Information security: where to start

Directions within the field

This isn't one profession but several.

The offensive side. Security testing: finding vulnerabilities in a client's systems with their permission. The romanticised direction, but rarely a first job.

The defensive side. Monitoring events, incident response, investigation. There are more entry-level roles here than people assume.

Secure development. Checking code for vulnerabilities, embedding checks into the build process. A good route for people arriving from development.

Compliance. Documents, policies, audits. Less technical, more regulatory. Often underrated, with steady demand.

Infrastructure security. Configuring network protection, access, equipment. Closer to system administration.

What you need at entry

Whichever direction:

Networking. Deeper than a developer needs: protocols, routing, what can be seen in traffic.

Operating systems. Linux essential, Windows desirable. Permissions, processes, logs.

How web applications work. Service calls, authentication, sessions, databases.

The main vulnerability classes. Injection, running code in someone's browser, permission failures, insecure storage.

Scripting. Python at the level of automating routine work.

The barrier is above average: you must understand how the thing you're protecting works.

Can a beginner get in

Into defence and compliance — yes, entry-level roles exist. Working in a monitoring centre is a common way in, though the work is shift-based and initially repetitive.

Into security testing — usually not. People arrive there with development or administration experience, because you can't find holes in something you don't understand.

Into secure development — through development. The best route for someone already writing code.

Building practice legally

Separately and emphatically: probing someone's systems without permission is a crime. Not a grey area — an offence. Good intentions don't help.

Legal routes:

Training ranges. Purpose-built environments with deliberately vulnerable systems where you can practise freely.

Security competitions. Regular contests finding vulnerabilities in prepared challenges. They read well on a CV.

Bug bounty programmes. Companies formally permit searching their systems and pay for findings. Strictly within the programme's rules.

Your own lab. Stand up a vulnerable system at home and break it as much as you like.

Auditing your own projects. Take your own application and try to find holes in it. You'll simultaneously learn not to create them.

What to show in a portfolio

Write-ups from training ranges, competition results, vulnerability analyses explaining the mechanics, and your own tools for automating checks.

Separately valuable: taking the security role in someone else's project. Reviewing a team's code for vulnerabilities, explaining what you found and helping fix it is precisely the job — and it gives you something to talk about.