Plan your cybersecurity career, year by year

Your first month

1. Pick two or three target roles. The Pathway Finder ranks 14 roles by your interests in about five minutes. Each role guide names a realistic first job, such as a security operations center (SOC) analyst at a company or at a managed detection and response (MDR) provider. The Finder uses the NICE Workforce Framework (a common vocabulary for cybersecurity work, maintained by the National Institute of Standards and Technology) as its reference^[1].
2. Start a portfolio. Create a GitHub account and one public repository for lab notes and write-ups. GitHub Pages can host a personal site straight from a repository^[2]. See Build skills.
3. Join a student club. Ask your department which security clubs and competition teams meet on campus. Women in CyberSecurity (WiCyS) supports student chapters, though new chapter applications are paused until spring 2027^[3].
4. Find a faculty mentor. Agree on a meeting schedule at the first meeting, and keep it.
5. Start a one-page resume. Update it every term. See Get hired.
6. Learn research ethics basics. Complete your campus research ethics training before you work with data about people^[4].

Join the local security community

Local chapters put you in a room with working practitioners, and some of them hire interns and new graduates. Go to one meeting a month, and talk to two people at each.

• OWASP chapters. The Open Worldwide Application Security Project (OWASP) runs local chapters with free meetings, talks and training open to members and non-members^[5].
• ISSA chapters. The Information Systems Security Association (ISSA) offers student membership at US$30 a year plus local chapter dues, for full-time students not yet working full-time in cybersecurity^[6].
• ISACA chapters. ISACA (a professional association for IT audit, risk and governance) has more than 200 local chapters^[7]. Student membership is US$25 a year plus chapter dues^[8]. It fits GRC Analyst and IT Auditor targets.
• BSides. BSides events are local security conferences run by and for the security community^[9]. Each event sets its own ticket price, so check its page.

Every semester

• Take one skill step. Finish a lab, a competition, a write-up or a certification step each term. See Build skills and Certifications.
• Add one item to your portfolio. A write-up, a lab diagram or a small tool you wrote all count.
• Keep your grades up. Many scholarships set a minimum grade point average (GPA), such as 2.5 for ISC2's academic scholarships^[10].
• Meet your mentor on schedule. Bring a short written update and one specific question.

Every year

• Late summer and fall: apply for next summer's internships. Many large employers in technology, finance and consulting start recruiting in late summer or early fall for roles that begin the following year^[11][12]. Other employers post later, so check each posting's closing date.
• Use every channel. Go to campus career fairs, and check your career center's job board. Handshake, for example, partners with more than 1,500 schools and colleges^[13]. Ask the people you meet at chapter meetings for referrals.
• Summer: work in a security role. An internship, a research assistantship or a campus IT security job gives you experience to describe on a resume. Internships also lead to jobs: in a 2026 National Association of Colleges and Employers (NACE) survey, employers converted 63.1% of their 2024-25 interns into full-time hires^[14].
• Spring: update your plan. Compare your resume and portfolio with two real job postings for your target role, and close one gap before fall.

Your final year

• Apply early. The same fall timeline applies to many full-time programs for new graduates at large employers^[11].
• Ask for referrals. Former internship managers, club alumni and chapter contacts can refer you. Send each one the posting and your resume.
• Compare offers before you accept. See Get hired for how to compare pay and ask for time.

Having a plan matters less than following it. The pages below cover each step in detail.

If you are considering government or defense work

Many government and defense contractor jobs require a security clearance. If that track interests you, start a records file now. The clearance questionnaire asks for 10 years of addresses, employers and schools, and 7 years of foreign travel and close foreign contacts^[15]. Working in government or defense covers the process, and Get hired covers federal applications.

The rest of this guide

Related Pathway Finder roles

Each role guide covers the work, the realistic first job, starter certifications and free practice.

Sources

We checked each source in October 2026. Rules, prices and dates change, so confirm them on the source before you act.

1. [1] CISA NICCS. NICE Framework work roles (v2.2.0 data).
2. [2] GitHub Docs. What is GitHub Pages?.
3. [3] WiCyS. Student chapters.
4. [4] HHS Office for Human Research Protections. Office for Human Research Protections.
5. [5] OWASP Foundation. Local chapters.
6. [6] ISSA. The benefits of membership at student-friendly rates.
7. [7] ISACA. Join an ISACA local chapter.
8. [8] ISACA. Become a member.
9. [9] BSides. BSides Global Community.
10. [10] ISC2 Center for Cyber Safety and Education. Academic scholarships.
11. [11] Cornell University Career Services. Recruiting timeline by career pathways.
12. [12] University of Washington Career & Internship Center. Internships: recruiting candidates.
13. [13] Handshake. Handshake for career centers.
14. [14] National Association of Colleges and Employers. Intern conversion rate hits highest mark in five years (April 3, 2026).
15. [15] OPM. Standard Form 86, Questionnaire for National Security Positions.