Build skills and a portfolio employers can check

Build a portfolio

• A home lab. Run a few virtual machines on your own computer: an attacker machine, a target and a logging server. Write down what you built, what broke and how you fixed it.
• Capture-the-flag (CTF) challenges. CTFs are puzzles in which you exploit or analyze a system to find a hidden string (the flag). CTFtime keeps a public calendar and archive of events, with past write-ups^[1].
• Write-ups. Write one short write-up a month. Explain a solved challenge in plain language (after the competition ends, never during it).
• Open-source contributions. Many projects label beginner tasks "good first issue," and GitHub counts documentation and other non-code help as contributions^[2]. OWASP projects are built and maintained by volunteers^[3].
• A simple site. Host your write-ups on GitHub Pages and link the site from your resume^[4].

A hiring manager can read one page of your work in two minutes. Three clear write-ups do more for you than thirty screenshots.

Practice legally

Test only systems you own or have written permission to test. Federal law makes unauthorized access to computers a crime^[5]. Curiosity is not a defense.

• Intentionally vulnerable targets. OWASP Juice Shop is an insecure web application built for security training^[6]. Run your own copy, and attack it as hard as you like.
• Bug bounty programs. Companies invite outside researchers to find and report vulnerabilities, and some pay rewards. Each program publishes a policy that sets its scope (the systems you may test) and its rules^[7].
• Safe harbor. A safe harbor statement is the program's promise that good-faith research within its policy counts as authorized, and that it will not take legal action against you for that research^[8]. disclose.io publishes open safe harbor policy templates and a directory of disclosure programs^[9]. Safe harbor terms differ by program, so read each one.
• Stay in scope. HackerOne requires you to review a program's policy before you test^[10]. Bugcrowd tells researchers never to test out-of-scope targets and warns that doing so can end in a ban^[11].
• Check age and payment rules. HackerOne requires a parent or guardian to accept its terms for users under 18^[12]. Bugcrowd pays rewards only to researchers who are at least 18 or have reached the age of majority^[13].

Start with practice targets and programs that accept reports without rewards. A clear report is a portfolio item once the program allows you to disclose it.

Free training

• CISA Learning. The Cybersecurity and Infrastructure Security Agency (CISA) replaced its old FedVTE platform with CISA Learning. It offers about 850 hours of no-cost training mapped to the NICE Framework, and U.S. residents sign in with Login.gov^[14].
• NICCS Education and Training Catalog. A searchable list of thousands of in-person and online cybersecurity courses from many providers^[15]. Check the price on each listing.
• MITRE ATT&CK training. MITRE publishes courses on ATT&CK (a public knowledge base of attacker tactics and techniques), including ATT&CK Fundamentals and a Cyber Threat Intelligence course^[16].
• Microsoft Learn AI security fundamentals. A beginner learning path of three modules: AI security, AI security controls and an introduction to AI security testing^[17].

Practice platforms

• OverTheWire. Start with Bandit, which teaches Unix and Linux basics through short levels^[18].
• CyLab Security Academy. Carnegie Mellon's free practice platform, formerly picoCTF. Older picoCTF logins still work^[19].
• TryHackMe. Guided exercises that run in your browser. Students get 20% off an annual Premium subscription^[20].
• Hack The Box Academy. A discounted student subscription is available once you verify an academic email address^[21].
• After graduation: SANS Cyber Academy. Free, intensive training for career changers. Full-time students are not eligible, and it requires U.S. citizenship or permanent residence^[22].

Competitions help, but are optional

• National Cyber League (NCL). Individual and team games run each fall and spring. High school and college students in the United States and Canada can play^[23][24].
• Collegiate Cyber Defense Competition (CCDC). College teams run and defend a business network against a live attacking team, through regional rounds to a national final^[25]. Ask your department whether it fields a team.

Competitions give you a rank, a date and a team to describe in an interview. They are useful, not required. A portfolio of labs and write-ups shows the same skills.

Go to conferences and meetups

• BSides. Local security conferences run by and for the community^[26]. Each event sets its own price.
• OWASP chapter meetings. Free and open to non-members^[27].
• DEF CON. DEF CON does not offer student discounts. Its FAQ lists other ways to attend free, such as working on a contest, event or village^[28].
• WiCyS conference scholarships. These cover registration and shared lodging. See Scholarships.

Bring a one-sentence introduction, and ask people what their team works on. See Start here for local chapters.

Related Pathway Finder roles

Each role guide covers the work, the realistic first job, starter certifications and free practice.

Sources

We checked each source in October 2026. Rules, prices and dates change, so confirm them on the source before you act.

1. [1] CTFtime. CTFtime.org: all about CTF (capture the flag).
2. [2] GitHub Docs. Finding ways to contribute to open source on GitHub.
3. [3] OWASP Foundation. About OWASP.
4. [4] GitHub Docs. What is GitHub Pages?.
5. [5] Legal Information Institute. 18 U.S. Code 1030 (Computer Fraud and Abuse Act).
6. [6] OWASP Foundation. OWASP Juice Shop.
7. [7] HackerOne. Vulnerability disclosure guidelines.
8. [8] HackerOne. Safe harbor overview and FAQ.
9. [9] disclose.io. Vulnerability disclosure standards and tools.
10. [10] HackerOne. Code of conduct.
11. [11] Bugcrowd. Reviewing bounty briefs.
12. [12] HackerOne. Community member terms and conditions.
13. [13] Bugcrowd. Standard disclosure terms.
14. [14] CISA NICCS. CISA Learning.
15. [15] CISA NICCS. Education and Training Catalog.
16. [16] MITRE. ATT&CK training.
17. [17] Microsoft Learn. AI security fundamentals learning path.
18. [18] OverTheWire. Wargames.
19. [19] Carnegie Mellon University CyLab. CyLab Security Academy.
20. [20] TryHackMe. Student discount.
21. [21] Hack The Box. Getting the student subscription.
22. [22] SANS Institute. SANS Cyber Academy.
23. [23] National Cyber League. National Cyber League.
24. [24] National Cyber League. Spring 2026 NCL winners.
25. [25] National Collegiate Cyber Defense Competition. NCCDC.
26. [26] BSides. BSides Global Community.
27. [27] OWASP Foundation. Local chapters.
28. [28] DEF CON. Frequently asked questions.