student@hack3rs:~$ cat entry-level-network-security-roadmap-canada.md
Entry-Level Network Security Roadmap in Canada (0-12 Months)
A realistic 0-12 month roadmap for Canadian learners building toward entry-level network security, SOC, or blue-team-adjacent roles with a fundamentals-first, white-hat approach.
prerequisites
- $Beginner interest in network security or cybersecurity learning.
1. Months 0-3: Build Protocol and Logging Literacy
Focus on networking, protocols, and host logging. Learn TCP/IP, DNS, HTTP/TLS, routing basics, subnetting, NAT, and firewall policy logic. At the same time, learn where Linux and Windows logs live and how to read basic auth, service, and system events.
This stage is about learning what normal looks like. Most beginner mistakes happen because they treat every unfamiliar event as suspicious. Build confidence by repeatedly observing normal traffic and normal logs first.
By the end of this stage, you should be able to trace a normal web request, explain basic firewall decisions, and correlate at least one network event with host logs.
2. Months 4-8: Add Packet Analysis, Detection, and Validation Workflows
Add Wireshark/TShark, tcpdump, Nmap, Zeek, and Suricata to your study loop. Learn how each tool answers a different question: packet evidence, quick capture, exposure validation, protocol telemetry, and detection signals.
Practice safe lab workflows and write short analyst-style notes. For each exercise, document the question, command(s), output, interpretation, and what evidence would increase confidence. This is how you build interview-ready skill instead of a pile of copied commands.
Start reading threat pages and link them to tools. Example: phishing and credential theft -> auth logs + Sigma + Wazuh + packet validation.
3. Months 9-12: Build Portfolio, Role Focus, and Interview Readiness
Choose a role-leaning path: network operations/SOC, wireless, web app defense support, or AD/Windows defense. Follow one guided path in depth and complete repeatable labs that show you can collect and explain evidence.
Create a portfolio of white-hat learning notes: packet investigations, exposure validation writeups, triage worksheets, and post-incident improvement exercises. Keep it defensive and authorized. Do not publish offensive how-to content or scans of third-party systems.
Prepare for interviews by practicing explanations, not just commands. Employers remember candidates who can explain what a tool is for, how they validated output, and what they would do next in a real incident.
12-month-roadmap-checkpoints
- $Complete core fundamentals modules and logging basics.
- $Practice one packet analysis and one logging correlation exercise each week.
- $Build a small lab and document every experiment clearly.
- $Follow one guided tool path deeply rather than skimming many.
- $Create a defensive portfolio with evidence-focused writeups.