM · Automation · High demand

Typical day: Reviewing permissions, fixing misconfigurations, writing policy.

Good first job?: Easier with some general IT or sysadmin background first.

Common tools: AWS Config, Terraform, Prisma Cloud

Malware Analyst

You take apart malicious software to understand exactly what it does, so defenders know what they’re up against. Detail-heavy and technical, often done quietly rather than under time pressure.

Reverse engineering · Assembly basics · Patience · Deep focus

Typical day: Running samples in a sandbox, tracing code, writing reports.

Good first job?: Rarely, this usually comes after a few years elsewhere.

Common tools:Ghidra, IDA, x64dbg

GRC (Governance, Risk & Compliance)

Less hands-on-keyboard, more making sure a company actually follows security rules and regulations, and can prove it during an audit. A good fit if you like policy and structure as much as technical depth.

Frameworks· Writing · Audits · Less coding

Typical day: Reviewing policies, preparing for audits, cross-team meetings.

Good first job?:Yes, especially with a background in writing or business.

Common tools:Spreadsheets, GRC platforms, frameworks like NIST and ISO 27001

Certifications, in plain words

Who each one is for, and roughly what it costs. None of these are required to get a job, but some help a resume stand out.

Security+

Beginner

A broad, vendor-neutral intro to security concepts. Often the first certification people get, and a common baseline requirement in job listings, especially government-adjacent roles.~$392 exam fee

~$392 exam fee

CEH

Beginner-Intermediate

Covers the concepts and tools behind ethical hacking. Well known by name, though some employers value hands-on certifications like OSCP more for actual pentesting roles.

~$1,199 exam fee

eJPT

Beginner

A hands-on, affordable entry point into penetration testing. Good as a first practical certification before attempting something harder.

~$249

OSCP

Intermediate-Advanced

A genuinely difficult, hands-on pentesting exam, you actually have to break into machines during the test. Widely respected and often listed as preferred for pentesting jobs.

~$1,749 (includes training)

Tools people actually use

You’ll see these names everywhere. Here’s what each one is actually for.

Wireshark

Captures and displays network traffic in detail, so you can see exactly what data is moving between two devices.

NETWORKING

Burp Suite

Intercepts and modifies web traffic between your browser and a website, used heavily in web app testing.

WEB SECURITY

Metasploit

A framework of ready-made exploits and payloads, used to test whether a known vulnerability can actually be exploited.
PENETRATION TESTING

Ghidra

A free reverse-engineering tool, built by the NSA, that turns compiled programs back into readable code.

MALWARE ANALYSIS

Nmap

Scans a network to find live devices and open ports, often the very first step in any assessment.

RECONNAISSANCE

Splunk

Collects logs from across a company’s systems and makes them searchable, central to most SOC work.
MONITORING