pov: you built 7 projects that landed your first cybersecurity role

so last month someone in my community landed their first cyber security job without having any previous professional experience they didn't have a CS or cyber security degree in fact they weren't even from an IT background right and this is actually way more common than you think i want you guys to kind of drop this limiting belief that you can't do this because you don't have a certain certification or because you don't have two years of experience because I see people break into the industry without having these things all the time without having these things so let's make that mindset change first before we move on okay i wanna run through the interview they had with the hiring manager right so what happened is they got thrown scenario after scenario at them and these are different situations they'd face on the job and this person had a project to talk about for every single one of those scenarios and that's the kind of person that gets hired these days not the one with the most certifications but the one who can kind of point to something they've built for every one of these questions so what I'll be doing in this video is showing you the exact 7 projects they built and these are all free and beginner friendly by the way and I want you guys to make sure you stay stick around for the last one because it's an AI related project and it's important for the current market before I get into the projects i need to kind of explain something that took me a while to understand so let me zoom in right here so when a hiring manager has 200 CVs in front of them that have applied for a certain role every single one of those people has a security plus certification or some sort of basic beginner certification and every single one has oh i'm in proficient one of these different cyber security fundamental concepts and that's why you're gonna struggle to stand out because it's not a differentiator anymore right and what you need instead is a CV that links to a GitHub with a documented projects with a documented projects that's the person who does the work instead of just studying for it so what I wanna go over is um three things that make a project genuinely employer ready so the first one is it needs to solve a problem that the company has so a day to day problem security issues that they might face the second one is it needs to be documented so you can walk someone through the steps out loud and the third one is it shows you understand the why not just the how and every project I'm gonna show you is gonna hit all three and these are all gonna be free to build so don't worry about that and quick note before you start a few of these build on the same environment so you're not just gonna be setting up seven separate environments from scratch right so yeah you'll know what I mean when we get onto it okay so let's get onto Project 1 right here let me zoom in so this is the detection lab and this is your centerpiece right if you only build one thing from this video build this and essentially what this is is you're gonna stand up Active Directory on a Windows Server virtual machine and that's the identity system that basically every company on earth runs it controls who can access what across the whole organization and then what you're gonna do is ship the logs from that environment into a SIM which is the tool a sock analyst kind of stares at all day and Splunk is a free version of this right there's also Microsoft Sentinel which has a free trial you can use either and what you're next gonna do is attack your own domain something simple like a um password spray for example and then this is the important part you're gonna go into the SIM and catch yourself doing the exact attack that's the essential story right I ran the attack I detected it and you're basically doing red team and blue team in one project okay so let's go over why this is a centerpiece it's actually three skills stacked into one environment so you now know Active Directory you know a SIM you know what an attack looks like from both sides so most entry level candidates have probably only touched one of these and you've done all 3 in 1 project and you can tell the full story this is the project that kind of lands you those sock and blue team interviews right when they ask have you used a SIM you answer yes with the evidence from this project and then when they ask you know understand how Active Directory works and you can talk about this project again so super useful project and on your CV you'd write something like I built a detection lab in Active Directory forwarded security logs to a SIM simulated a password spray attack and wrote the detection logic to catch that that's one line that essentially covers the whole project and the tools you're gonna be using are Virtual Box Windows Server evaluation license which you need and then Splunk free or you can use the Sentinel trial and yeah these would all be free to use and I would say roughly it would take about a weekend to set up um probably a bit more to attack and detect properly um but yeah super useful and gonna be worth it in the end moving on to Project 2 this is where you kind of stand out right because this is the one that has you writing a bit of code and that instantly puts you in front of most of the entry level candidates and don't get intimidated if you haven't coded before because it's pretty straightforward to pick up so what you'll do is take real fishing samples so these are public datasets that you can pull and you'll investigate them properly the way an analyst would right you'll pull the email headers trace the sender sorry and then extract the indicators of compromise the dodgy domains the URLs the attachment hashes and once you've done that you'll automate the boring part with a small python script that does the enrichment for you so these will check those indicators and kind of spit out a risk score and once you've got all this you can write the report I know some of you probably thinking I don't know Python and that's fine you don't need to be a developer right you need to understand what the script does and why and that's pretty much it chat GPT can use you can use that to kind of write the code but just make sure you understand every line before it goes on your CV and what this is gonna help you land is sock and threat analysis interviews and the thing is phishing is the No. 1 way companies get breached so proving you can investigate and report on this is the kind of skill that companies are looking for and in an interview you could say something like I built a Python script that passes email headers extracts indicators of compromise and scores them against known phishing patterns then I wrote the analyst report off the back of that and that alone gets you taken way more seriously because it's the actual job that you're gonna be doing quick thing before we move on to Project 3 if you need help building these projects I teach them live on group calls every single week we build the projects out together and I kind of help you document it on GitHub and then we get your full portfolio set up so it's ready to put in front of employers because I know a lot of people watching this you don't know how to start or you kind of get stuck on a certain step or you don't know how to showcase it right and that's essentially what we fix together on those calls so if that's something you want help with check out the first link in the description to join the community okay let's keep going Project 3 is kind of an underrated project right let me zoom in on that right here and it's actually a really easy one to build so you don't need code or you don't need no labs what you're gonna write is a professional document and then you're gonna be testing it so pick one attack scenario so this could be a ransomware or a account compromise and what you'll do is write the step by step response plan so let me give you the questions for example how you're gonna detect it how you contain it how you get rid of it and how you recover it and then you would also go over how you'd report this whole scenario and that's the nest incident response structure that you're going through right now and once you've done this a lot of people skip this step right you're gonna run a tabletop exercise against it you'll walk through a pretend incident using your own playbook and see where it kind of falls apart and then you'll fix the whole step by step process and that last step is what makes this real right anyone can copy a template but running a tabletop actually shows you you've thought about how a team responds under pressure and this project will help you land instant response uh roles as well as sock interviews and it reads really well for GRC as well so if you're interested in that but when you hand someone a playbook you wrote and tested yourself it tells them you understand how a security team actually operates not just how attacks work in theory and and the the tools for this are pretty simple right you just need a word or Google Doc and then 3 to 4 hours for writing the playbook and then probably another hour to run the tabletop exercise okay moving on to Project 4 and this is one a lot of beginners skip because it looks quite technical and it's why it's on the list because this is a 2026 project right it's very useful for the current market and you kind of need to know this cause the reality is almost every company is now cloud first they're using AWS Azure whatever cloud provider and most entry level security work touches the cloud within kind of the first week but almost nobody at entry level has a cloud project on their CV so this is really gonna help you stand out what you build is a deliberately misconfigured cloud setup so there are free intentionally vulnerable environments that you can spin up right there's things like a cloud sandbox on the free tier or a open source vulnerable cloud labs what you'll do is go through it and find the problems the for example the over permissioned roles the user that can do way more than they should um the storage bucket that's public on the internet and what you can do once you found those is write the remediation so what's wrong why it's dangerous and exactly how you'd fix it and that combination identity and access on one side and then the cloud misconfiguration on the other is the exact thing that cloud security teams deal with every single day and yeah this project is gonna help you land those cloud security and IAM interviews and these roles are growing faster than almost anything on the field right now so if any if there's a role that you want to kind of focus on definitely look into this but yeah putting cloud security assessment or IAM on a beginner's CV in 2026 is gonna help you stand out so much cause everyone is probably focusing on stock related things right so yeah super useful and the tools you'll need is yeah as I said a free cloud a free tier cloud account or a uh free vulnerable cloud lab and the cost is basically zero if you stay inside the free tier so make sure you kind of watch your usage and it should roughly take you a weekend to kind of build this okay let's move on to project No. 5 Okay let's move on to project No. 6 for anyone eyeing up GRC compliance and risk roles take a note of this one so what you'll do is take a fictional company so say a small e commerce business for example you assess the security risk it faces you rate each one by likelihood impact and recommend controls built on NIST CSF risk rating - controls - NIST CSF GRC / Compliance / Risk Analyst free NIST Cybersecurity Framework Okay moving on to project No. 7 this is the one I told you guys to stick around for and it's the one that's gonna help you stick out stand out in 2026 and I'll explain the backstory around this right so every company on earth I'm sure you know is racing to put AI into their products right now and almost none of them have figured out how to secure it which means there's a whole category of security roles opening up such as AI security AI governance and these barely existed a couple of years ago and there's not really anyone in entry level that can actually fill these roles up so if you have one project that you wanna complete and help you stand out in this current market so you're not competing with the crowd make sure you build this project and this is actually one of my expertises at the moment right I lead AI governance work in my day to day job so trust me when I say this hiring managers need more people with this skill set as soon as possible so let's go over what you build what you're gonna get is a large language model running on your machine and there are free open ones you can download as well and what you'll do is attack it so the main one is prompt injection so this is where you craft input that makes the model ignore its instructions and do something it shouldn't um such as leak data bypasses guardrails follow your commands instead of the systems and what you'll do is document the attack exactly what you did and what it exposed and then you write the risk assessment and in your assessment you'll write what the risk is to the business what controls you'd put in place to stop that and that's it another kind of simple one and it's kind of GRC related as well but what you're doing is attacking documenting assessing and mitigating same shape as the other projects right on this list but just pointed at AI which is what everyone's panicking about at the moment but yeah this is gonna help you land roles that didn't exist in 2021 and that companies are kind of desperate to have people with this kind of skill set so AI security AI governance and it makes your CV the one that gets remembered because you're gonna be the only one that brought it and yeah the tools you'll use again is a free local LLM should cost nothing to run and should take roughly around a weekend to complete this project should be a good one so yeah those are your seven projects right there and here's the part that actually turns them into interviews right because building the project is only half of it but there are three other things you need to do after you build a project the first thing is Github README so every project needs a clean repo with a readme that says what it is why you built it what tools you use and what you learned and you can write roughly around two paragraphs of that and a screenshot which should cover that whole project you don't wanna be writing lines and lines of reports the next thing is to use CV language so don't write built a home lab right designed and deployed a detection lab that simulates and identifies real world attacks same project but completely different impression and No. 3 is the interview answer so every project needs one sentence you can kind of say out loud without stumbling you can go into a bit more detail as well but a rough format would be I built X using Y and it taught me Z and it maps directly to what your team does when Z happens so I want you guys to practice that out loud a few times so you can kind of say it in a more natural way rather than rehearsed and if you do all three of these things for seven projects and you walk into the interview you're gonna smash it you're gonna be the most prepared person in the room every single time and I guarantee you on that so yeah I hope you guys found that useful and it kind of gave you an idea of what to be building to be able to land a job and if you need additional help building these documenting them properly and getting them on your CV and LinkedIn in front of real hiring managers and what we do have coming up as well is a internship opportunity so that you can get real verifiable experience on your CV as well so if that sounds like something you're interested in then just head over to the group in the link below and that's our private community that you can join um but yeah thank you guys for watching be sure to subscribe I'm gonna be uploading a lot more on this channel um a lot more useful tips on what you need to be learning what you need to be building and essentially help you land your first cybersecurity job without having any previous experience