DAIR Prepare, Part 4: Training

Before detecting anything, we need to know our job. How to find your way in a vast field, then where to train in Security Operations: learning platforms, certifications, conferences and bug bounty.

Posted Nov 10, 2026 Updated Nov 11, 2026

A laptop terminal: learn, certify, meet the community, repeat

By CyberHorizon

8 min read

DAIR Prepare, Part 4: Training

The first three parts of Prepare covered the analyst’s toolkit, logs and visibility and shared infrastructure. Before moving on to the Detect step, there’s one more prerequisite: knowing our job.

But cybersecurity is a vast field, made of many different jobs, and nobody masters all of them. Two resources help to find your way:

Paul Jerimy’s Security Certification Roadmap: nearly 500 certifications mapped by domain (network, identity, architecture, GRC, forensics, penetration testing…) and by level (last updated in 2024). It also gives a good overview of the jobs behind them.
SANS: courses by frameworks and directives: training mapped to skills frameworks, including the US NICE Framework and the European Cybersecurity Skills Framework (ECSF) from ENISA, which describes the main cybersecurity roles.

In this blog and this post, I’ll focus on my own area of expertise, often grouped under Security Operations, which covers both the defensive and the offensive side.

1. Train first: the learning platforms

Before talking about pieces of paper and certifications, there’s a simpler step: training. Learning platforms let you practise on realistic labs, at your own pace, without the pressure of having to pass an exam.

To get started: TryHackMe and Root-Me

TryHackMe is often the first step: guided paths, browser-based labs, and content that covers both the offensive and the defensive side. Recently, they’ve been investing heavily to regain ground on the other platforms. They now offer their own certifications along their paths: SEC0 and SEC1 for the foundations, SAL1 and SAL2 on the analyst side, PT1, WEB1 and PT2 on the penetration testing side. On the defensive side, their more advanced paths, Advanced Endpoint Investigations and Windows Incident Response & Forensics, go further into investigation and DFIR. I haven’t tested their more advanced content yet, so I can’t give an opinion on it, but for getting started it remains an easy entry point.

Root-Me is a free French platform, well known in the French-speaking community, with hundreds of challenges across web, network, forensics, cryptography and more.

Offensive side

Two platforms stand out to learn:

Hack The Box: the HTB Academy for structured modules, then the Labs and their machines (boxes) to put it into practice on realistic targets.
PortSwigger Web Security Academy: the reference for web application security, built by the makers of Burp Suite. Each topic (SQL injection, XSS, SSRF, access control…) comes with explanations and hands-on labs, and it’s entirely free.

Defensive side

For me, the best resources are:

LetsDefend: a SOC analyst environment, with alerts to triage in a simulated SIEM, investigations and training paths.
Blue Team Labs Online: investigation challenges from Security Blue Team, on real artefacts: logs, PCAPs, memory, disk images.
CyberDefenders: investigation labs on disk, memory, network and log artefacts, many of them free. The same team is behind the CCDL2 certification below.
Hack The Box Sherlocks: Hack The Box isn’t only offensive. Sherlocks are DFIR and SOC investigation scenarios built on realistic artefacts.

2. Certifications

From my point of view, when you start, you need knowledge on both the defensive and the offensive side. Whichever side you end up on, what you’ve learned from the opposite one will be an integral part of your work: a defender who understands how attackers operate investigates better, and an attacker who understands detection works more effectively.

The paths I’d suggest:

Track	Path
Pentesting	PJPT (TCM Security) → HTB CPTS → HTB CWEE
Red team	CRTP (Altered Security) → CRTO (Zero-Point Security) → CRTE (Altered Security) → CRTL (Red Team Ops II, Zero-Point Security)
Defensive	BTL1 (Security Blue Team) → HTB CDSA → eCTHP (INE Security) → CCDL2 (CyberDefenders, formerly CCD)
SIEM / tools	SC-200 (Microsoft: Defender, Sentinel, Entra ID) · Splunk Certified Cybersecurity Defense Analyst
Engineering	CCNA (Cisco) → Fortinet NSE 4 (FortiOS) → Fortinet NSE 5 to 7 in your domain (secure networking, SASE, cloud, security operations)

Certifications validate knowledge, they don’t replace experience: what you practise in labs and on real cases matters more than the number of badges.

With that solid foundation, you’ll have all the tools to start a good career.

When budget isn’t an issue, OffSec and SANS/GIAC provide high-quality courses and exams, but they’re quite expensive.

I strongly recommend SANS if you have access to a scholarship or if your employer can cover the costs: it will open a lot of doors. There’s also SANS.edu, the SANS Technology Institute, which awards degrees and certificates built on SANS courses, with GIAC certifications included, often at an advantageous price.

Learn to walk before you run. Cybersecurity is trendy, but a solid foundation in system and network administration is essential to progress. You can’t defend or attack a network, an Active Directory or a Linux server you don’t understand. If you don’t have that background, train extensively on the IT fundamentals first.

Over time, you’ll discover other certifications and other resources. That means you already have a foot in the field. This post is here to guide you and show you where to look: training is a big business, with a lot of players, and it’s easy to get lost.

3. Conferences

Platforms and certifications are done alone, in front of a screen. Conferences are where you meet the community: talks on the latest techniques and investigations, hands-on workshops, CTFs, and above all people. Many opportunities, jobs and collaborations start with a conversation in a hallway.

A selection, from close to home to the other side of the world:

Country	Conference	In short
Belgium	BruCON (Ghent)	The Belgian security conference: talks, workshops and trainings
France	InCyber Forum (Lille, formerly FIC)	One of the largest events in Europe, with a strong policy and industry side
France	leHACK (Paris)	A non-profit hacking conference: offensive security, hardware, OSINT
France	Botconf (a different city each year)	Botnets, malware and threat intelligence: very technical, run by practitioners
Luxembourg	Hack.lu	A long-running technical conference, organised by CIRCL, the team behind MISP
Monaco	Les Assises	A meeting place for security decision-makers and experts, mostly French-speaking
Poland	x33fcon (Gdynia)	Built around collaboration between red and blue teams: purple teaming
Europe	DFC Europe (formerly DFRWS EU, a different city each year)	Digital forensics research, hands-on workshops and a forensic challenge
United Arab Emirates	GISEC Global (Dubai)	The large regional event, with over 25,000 expected attendees
United States	Black Hat and DEF CON (Las Vegas)	The summer week in Las Vegas: research and briefings at Black Hat, the community and its villages at DEF CON
United States	RSAC Conference (San Francisco)	One of the largest industry conferences, very vendor and leadership oriented
Worldwide	FIRST Conference (a different city each year)	The annual gathering of incident response teams and CSIRTs from around the world

And the SANS Summits, held all over the world on specific topics (DFIR, threat hunting, CTI, cloud…). Many of them can also be followed online, often for free.

The BSides are community-run conferences, free or cheap, organised in many cities around the world. A good first conference, and often the easiest place to give your first talk.

Many conferences also host a CTF, and CTFtime lists the online ones all year round. Playing as a team builds the same reflexes as an incident: splitting the work, sharing findings, keeping notes.

Many conferences publish their talks online afterwards. Even when you can’t attend, the recordings are a free and up-to-date source of training.

4. Bug bounty

When you have enough experience and want to practise web security on real targets, bug bounty is an easy way in. Companies open part of their systems to researchers, with clear rules, and reward the vulnerabilities reported. A few platforms:

Intigriti: a Belgian platform, with many European programmes.
YesWeHack: a French platform, also strongly present in Europe.
HackerOne and Bugcrowd: the two large US platforms.

Check your legal situation first. Before taking part, make sure you understand the law and the rules of your country, as well as the scope and rules of each programme: testing outside the scope is not covered. In Belgium, for example, a legal framework has protected ethical hackers since February 2023, but only under strict conditions, including reporting to the Centre for Cybersecurity Belgium (CCB).

Whatever path you choose, training never stops: techniques, tools and attackers keep changing. Start with the fundamentals, practise without pressure, get certified when it makes sense, and go meet the community. And remember that every incident you work on is also a lesson.

Next: the last part of Prepare, playbooks and communication: turning all this preparation into procedures the team can follow under pressure, and the exercises that test them.

References

Need help with an incident? Through Cyber Horizon, I offer incident response for businesses in Belgium and beyond. Learn more about incident response or get in touch.

Incident Response, DAIR

This post is licensed under CC BY 4.0 by the author.