35. Careers, Certifications and Bug Bounty
35.1 Cyber Security Job Roles
| Role | What they do | Chapters that prepare you |
|---|---|---|
| SOC Analyst (L1/L2) | Monitor SIEM alerts, triage, escalate, investigate | 1–6, 19, 24, 31 |
| Incident Responder | Contain and clean up attacks, lead investigations | 28, 31, 34 |
| VAPT / Penetration Tester | Test apps, networks and cloud with permission, write reports | 18–26, 29 |
| Web Application Security Tester | Find OWASP issues in web apps and APIs | 9–16, 21, 29 |
| Cloud Security Engineer | Secure AWS/Azure accounts, IAM, logging, guardrails | 12–16, 30 |
| Security Engineer / Hardening | Build and maintain firewalls, EDR, hardened servers | 5–8, 32 |
| Digital Forensics Analyst | Collect and analyse evidence from disks, memory, logs | 28, 34 |
| GRC / Compliance Analyst | Policies, risk assessments, audits (ISO 27001, DPDP) | 18, 34 |
| DevSecOps Engineer | Add security scanning and secrets control into CI/CD pipelines | 16, 29, 30 |
| Threat Intelligence Analyst | Track attacker groups, indicators and trends | 19, 27, 31 |
For freshers the most common entry points are SOC Analyst L1, VAPT trainee and IT/cloud support with security duties. Many people move into security from system administration, networking or development – your AWS and Linux skills are a real advantage.
Ravindra Bagale's Tip
All freshers say "I want to become an ethical hacker" and think they need OSCP on day one. Start as a SOC or VAPT trainee, gain experience, then specialise. And if your networking + Linux are weak, no security role will last – make the foundation solid.
Ravindra Bagale's Tip – मराठी
Freshers सगळे "मला ethical hacker व्हायचे" म्हणतात आणि पहिल्या दिवशी OSCP लागेल असा विचार करतात. सुरुवात SOC किंवा VAPT trainee पासून करा, experience घ्या, मग specialise करा. आणि networking + Linux कच्चे असेल तर कुठलाच security role टिकत नाही – पाया पक्का करा.
Ravindra Bagale's Tip – हिंदी
सारे freshers कहते हैं "मुझे ethical hacker बनना है" और सोचते हैं कि पहले दिन OSCP चाहिए. शुरुआत SOC या VAPT trainee से करो, experience लो, फिर specialise करो. और networking + Linux कच्चा हो तो कोई भी security role नहीं टिकता – नींव पक्की करो.
Practice task
Pick two roles from the table that interest you. Search current job postings for each on a job portal and write down the five skills and two tools that appear most often. Mark which chapters of this book cover them and which gaps you still need to fill.
Extended teaching notes
Why this lesson matters
Hiring managers in India look for labs, clear ethics, and the ability to explain a fix. Certifications help; unauthorised testing destroys careers.
- Build a home lab and keep notes.
- Publish write-ups only for systems you own or public labs.
- Learn Linux, networking, one cloud, OWASP.
- Practice platforms: TryHackMe, HTB, PortSwigger Academy — under their rules.
Mini case study
Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.
Defender's worksheet (do this today)
- Write the lesson title, date and the exact lab target you are allowed to use.
- List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
- Run one safe check from the lesson on a lab system only. Paste the command and output.
- Write a two-sentence fix you would give a teammate.
- Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.
Indian workplace (sample data)
Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).
Global practice
Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.
Everyday analogy
Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.
Key terms
- Control: a safeguard (patch, config, process, detection).
- Finding: a weakness backed by evidence.
- Remediation: the fix plus how you verified it.
- Scope: systems you have written permission to touch.
- Least privilege: only the access the task needs.
- Defence in depth: several layers so one failure does not end the story.
Common mistakes
- Skipping written permission "just for a quick scan".
- Practising on hostel, office or public targets without authorisation.
- Collecting tool output without writing the fix.
- Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
- Publishing screenshots that contain secrets, cookies or internal hostnames.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Fix > spectacle.