Find a path. Practice one skill at a time.
Explore a role, try a related activity, and turn your work into a small example you can discuss. These are starting points—not job guarantees, prerequisites, or a fixed sequence. Some linked course activities may require sign-in and an assigned track.
IT support and help desk
Support work can be a useful way to build IT experience: listen to users, narrow a problem, document findings, and escalate when needed. Titles and requirements vary by employer.
Build the foundation
- Learn IP addressing, DNS, basic connectivity, and account access.
- Practice asking what changed, who is affected, and what has already been tried.
- Explain a technical issue clearly without blaming the user.
Practice and show your work
Write a fictional support handoff describing a name-resolution problem, the checks performed, what each result showed, and the next step. Label the work as a simulation.
Review troubleshooting tools and ports →Security operations
Security operations work can involve reviewing alerts, comparing logs, recording evidence, and escalating based on an organization’s procedures. Some analyst positions ask for prior IT experience.
Build the foundation
- Distinguish an observable event from an assumption about its cause.
- Review identity, network and endpoint logs with consistent timestamps.
- Learn how to document actions and use an incident-response process.
Practice and show your work
Use the fictional MFA prompt scenario to write a short incident handoff: confirmed facts, alternate explanations, next checks, and an open question.
Try the fictional SOC exercise →Identity and access support
Identity teams help people get appropriate access while controlling changes, reviewing permissions, and removing access when it is no longer needed. Responsibilities differ across organizations.
Build the foundation
- Separate authentication from authorization.
- Understand MFA, least privilege, access reviews, and joiner–mover–leaver processes.
- Practice documenting approvals and time-limited access.
Practice and show your work
Describe a fictional employee role change: requested access, approval, old access to remove, new access to grant, and a review date.
Walk through the identity lifecycle →Governance, risk, and compliance
GRC work can include identifying risks, organizing evidence, tracking actions, and communicating requirements. A control’s owner, obligations, and actual job duties depend on the organization.
Build the foundation
- Compare policies, standards, procedures, and controls.
- Describe likelihood and impact, risk treatment, and ownership.
- Practice asking what evidence supports a control’s operation.
Practice and show your work
Create a one-page fictional vendor-risk note: what data is involved, one concern, a proposed treatment, and a question for the vendor.
Try the third-party risk exercise →Cloud and infrastructure
Explore how identity, networking, operating systems, data, and cloud services fit together. Some cloud and systems roles expect experience with administration or networking.
Build the foundation
- Compare on-premises, cloud, and hybrid environments.
- Distinguish IaaS, PaaS, and SaaS and check the service-specific shared responsibility model.
- Study secure configuration, logging, backup, and recovery.
Practice and show your work
Diagram a fictional local identity service connected to a cloud application. Label who manages users, the guest operating system, backups, and logging; note what depends on the provider agreement.
Open the cloud and hybrid guide →Choose your next step
- Pick one path that interests you; explore more than one if you like.
- Compare several actual job postings for the location and work arrangement you want. Note the skills and qualifications employers request.
- Choose one activity above and complete a clearly labeled fictional work sample.
- Discuss what you learned with your instructor and identify one skill to practice next.
Keep credentials, student information, private tickets, and sensitive logs out of shared work. Use only systems you own or are authorized to assess. This page does not collect or save your responses.
Explore NIST’s NICE Framework ↗ · Read the BLS information security analyst profile ↗