Cybersecurity Analyst

☐ Networking Fundamentals · Required · 8 hrs

OSI model, TCP/IP, DNS, DHCP, HTTP/S, common ports. Every attack and defence happens over a network.

• Networking Deep Dive — Subnets, Routing, Firewalls, VPNs (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/networking-deep-dive
• The TCP/IP Model — How the Internet Works (Networking): https://chaduvuko.com/learn/networking/tcp-ip-model
• Ports and Sockets — Where Applications Live (Networking): https://chaduvuko.com/learn/networking/ports-and-sockets

☐ Linux & Command Line · Required · 6 hrs

File permissions, processes, user management, log files, bash scripting. Most servers run Linux and most attacks target Linux.

• Linux for Security Engineers (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/linux-for-security
• Linux Hardening — From Default to Secure (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/linux-hardening

☐ Scripting (Python / Bash) · Required · 6 hrs

Automate log parsing, write detection rules, build security tools. Security engineers who can code are 10x more effective.

• Linux and Shell Scripting for Data Engineers (Data Engineering): https://chaduvuko.com/learn/data-engineering/linux-shell
• Building a CLI Tool (Python): https://chaduvuko.com/learn/python/building-a-cli-tool

☐ Cryptography · Required · 5 hrs

Symmetric/asymmetric encryption, hashing, PKI, TLS/SSL, certificates. You can't understand HTTPS, VPNs, or token signing without this.

• Cryptography From Scratch (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cryptography-fundamentals
• TLS — How Encryption Protects Every HTTPS Request (Networking): https://chaduvuko.com/learn/networking/tls-ssl

☐ Security Fundamentals · Required · 6 hrs

CIA triad, threat actors, attack surfaces, defence in depth, least privilege, zero trust. The mental model for all security work.

• What is Cybersecurity? (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/what-is-cybersecurity
• The CIA Triad and Security Models (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cia-triad-security-models
• How Attackers Think — The Kill Chain and MITRE ATT&CK (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/attacker-mindset-kill-chain

☐ OWASP & Web Security · Required · 6 hrs

OWASP Top 10, SQLi, XSS, CSRF, SSRF, broken auth. Web applications are the most common attack vector.

• Web Application Attacks — OWASP Top 10 From First Principles (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/web-attacks-owasp
• Secure Coding — Building Software That Does Not Break Under Attack (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/secure-coding

☐ SIEM & Log Analysis · Required · 7 hrs

Splunk or Microsoft Sentinel, log collection, correlation rules, dashboards, threat hunting. The core tool of every SOC.

• SIEM and Log Analysis — Finding Attacks in the Noise (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/siem-log-analysis

☐ Vulnerability Assessment · Required · 5 hrs

Nmap, Nessus, OpenVAS, CVE scoring, patch management. Know what's exposed before attackers do.

• Vulnerability Management — Scanning, Prioritisation, Remediation (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/vulnerability-management
• Vulnerabilities and Exploits — CVEs, Zero-Days, and Patch Management (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/vulnerabilities-and-exploits

☐ Penetration Testing · Recommended · 20 hrs

Metasploit, Burp Suite, privilege escalation, report writing, HackTheBox / TryHackMe practice. The offensive mindset that makes defenders better.

• Penetration Testing — Methodology, Scoping, and Legal Framework (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/penetration-testing-methodology
• Reconnaissance — OSINT and Footprinting (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/reconnaissance-osint
• Scanning and Enumeration (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/scanning-enumeration
• Web Application Pentesting — SQL Injection to IDOR (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/web-app-pentesting

☐ Incident Response · Required · 7 hrs

IR lifecycle, containment, eradication, recovery, forensics basics, post-incident reports. How teams respond when the alarm fires.

• Incident Response — From Alert to Recovery (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/incident-response
• Threat Intelligence and Threat Hunting (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/threat-intelligence-hunting

☐ Threat Modelling · Required · 5 hrs

STRIDE, DREAD, MITRE ATT&CK, attack trees, data flow diagrams. Bake security into the design phase rather than bolt it on later.

• How Attackers Think — The Kill Chain and MITRE ATT&CK (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/attacker-mindset-kill-chain
• Security Architecture — Defense in Depth and Zero Trust (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/security-architecture

☐ Cloud Security · Required · 8 hrs

AWS/Azure security services, IAM misconfigurations, CSPM, container security, secrets management. The cloud is where most companies run now.

• Cloud Security — Shared Responsibility and IAM Misconfiguration (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/cloud-security

☐ Compliance & Frameworks · Recommended · 5 hrs

ISO 27001, SOC 2, NIST Cybersecurity Framework, GDPR basics, risk management. Required for regulated industries.

• Compliance Frameworks — NIST, SOC 2, ISO 27001, PCI-DSS (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/compliance-frameworks

☐ Certification (CEH / CompTIA) · Recommended · 20 hrs

CompTIA Security+, CEH, or OSCP. Certifications open doors at service companies and MNCs significantly.

• Security Certifications — Which One to Get First (Cybersecurity): https://chaduvuko.com/learn/cybersecurity/security-certifications