So you want to break in.
A practical guide to careers in cybersecurity in India — the actual paths that exist, the skills that get you interviews, and the portfolio pieces that get you offers. No "become a hacker in 30 days" fluff.
Six real career tracks.
Security isn't one job — it's a family of them. These are the ones with actual demand in the Indian market as of 2026. Salary ranges are Bangalore/Gurugram indicative; adjust for your city.
Bug Bounty Hunter
Independent work on platforms like HackerOne and Bugcrowd. Great for building portfolio and side income. Flexible, remote, no formal degree required. Pays per finding — highly variable.
Application Security Engineer
Full-time role at product companies. Review code for vulnerabilities, run pentests, build security guardrails. In-house version of what a pentester does externally.
Penetration Tester / VAPT
Consulting work — you're hired to break into a client's systems on a schedule. Good breadth of exposure, lots of variety, some travel. Often the entry-level path.
Red Team Operator
Advanced offensive work — long-form engagements simulating real threat actors. Windows AD, evasion, persistence. Requires strong foundation in a specialty.
Cloud Security Engineer
AWS/GCP/Azure security. Misconfigurations, IAM, container security, cloud-native attacks. Fastest-growing specialty right now given cloud adoption.
DevSecOps Engineer
Security embedded in the CI/CD pipeline. SAST/DAST tooling, container scanning, IaC security. Half security, half infrastructure engineer.
Skills you need day one.
These are the baseline. If you're missing any, that's a gap to fill first — before enrolling in any cohort. Free resources exist for all of them.
Your portfolio matters more than your degree.
Security hiring is unusual. Most managers care less about your CS degree and more about what you can show. Here's what the strongest entry-level candidates walk in with:
3-5 valid bug bounty submissions
Real reports on real programs. Doesn't have to be critical severity — even accepted low-hanging fruit shows you can operate within scope, follow disclosure timelines, and write triage-quality reports.
Public writeups on your findings
Blog on Medium, Substack, or GitHub Pages. One post per finding. Employers Google you before interviews — writeups are how you show up.
A GitHub with real security work
Custom scripts, CTF writeups, tool contributions. Doesn't need to be popular — needs to show you write code for security use cases, not just consume it.
One completed certification
CEH for résumé-friendly signaling. PWPA, OSCP+, or CRTP for actual technical depth. Employers weigh certifications less than portfolio, but they're a checkbox filter for HR.
We help you build the portfolio.
We can't hand you a job. What we can do: give you real work to point at. Every cohort produces valid bug bounty submissions, a VDR-quality writeup portfolio, and a verifiable certificate. That's what recruiters open their inbox for.
Real submissions
Every cohort student ships at least one submission during the program.
Public writeups
Writeup reviews are built into cohort feedback. Publish as you go.
Verified certificate
Public QR-verify page for every graduate. Recruiter-friendly.
The hardest one.
Aim smaller than you think
Your first role probably won't be at a FAANG. It'll be at a mid-size product company, an Indian services firm, or a specialist boutique. That's fine. The first job's job is to get you into the industry so the second job can be better.
Being a developer first is an advantage
If you can code, you can read the code you're auditing. That's uncommon among security engineers and highly valuable to employers building product-integrated security.
Interview yourself into a job
Most security interviews test whether you can talk about vulnerabilities you've actually found — not whether you memorized OWASP. Come with 2-3 findings you can walk through in detail. That alone beats 90% of candidates.