Home/Learn/Security Engineer/30-day plan
30-day lab plan · 🛡️ Security Engineer (SOC / Infra Security)

Become job-ready as asecurity engineer in 30 days.

One focused task a day, four weeks, ending with a portfolio and a mock interview. Built for students and engineers in India who learn by doing — about 2 hours a day on weekdays, a little more on weekends.

What you needInterview questions →Role path →
Your kit

Set up before day 1

A Kali VM, a vulnerable target (DVWA/Metasploitable), Wazuh or Security Onion, and our DNS/email security tool. Everything here is free or has a free tier; a laptop with 16 GB RAM is enough for most labs (32 GB for nested clusters).

  • Daily ruleFinish the task, write 5 lines of notes, commit to Git. Notes become your interview stories.
  • Weekend ruleDay 7 of each week is a review: redo the hardest task from memory.
  • Stuck rule30 minutes max, then ask in a community or our engineer network.
Week 1

Fundamentals

  1. Day 1Set up Kali + DVWA in isolated VMs; snapshot them
  2. Day 2OWASP Top 10: exploit SQLi and XSS on DVWA; then fix the code
  3. Day 3Nmap scan types; interpret results on Metasploitable
  4. Day 4Password hashing lab: hashcat on sample hashes; discuss policy
  5. Day 5TLS: inspect a handshake in Wireshark; test a site with our SSL tool
  6. Day 6Email security: run our SPF/DKIM/DMARC check on 5 domains; explain results
  7. Day 7Review: write a one-page threat model for a small e-commerce site
Week 2

Blue team

  1. Day 8Install Wazuh; onboard two agents (Linux + Windows)
  2. Day 9Generate events (failed logins, sudo); build a detection rule
  3. Day 10Sysmon on Windows; map 3 events to ATT&CK techniques
  4. Day 11Linux hardening with a CIS script; re-scan with Lynis
  5. Day 12Set up a honeypot (Cowrie); review attacker commands
  6. Day 13Vulnerability scan with OpenVAS; prioritise with CVSS + KEV
  7. Day 14Review: write an incident report for one Wazuh alert
Week 3

Cloud & identity

  1. Day 15Create a free AWS/Azure account; enable logging; misconfigure then fix an S3 bucket
  2. Day 16IAM least privilege: write a policy for a read-only auditor
  3. Day 17MFA/conditional access lab in Entra ID free tier
  4. Day 18Container security: scan an image with Trivy; fix the Dockerfile
  5. Day 19Secrets scanning with gitleaks on a sample repo
  6. Day 20WAF basics with Cloudflare free/ModSecurity; block a test attack
  7. Day 21Review: draft a cloud security baseline checklist
Week 4

Response & portfolio

  1. Day 22Tabletop: ransomware on a file server — write the 60-minute playbook
  2. Day 23DPDP Act summary: 10 technical controls your company needs
  3. Day 24Phishing simulation design (GoPhish) and awareness plan
  4. Day 25Purple-team mini exercise: 3 ATT&CK techniques detected or not
  5. Day 26Write a vulnerability-management SOP with SLAs
  6. Day 27Mock interview with 20 questions from our bank
  7. Day 28Publish write-ups (sanitised) on GitHub/LinkedIn; update resume
After day 30

What you will have

  • A portfolio repoDiagrams, configs, scripts and runbooks a hiring manager can read in five minutes.
  • Interview storiesReal faults you fixed — the answers to “tell me about a time…”.
  • A certification targetSee the role path for which exam to book next.
  • A place in our networkFinish the plan, share the repo, and apply — we mentor and place engineers who complete it.

Finished the plan? Show us.

Share your repo and notes; completed plans get a technical conversation with our architects and first paid tasks through the engineer network.

Apply to the networkPractice interview questions