Cybersecurity analyst: a practical starter project

The project brief

Create a threat model for a fictional student-club website without testing any real target.

The purpose is to experience a small part of the work before making a larger education or career commitment. This is not an aptitude test and there is no pass/fail career recommendation. Keep the task small enough to revise after feedback. If you cannot access specialist equipment, use a paper model, simulation or invented data rather than improvising unsafe real-world work.

Define the output before you begin

A system diagram, five prioritised risks and a checklist of defensive controls.

Write down the intended user, the question you are answering and the constraints you are accepting. Limit the first version to one useful outcome. Keep a short source and permissions log for any material you use, and label invented data clearly. Do not collect health, financial, identity or other sensitive information to make a student project appear more realistic.

A four-session working plan

The sessions are a suggested exploration structure, not a promise that you can learn the profession in four sittings. Adjust the scope or ask for help if a task becomes unsafe, inaccessible or too technically demanding.

• Session 1 — Understand the brief. Sketch two approaches and explain why one is more manageable with your current skills and resources.
• Session 2 — Make a rough first version. Keep a record of confusing decisions and errors instead of hiding them.
• Session 3 — Check the output against the criteria below. Ask a teacher, mentor or willing adult collaborator for focused feedback where appropriate.
• Session 4 — Revise one important weakness. Write a short handover explaining the result, its limits and what you would try with more time.

What good evidence looks like

Each risk has an asset, a plausible failure and a proportionate control; no real credentials or unauthorised tests are used.

A useful review asks whether the result meets the original brief and whether someone else can understand how it was produced. Keep the first draft as well as the final version. The change between them often reveals more about learning than a polished output alone. Explain one decision you changed and the observation that caused you to change it.

Notice the work you enjoy and the work you avoid

This career uses systematic investigation, networking fundamentals, ethical judgment, concise incident writing. For each skill, note one moment in the project when you used it and one moment when support would have helped. Difficulty on a first attempt is information about preparation, not proof that you cannot pursue the field.

Watching hacking demonstrations is different from authorised, documented defensive work.

• Some roles include on-call work
• Threats and tools change frequently
• Security work must stay within explicit authorization

Turn the experiment into a decision

Write three short notes: the task you would willingly repeat, the task you would rather avoid and the next question you need answered. Compare these with an adjacent career before choosing a course. You may prefer a neighbouring role that shares the interesting work but has different responsibilities. The linked career profiles below are starting points for that comparison, not automatic recommendations.

Next actions

1. Complete a rough version before paying for advanced tools.
2. Record one failure and how you investigated it.
3. Discuss the result with a teacher or practitioner without asking them to predict your future.

Continue this career investigation

Compare adjacent careers

• Software developer
• Data analyst
• Privacy specialist