Lesson 1.5: Jobs in cybersecurity and your learning path

The main roles in the field, from the security operations centre (blue team) and incident response to penetration testing (red team), security engineering and governance, risk and compliance; what each does all day and which skills they share; where this academy's courses fit; and a first learning plan written in the lab from real-looking job descriptions.

15 min

You will learn to

Name the main cybersecurity roles and what they do
Explain red team, blue team and purple team
Find the skills most roles share
Write a first learning plan

Key terms

Blue team: The defenders: people who monitor, detect and respond to attacks and harden systems.
Red team: People who attack an organisation's systems with permission, the way a real attacker would, to find weaknesses before criminals do.
Security Operations Center (SOC): The team (often 24/7) that watches alerts and logs and handles suspicious events.
SIEM: Software that collects logs from many systems in one place and raises alerts on suspicious patterns.
Penetration test: An authorised, scoped attempt to find and demonstrate weaknesses in systems, ending in a written report.
GRC: Governance, Risk and Compliance: setting security policies, assessing risk and checking that laws and standards are followed.

← Linux distributions · All lessons · Kernel, shell and terminal →