The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

Navigating the first two years of a security career

2026.09.08//7 MIN READcareerfundamentalsred-teamblue-team

// Getting Started: A Practical Approach

The first two years in cybersecurity often feel like you’re drowning in a sea of acronyms and buzzwords. Amidst this chaos, establishing a solid foundation in both offensive and defensive techniques is critical. If you’re new to the field or transitioning from another role, focusing on hands-on experience and practical knowledge will set you apart.

Develop a Lab Environment

Creating a controlled lab environment allows you to experiment and learn without the risk of legal consequences. Tools like VirtualBox or VMware can help you set up multiple virtual machines (VMs). Here’s a simple approach to creating your lab:

1. Choose your OS: Linux (Kali, Ubuntu) and Windows are must-haves. 2. Set up vulnerable targets: Consider Metasploitable or OWASP Juice Shop for practice. 3. Networking setup: Ensure your VMs can communicate. A NAT network is usually sufficient for beginners.

#### Example of creating a VM in VirtualBox:

VBoxManage createvm --name "Kali-Linux" --register
VBoxManage modifyvm "Kali-Linux" --memory 2048 --cpus 2 --nic1 nat
VBoxManage createhd --filename "Kali-Linux.vdi" --size 20000
VBoxManage storagectl "Kali-Linux" --name "SATA Controller" --add sata --controller IntelAhci
VBoxManage storageattach "Kali-Linux" --storagectl "SATA Controller" --port 0 --device 0 --type hdd --medium "Kali-Linux.vdi"
VBoxManage storageattach "Kali-Linux" --storagectl "SATA Controller" --port 1 --device 0 --type dvddrive --medium path_to_kali.iso

Skill Development: Focus on Key Areas

Your first two years should focus on a mix of technical skills and soft skills. Here are critical areas to develop:

  • Networking fundamentals: Understand TCP/IP, subnets, and protocols. Wireshark can help analyze traffic.
  • Operating Systems: Get comfortable with both Linux and Windows. Know basic commands and configurations. For Linux, understanding the root user and the implications of uid 0 is vital. See What root actually means on Linux, and why uid 0 is not magic.
  • Scripting: Learn Python or Bash scripting to automate tasks and analyze logs.

#### Example of a simple Python script to analyze logs:

import re

with open('access.log') as f:
    for line in f:
        if re.search('404', line):
            print(line.strip())

Certifications: Worth Your Time?

Certifications can add credibility to your resume, but they should not be your only focus. Consider pursuing:

  • CompTIA Security+: Good for fundamentals.
  • Certified Ethical Hacker (CEH): Introduces offensive techniques.
  • Certified Information Systems Security Professional (CISSP): More advanced, for later in your career.

Networking: Build Connections

Engage with the community. Attend local meetups or webinars. This is where you’ll find mentorship opportunities and job leads. Websites like Meetup.com or security-focused Discord servers can help you connect with industry professionals.

Common Pitfalls to Avoid

  • Neglecting soft skills: Communication, teamwork, and problem-solving are as important as technical knowledge.
  • Ignoring documentation: Keep track of your learnings and projects. Tools like Jupyter Notebooks can help organize notes and code.
  • Overlooking security fundamentals: Always understand the basics before diving into advanced topics. Skills like defending Active Directory environments are critical; see Active Directory objects: Defending your digital realm.

Checklist for Your First Two Years

  • [ ] Set up a lab environment.
  • [ ] Learn networking fundamentals and TCP/IP.
  • [ ] Get hands-on with both Linux and Windows.
  • [ ] Write simple scripts for automation.
  • [ ] Build a portfolio of projects.
  • [ ] Attend at least one security conference.

Conclusion

The first step in your security career can be daunting, but with a structured approach, you can develop the skills necessary to thrive. Focusing on a blend of practical experience, community engagement, and continuous learning will set the stage for a rewarding career. Remember, the DaemonCore Academy curriculum is free, so leverage these resources and practice in a controlled environment that you own. Stay curious and committed to your growth.