Cyber Security Career Roadmap Haryana 2026: From Zero to Hired in 12 Months
If you are sitting in Hisar, Rohtak, Karnal, Panipat, or any Haryana city in 2026 with zero cyber security background and a goal of being employed in the field within 12 months, this guide is your month-by-month plan. Tested with actual graduates from Cyber Defence and the broader Haryana ecosystem.
The Honest Premise
Becoming a junior security analyst or pentester in 12 months from zero is realistic for a motivated full-time learner with the right structure. It is not realistic if:
- You can only spend 2-3 hours per week
- You expect a Rs 15 LPA job at month 12 (Rs 4-6 LPA is realistic for a fresh CEH-certified candidate)
- You are unwilling to do any networking outreach yourself
- You expect the institute to do all the work for you
Assuming you accept those caveats, here is the month-by-month roadmap.
Month 1: Foundations Boot
Goals:
- Get comfortable with Linux command line (Kali / Parrot)
- Understand basic networking — TCP/IP, OSI, IP addressing, subnetting
- Touch Python at hello-world level
- Set up a learning environment
Daily commitment: 3-4 hours
Specific actions:
- Enroll in a Haryana institute (Cyber Defence in Hisar, or equivalent in your city)
- Install Kali Linux as a VM on your laptop (VirtualBox is free)
- Complete TryHackMe's "Pre Security" learning path
- Read "Networking All-in-One For Dummies" or equivalent foundation book
- Set up a free LinkedIn profile labeled "Aspiring Cyber Security Professional, Haryana"
End of month 1 outcome: you can navigate Linux without panic and explain what an IP address is to a friend.
Month 2: Networking Depth
Goals:
- Master subnetting — should be reflex, not effort
- Understand routing, switching, VLANs
- Be able to read Wireshark packet captures
- Begin Bash scripting
Daily commitment: 3-4 hours
Specific actions:
- Continue your institute course (you will be in networking module by now if at Cyber Defence)
- Complete TryHackMe "Network Fundamentals" room
- Subnetting practice on subnettingpractice.com — until you can do /24 to /29 in your head
- Capture and analyze your own home network traffic in Wireshark
- Write 5-10 Bash scripts (file ops, simple loops)
End of month 2: you understand how packets move and how networks are segmented.
Month 3: Reconnaissance and Scanning
Goals:
- Comfortable with Nmap — all common flags, scripting engine basics
- OSINT — Google dorking, Maltego intro, Shodan
- Vulnerability scanning — Nessus or OpenVAS basics
- First HackTheBox account, complete 3-5 starting machines
Daily commitment: 4-5 hours
Specific actions:
- Continue institute coursework
- Nmap practice: scan every machine on your home network, document services
- TryHackMe "Recon" and "Nmap" rooms
- Sign up at HackTheBox, complete the introductory machines
- Start a public blog (Hashnode, Dev.to, your own Next.js site) — write up what you learned
End of month 3: you can do a basic external reconnaissance of any internet-facing target.
Month 4: Web Application Hacking
Goals:
- OWASP Top 10 fluency
- Burp Suite (free edition first, Pro if course provides)
- SQL injection — manual and automated
- XSS, CSRF, broken auth — practical exploitation
Daily commitment: 4-5 hours
Specific actions:
- Institute web hacking module (heaviest content)
- PortSwigger Web Security Academy — complete all "Apprentice" labs (free)
- TryHackMe "OWASP Top 10" room
- Practice on DVWA, bWAPP, OWASP Juice Shop
- Read "Web Application Hacker's Handbook" (older but still gold)
End of month 4: you can find and exploit common web vulnerabilities in a controlled lab.
Month 5: System Hacking and Privilege Escalation
Goals:
- Metasploit framework comfortable usage
- Windows and Linux privilege escalation
- Active Directory attacks basics
- Beginner CTF participation
Daily commitment: 4-5 hours
Specific actions:
- Institute system hacking and post-exploitation modules
- HackTheBox: complete 8-10 retired easy machines, write up each
- Try one or two TryHackMe "Junior Penetration Tester" path rooms
- Participate in one CTF (CTFtime.org lists upcoming) — even if you finish last, participate
- Write up your CTF experience on your blog
End of month 5: you can take a foothold and escalate to root/SYSTEM on common machines.
Month 6: Wireless, Mobile, and Specialization Decision
Goals:
- WiFi pentesting basics — WPA2 cracking
- Mobile hacking introduction — APK analysis, basic Frida
- Pick your specialization for months 7-12
Daily commitment: 4-5 hours
Specific actions:
- Institute wireless and mobile modules
- Set up a separate test WiFi network and crack your own WPA2
- Decompile 2-3 random Android APKs with jadx
- Decide your specialization: web pentest, network pentest, mobile pentest, cloud security, malware analysis, blue team / SOC
- Update your LinkedIn with the specialization direction
End of month 6: institute course complete. You have intermediate skills across the board and a chosen specialization.
Month 7: CEH Exam Preparation
Goals:
- Pass CEH written exam
- Have a working portfolio of 8-12 HackTheBox writeups
Daily commitment: 5-6 hours
Specific actions:
- Practice CEH-aligned mock exams provided by your institute
- Book the actual CEH exam voucher (Rs 50K-65K from EC-Council)
- Two weeks of intensive flashcard / quiz review
- Schedule and give the exam in this month
- Continue HackTheBox and bug bounty practice in parallel
End of month 7: CEH certification in hand. This is a real credibility unlock.
Month 8: Building Public Proof
Goals:
- Strong LinkedIn presence
- 10+ blog posts (technical writeups, opinions)
- Active GitHub with 3-5 security projects
- First bug bounty profile activation
Daily commitment: 4-5 hours
Specific actions:
- Optimize LinkedIn: CEH badge, headline says "Junior Penetration Tester | CEH | Haryana"
- Write 4 long blog posts this month on topics you know well
- Push 3 small security tools or scripts to GitHub (e.g., a custom subdomain enumerator, a wordlist generator, a CTF helper)
- Sign up at HackerOne and Bugcrowd, read 10 disclosed reports
- Submit your first bug bounty report (even if "informational" / no payout) — the act of submitting is the milestone
End of month 8: you are publicly visible as a security practitioner, not just a student.
Month 9: Specialization Deep Dive
Goals:
- Become genuinely good at your chosen specialization
- One concrete project in that specialization
Daily commitment: 4-5 hours
Specific actions (web specialization example):
- Complete all PortSwigger Practitioner labs
- Read the OWASP ASVS spec end to end
- Build a custom security tool for web testing (e.g., a Burp extension)
- Submit 3-5 more bug bounty reports
(Mobile specialization example): Complete MobSF deep dive, Frida advanced course, 2-3 retired Android CTF challenges.
(SOC specialization example): TryHackMe SOC Level 1 path, Splunk fundamentals, log analysis exercises.
End of month 9: you have a depth that goes beyond CEH baseline.
Month 10: Networking and Applying
Goals:
- Build local cyber security network in Haryana / Delhi
- Begin active job applications
Daily commitment: 4-5 hours
Specific actions:
- Join Haryana / Delhi cyber security Telegram and WhatsApp groups
- Attend any BSides Delhi or null Delhi chapter meeting
- Apply to 25-30 jobs this month (mix of Naukri, LinkedIn, direct emails to hiring managers)
- Reach out to 5-10 alumni of your institute on LinkedIn — ask for advice, not jobs
- Update resume to include CEH, GitHub, blog, bug bounty profile
End of month 10: at least 2-5 first-round interview calls.
Month 11: Interview Rounds
Goals:
- Pass technical interviews
- Negotiate first offer
Daily commitment: 4-5 hours
Specific actions:
- Practice common security interview questions (Cyber Defence and other institutes provide mock interviews)
- Brush up on networking fundamentals — almost every interview asks this
- Be honest about your bug bounty submissions even if none paid out
- Apply to 25-30 more jobs in parallel — interviews are slow, parallelize
End of month 11: at least one offer letter.
Month 12: Choose, Negotiate, Start
Goals:
- Pick the right first job (not necessarily highest pay)
- Negotiate a fair package
- Plan continuous learning post-employment
Decision framework for first job:
- Pick the role that gives you the most varied learning, not the highest title
- Hiring manager quality matters more than company prestige at year 1
- Travel and commute matter — a Rs 5 LPA Hisar/remote role beats a Rs 6 LPA daily-Gurugram commute role
End of month 12: you are employed in a cyber security role. Congratulations.
Post-Month-12: The Compounding Decade
What separates junior pentesters who become senior pentesters in 5 years from those who stagnate at junior level:
- Continuous certification: OSCP at year 2, CRTE / OSWE at year 3-4
- Public output: keep writing, keep open-sourcing
- Mentor others: teach what you know in informal sessions
- Stack a specialization: cloud security, AI security, mobile pentesting — pick one and go deep
- Build a side project / consultancy / niche tool — it doesn't matter what, just keep building
The first 12 months get you employed. The next 12 years compound that employment into a career.
How Cyber Defence Hisar Supports This Roadmap
We are not just a course provider; we structure our 6-month Ethical Hacking program to match months 1-6 of this roadmap. Post-course, we offer:
- Free monthly alumni check-ins for 12 months
- Mock interview booking (Rs 0 for current students)
- Hiring partner referrals for genuine candidates
- Continued learning resources
Visit cyberdefence.org.in/ethical-hacking-course-in/hisar or call +91-75175-72000 to discuss your specific timeline.
12 months from zero to hired is real. We have seen it happen. Show up, do the work, get the job.