Career studio / Cybersecurity
Build evidence for the Cybersecurity Analyst role
A fictional training portal shows repeated failed sign-ins followed by a success. Triage the evidence, build a timeline and recommend proportionate defensive follow-up.
Your outcome: Security triage report, event timeline and incident escalation decision.
Start with the right expectations
Who this is for
Basic networking and operating-system concepts; exercises use synthetic logs only.
This path develops a demonstrable work sample for the named role. It does not replace employer-specific experience, professional qualifications or supervised practice.
Plan your study time
Use a flexible six-week project schedule: one week for each of the first four stages and two weeks for the portfolio and review. Allow roughly 3–5 hours per week for the case work, in addition to course study. This is a planning suggestion, not a measured course duration or a promise of job readiness.
Read the course access notes before starting. Free viewing or reading does not automatically include certificates, graded assessments, software licences or paid cloud resources. Core case work can be documented with a free editor and spreadsheet; optional implementation tools may have additional requirements.
Your course sequence
Start in the order below. Use the course outline to select the sections relevant to the stage tasks, and complete foundation exercises before moving on. Full provider courses can be substantially longer than this project schedule. These are course resources, not a claimed count of individual lessons.
Resource 01 / Google
Free Cybersecurity Course for Beginners by Google
Purpose: Build the foundations. Connect your notes to the case tasks below rather than only collecting completion marks.
Access: Free Video
Certificate: Free video viewing; a Google certificate is not included
Resource 02 / IBM
Free Security Operations Course: SIEM, SOAR and EDR
Purpose: Develop the role-specific method. Connect your notes to the case tasks below rather than only collecting completion marks.
Access: Free Video
Certificate: Free video viewing; IBM certification is not included
Resource 03 / IBM
Free Cybersecurity Architecture Course: Identity to Response
Purpose: Strengthen practical application. Connect your notes to the case tasks below rather than only collecting completion marks.
Access: Free Video
Certificate: Free video viewing; IBM certification is not included
Learn, make, check
Keep a decision log as you work. For each stage, capture the assumption, your work product, a check and the change you made after that check. The acceptance criterion is the stopping condition for the stage.
Stage 1 / suggested project week 1
Understand the environment
Understand: A security event needs asset and account context.
Make: Map the portal, identity service and relevant log fields.
Check before moving on: Use fictional accounts and documentation-reserved example addresses.
Study companion: Free Cybersecurity Course for Beginners by Google. Use its relevant lessons and examples; the independent WikiFree task is not a provider assessment.
Save as evidence: a dated work product and a short note explaining one choice, one alternative and one remaining uncertainty.
Stage 2 / suggested project week 2
Build the timeline
Understand: Events become useful when timestamps and identities are consistent.
Make: Normalize timestamps and order the supplied events; distinguish facts from hypotheses.
Check before moving on: A failed login alone is not proof of compromise.
Study companion: Free Security Operations Course: SIEM, SOAR and EDR. Use its relevant lessons and examples; the independent WikiFree task is not a provider assessment.
Save as evidence: a dated work product and a short note explaining one choice, one alternative and one remaining uncertainty.
Stage 3 / suggested project week 3
Assess and escalate
Understand: An analyst should connect evidence to a defensible severity decision.
Make: Write the impact questions, evidence gaps and escalation recommendation.
Check before moving on: Avoid unsupported attribution to a person or group.
Study companion: Free Cybersecurity Architecture Course: Identity to Response. Use its relevant lessons and examples; the independent WikiFree task is not a provider assessment.
Save as evidence: a dated work product and a short note explaining one choice, one alternative and one remaining uncertainty.
Stage 4 / suggested project week 4
Recommend defensive controls
Understand: A useful response balances containment and operational impact.
Make: Propose account review, stronger authentication and log retention checks for authorized owners.
Check before moving on: Do not attempt credential attacks or test a real third-party system.
Study companion: Free Cybersecurity Architecture Course: Identity to Response. Use its relevant lessons and examples; the independent WikiFree task is not a provider assessment.
Save as evidence: a dated work product and a short note explaining one choice, one alternative and one remaining uncertainty.
Stage 5 / suggested project weeks 5–6
Present your portfolio
Assemble the four work products into Security triage report, event timeline and incident escalation decision. Write a README explaining the problem, your assumptions, the decisions you made, tests actually performed and what remains incomplete.
Give a five-minute walkthrough: one minute for the problem, two for the work and evidence, one for trade-offs and one for the next improvement. If you have not implemented a proposed system, label it a design or prototype rather than a deployed solution.
Acceptance: a reviewer can locate each work product, reproduce the key reasoning and identify the limits without a private explanation from you.
The portfolio brief
A fictional training portal shows repeated failed sign-ins followed by a success. Triage the evidence, build a timeline and recommend proportionate defensive follow-up.
Deliver: Security triage report, event timeline and incident escalation decision.
| time utc | account | event | source ip |
|---|---|---|---|
| 09:00 | user-demo | login_failure | 192.0.2.10 |
| 09:01 | user-demo | login_failure | 192.0.2.10 |
| 09:04 | user-demo | login_success | 192.0.2.10 |
Use these small inputs to make the reasoning visible. They are not a representative dataset, a real client engagement or evidence of production performance. Where the brief requires additional sample records, create them yourself, label them synthetic and explain why you added them.
The ZIP includes the case CSV, four stage worksheets, course sequence, decision log, test log, portfolio README template, review rubric and reference reasoning. It is a starter kit for your work, not a completed application, professional report or proprietary project file.
Check your reasoning
Two failures precede one successful login. Is compromise proven?
Write your answer and assumptions before opening the reference.
Read the reference reasoning
No. It is a signal to investigate with account-owner confirmation, device context and additional events. Preserve evidence and follow the organization’s incident process.
Portfolio review rubric
| Criterion | Points | Evidence required |
|---|---|---|
| Problem and scope | 4 | A clear user, need, boundary and assumptions |
| Role-specific work | 8 | 2 points for each of the four stage acceptance checks |
| Reasoning and validation | 4 | Independent checks, actual results and uncertainty |
| Communication and reproducibility | 4 | A usable README, source links and reviewable work products |
Aim for at least 16/20 as a self-review target, with no missing stage acceptance check. This is a WikiFree practice rubric, not an industry credential or a hiring assessment.
Interview practice
Which missing evidence would most change your triage decision?
Answer using the case: context, your action, evidence and limitation. Describe this honestly as a self-directed project. Do not present fictional organizations, invented interviews or practice results as paid work experience.
Your progress
Use this checklist as a personal study aid. Progress is stored in this browser when local storage is available; it is not an account record or a certificate.
0 of 5 milestones complete
The lessons and projects remain readable without JavaScript. Automatic progress saving requires JavaScript.
Questions before you start
Will this path qualify me for a job?
It helps you study relevant foundations and produce a work sample. Employers may require additional skills, qualifications and experience. Review actual role requirements before applying; no job or certification is guaranteed.
Are all tools and certificates free?
The linked learning routes were selected for free viewing or reading. Follow the separate access and certificate notes on each course. Paid tools and cloud deployment are optional; document a local design when implementation resources are unavailable.
Can I follow this on a phone?
You can read the path and many learning resources on a phone. Coding, detailed spreadsheet work, design tools and mobile-app development are easier or require a suitable computer. The page is designed to reflow; that is not a claim that every physical device has been tested.
Questions & discussion
Share a useful question or correction. Comments appear after moderation. Please avoid personal or sensitive information.