The first cybersecurity job is usually not somebody in a black hoodie cracking a vault. It is somebody staring at an alert panel, asking why a login came from somewhere strange, and deciding whether the company should panic or carry on.
That sounds less glamorous than the YouTube version. It is also closer to the money. If you want into cybersecurity from scratch, the cleanest entry point is often a Security Operations Centre, or SOC, where the work is triage, logs, tickets, and proof. Not vibes. Proof.
What does the job actually look like
An entry-level SOC analyst spends most of the day inside dashboards and logs. Splunk. Microsoft Sentinel. Sometimes ELK. The screen fills with alerts from firewalls, endpoint tools, Active Directory, and whatever other system has decided to shout first and think later. Your job is to sort the noise from the thing that actually matters.
A typical shift might start with a burst of failed logins on a production server. You check the user account, the source IP, the geolocation, the time pattern, and the machine involved. You compare that with Windows Event Viewer, Linux `journalctl`, maybe firewall logs, maybe endpoint data, maybe a packet capture if the alert deserves extra attention. If it is harmless, you close it cleanly and document why. If it looks real, you escalate with enough detail that the next analyst does not have to start from zero.
That documentation piece is where a lot of hopefuls fall apart. Companies do not just want someone who can click through an alert. They want someone who can explain what happened, what evidence supported the call, and what should happen next. A SOC analyst who writes badly is a liability. A SOC analyst who writes clearly is useful.
Why this is not penetration testing
A lot of people say they want cybersecurity, then describe red-team fantasies. That is usually not where a first job lands. The entry role is more often blue-team work, watching for signs that someone else is already inside, or trying to get in.
Penetration testing gets the attention. SOC work gets the recurring need. Every company with enough digital surface area needs someone watching for weirdness, not just someone occasionally simulating an attack. That is why the first role is often less about breaking things and more about noticing when things have already started breaking themselves.
There is also less ego in it. Good SOC work is patient, repetitive, and a little suspicious by nature. You spend a lot of time being wrong in small ways until you get good at being right in important ones. That is a better apprenticeship than it sounds.
What should you learn first
The tools matter, but only after the basics stop wobbling.
Start with networking. If you do not understand IP addresses, subnets, DNS, DHCP, HTTP, routing, and firewalls, the alert feed is just decorative noise. Then get comfortable with Windows administration and Linux command line work. On Windows, that means Event Viewer, Active Directory concepts, and PowerShell. On Linux, it means moving around comfortably, checking logs, and understanding services.
Then learn Wireshark. Not because it looks impressive in screenshots, but because packet capture forces you to see what traffic actually did, not what a dashboard claims it did. If a login, DNS query, or download looks odd, Wireshark helps you verify whether your instinct is real or dramatic.
After that, pick one SIEM path and stop collecting badges for a week. Microsoft Sentinel is a smart choice if you want something common in modern environments. Splunk is still a serious name and worth learning, especially the search language. ELK is the open-source route if you want to understand log collection and search without paying for a commercial platform. You do not need all three at once. You need one well enough to investigate something without getting lost in the interface.
Blue-team platforms help too. TryHackMe has useful SOC and incident response paths. Hack The Box Academy has structured defensive material as well. Those are better than random tutorial hopping because they force you to investigate, not just read.
How much does it cost
You can start for R0 if you already have a laptop that can survive the effort. A machine with 8GB RAM is the minimum I would call usable. 16GB makes life easier. An SSD helps a lot.
A realistic low-cost home lab sits in the R0 to R3 000 range if you need to buy a few things. VirtualBox is free. VMware Workstation Player is also a common free route for lab work. Windows Server evaluation copies are available for practice. Ubuntu and Debian cost nothing. Kali is free. You can also build a small lab with a pfSense virtual machine, one Windows VM, one Linux VM, and a deliberately vulnerable target like Metasploitable2 or OWASP Juice Shop.
The expensive part is not the software. It is the temptation to buy your way around the work. People love selling shortcuts to a field that punishes shortcuts.
How long does it take
If you are disciplined, three to six months is enough to build a portfolio that looks like the beginning of a junior application, not a fantasy CV.
That does not mean you are job-ready in six months because you watched a few videos. It means you can spend that time building evidence. Alerts investigated. Logs read. Packet captures understood. Reports written. The point is not to look busy. The point is to produce proof that you can think under pressure and document what you did.
If you are starting from a small-town or township bedroom with unstable connectivity and load shedding, that timeline still works. You just need to be realistic about the setup. Download what you can when the data is cheaper. Keep lab machines lightweight. Use what you already have before you go shopping for a fantasy workstation that will spend most of its life collecting dust.
How do you get in without a degree
A degree can help. It is not the gatekeeper people make it out to be.
What actually gets attention is evidence. Three clean incident reports will tell a hiring manager more than a generic certificate stack. Each report should show the alert, the evidence, your decision, and the response you recommend. If you can do that three times on three different scenarios, you have already shown the core habit of the job.
Put the reports in a public GitHub repo. Add lab notes. Add scripts if you wrote any, even simple Python for parsing logs or PowerShell for checking system state. If you can make a small demo video of your home lab or write a clear walkthrough, even better. That is the stuff that proves you can do the work, not just pass a quiz.
Some employers still care a lot about certifications, and yes, they can open doors. But a cert without evidence is mostly expensive stationery. If a course or bootcamp is charging you, check exactly what certification it leads to, what the exam costs, whether the lab access is included, and what work sample or portfolio you walk away with. If all you are buying is a slick promise and a PDF, you are being sold lighting, not substance.
How do you know an offer is legit
If someone promises “ethical hacker in six weeks”, assume marketing first and curriculum second.
A serious offer should answer five simple questions without stalling:
- Which certification are you preparing for?
- What is the exam fee in rand, dollars, or both?
- Is lab access included, and for how long?
- What real work output will you finish, besides a certificate?
- How does this help you prove you can actually do SOC work?
If they cannot name the evidence you will produce, they are probably selling hope with a nice logo.
Also ask whether the labs are based on the actual tasks of the role. If the content is all “hack this website” and none of “read this log, decide if it is malicious, write the incident report”, then it is not preparing you for SOC work. It is preparing you for being impressed by yourself.
What does shift work do to the job
SOC work often runs 24/7. That means nights, weekends, public holidays, and the kind of sleep pattern your body does not applaud.
This matters because alert fatigue is real. You will see a lot of false positives. A lot. Legitimate admin work can look suspicious. New software can generate odd traffic. A badly tuned rule can scream at everyone for no reason. The junior analyst who panics at every alert burns out fast. The one who learns to test, compare, and document becomes useful.
That is why trust in a SOC is earned through consistency. Close false alarms properly. Escalate real issues quickly. Write clearly enough that the next person can follow your trail. If you are careless, nobody wants you touching the network. If you are steady, people start leaving harder calls with you.
What makes you employable
Not swagger. Not a course thumbnail. Not the word “hacker” in your bio.
Employability in this lane comes from a few boring but powerful things: networking basics, patience, decent notes, comfort with logs, and enough lab time to show that you have already made mistakes somewhere safe. A junior SOC analyst who understands Wireshark, Sentinel or Splunk, Windows, Linux, and incident reporting is already ahead of the usual “I finished a bootcamp” crowd.
The entry job is watching the alarm panel. That is not a downgrade. It is the first place you learn how real attacks look when they are still ugly, confusing, and half-hidden inside normal traffic. If you can handle that, you are not pretending to work in cybersecurity. You are actually starting there.
