IBM Cybersecurity Analyst

Attackers end up on operating systems, so defenders must know them. You manage users, permissions, processes and services on Windows and Linux, read their logs, and harden them against common weaknesses.

• Users, groups and permissions
• Processes and services
• The Linux command line for administrators
• Windows administration essentials
• Logs and what they record
• Patching and configuration hardening

You build A hardening checklist applied to a Linux machine, with before-and-after evidence.

You cannot defend traffic you cannot read. You learn how networks and their protocols work, inspect packets, and use segmentation, firewalls and encrypted tunnels to limit what attackers can reach.

• TCP/IP layers and addressing
• DNS, DHCP and HTTP in practice
• Reading traffic with a packet analyzer
• Firewalls and network segmentation
• VPNs and encrypted channels
• Intrusion detection and prevention
• Common network attacks

You build A packet capture analyzed to identify normal traffic and one suspicious flow.

Databases hold what attackers want. You learn how relational databases work, write basic queries, see how injection and weak access control expose data, and apply protections.

• Relational databases and SQL basics
• How SQL injection works
• Access control and least privilege in databases
• Encryption of stored data
• Backup, recovery and auditing
• Hardening a database

You build A vulnerable query exploited in a lab and then fixed.

Controls work best when designed together. You apply defense in depth and zero-trust ideas, plan identity and access control, and lay out the safeguards for a system from the inside out.

• Defense in depth
• Zero trust principles
• Identity and access management
• Selecting and layering controls
• Security in cloud environments
• Documenting a security architecture

You build A layered security architecture for a small web application.

Security work is measured against rules. You read the main frameworks and laws, such as NIST, ISO 27001, PCI DSS, HIPAA and GDPR, understand what each requires, and see how audits test whether you comply.

• Why frameworks and standards exist
• NIST Cybersecurity Framework
• ISO 27001 and security management systems
• Industry rules: PCI DSS and HIPAA
• Privacy law and GDPR
• Audits, evidence and gap analysis

You build A gap analysis of a sample organization against one framework.

Finding weaknesses before attackers do is a discipline with rules. You follow the stages of a test, scan and assess vulnerabilities, use tools such as OWASP ZAP and Snyk, and report findings others can act on.

• Scope, authorization and rules of engagement
• Reconnaissance and scanning
• Scoring and prioritizing vulnerabilities
• Testing web applications with OWASP ZAP
• Finding vulnerable dependencies with Snyk
• Exploitation in a controlled lab
• Writing a penetration test report

You build A scoped test of a lab application ending in a prioritized findings report.

Some attackers evade alerts, and all data needs protecting in transit and at rest. You hunt for hidden activity with hypotheses and logs, and apply hashing, encryption, signatures and certificates correctly.

• Hypothesis-driven threat hunting
• Indicators of compromise and behavior
• Searching logs for hidden activity
• Symmetric and asymmetric encryption
• Hashing and digital signatures
• Certificates and public key infrastructure
• Common cryptography mistakes

You build A threat hunt from a hypothesis through log search, plus a signed and encrypted message.

When something goes wrong, order matters. You follow the incident response lifecycle, contain and recover, collect evidence so it holds up, and reconstruct what happened from disk, memory and logs.

• Preparing: playbooks, roles and tools
• Detection and analysis
• Containment, eradication and recovery
• Evidence handling and chain of custody
• Disk and memory forensics basics
• Building a timeline of an incident
• Post-incident review

You build An incident timeline and response report reconstructed from supplied evidence.

Study how an actual breach happened. You trace each stage of the attack, identify the vulnerabilities that allowed it, and recommend the controls that would have prevented or limited it.

• Reconstructing the attack chain
• Identifying the weaknesses exploited
• Mapping stages to attacker techniques
• Assessing what detection missed
• Recommending prevention and response changes

You build A breach analysis report with the attack timeline and prioritized recommendations.

Defenders and attackers both use generative AI. You apply it to triage alerts, explain code and draft reports, learn how it is also used against you, and keep sensitive data out of public tools.

• Using AI to summarize alerts and logs
• Explaining suspicious code with AI help
• Drafting reports and playbooks
• How attackers use generative AI
• Protecting sensitive data when using AI tools
• Verifying AI conclusions before acting

You build An alert-triage workflow that uses AI with each conclusion verified by hand.

Bring the whole course together against the domains that two widely used CompTIA certifications describe. You map your skills to them, find gaps, and fill those gaps with focused review.

• Mapping course topics to the Security+ domains
• Mapping course topics to the CySA+ domains
• Self-assessing knowledge by domain
• Closing gaps with targeted review
• Connecting concepts across domains

You build A skills map across both domains with a plan for the weakest areas.