Start by building IT fundamentals — networking basics, Linux, and how the web works — then learn core security concepts through a beginner-friendly certification such as ISC2 CC or CompTIA Security+. Next, pick a direction (SOC analyst, penetration testing, GRC, or cloud security) and practise hands-on on free platforms like TryHackMe and HackTheBox. In India, most freshers enter through SOC analyst or VAPT roles and then specialise after 1–2 years. Consistent hands-on practice for 6–12 months is usually what makes you interview-ready, not just collecting certificates.

Target fresher-friendly roles such as SOC analyst (Tier 1), VAPT trainee, or IT support roles with a security tilt. Build proof of skill: complete free labs, do beginner CTFs, contribute to responsible disclosure programmes, and earn one entry-level certification like ISC2 CC. Hiring managers in India weight demonstrable hands-on skills over degrees, so a portfolio of lab write-ups and a well-maintained LinkedIn profile go a long way.

For most people, yes — India has a well-documented shortage of skilled security professionals while attacks on Indian companies keep rising, so demand has stayed strong even during IT hiring slowdowns. Salaries grow faster than general IT once you have 3–5 years of specialisation, and remote roles with global companies are common. The honest caveat: it demands continuous learning, and the first job takes effort — after that, a cyber security career in India offers strong long-term growth and job security.

Fresher cyber security roles like SOC analyst or VAPT trainee typically pay around ₹4–6 LPA in India. With 3–5 years of experience and specialisation (penetration testing, cloud security, GRC), ₹12–25 LPA is common, and senior roles such as security architect or security lead can cross ₹30–40 LPA. Your cyber security career salary depends more on hands-on skill depth and relevant certifications than on years of experience alone.

A practical cyber security career roadmap looks like this: (1) learn networking, Linux, and basic scripting; (2) cover security fundamentals with a certification like CompTIA Security+ or ISC2 CC; (3) choose a track — defensive (SOC), offensive (penetration testing), or compliance (GRC); (4) practise on labs and earn a track-specific certification, such as eJPT or CEH for offensive roles and OSCP later; (5) build a small portfolio and apply for entry-level roles. Give each stage one to three months and review your progress regularly.

The OSCP certification full form is Offensive Security Certified Professional, offered by OffSec. It is one of the most respected hands-on penetration testing certifications in the industry — instead of multiple-choice questions, you must compromise real machines in a 24-hour practical exam and submit a professional report. Because of this, employers treat OSCP as proof that you can actually perform penetration testing, not just understand the theory.

Enrol in OffSec's PEN-200 (Penetration Testing with Kali Linux) course — available as a standalone purchase or through the Learn One subscription — complete the course labs, then pass the 24-hour hands-on exam and submit your report within the given time. There are no formal prerequisites, but you should be comfortable with networking, Linux, and basic scripting before starting. Most candidates need 3–6 months of serious lab practice alongside the course.

OSCP is not sold as an exam-only option — the exam comes bundled with the PEN-200 course, so there is no separate "cost without training." As a rough guide, the standard course-and-exam bundle costs around USD 1,700 (approximately ₹1.5 lakh for Indian buyers, varying with exchange rate and taxes), while the Learn One subscription is priced higher but includes extended lab access. Check OffSec's official website for current pricing and any running discounts.

You cannot get OSCP certification completely free — the exam only comes with the paid PEN-200 course. What you can do is make the preparation nearly free: use free TryHackMe rooms, the HackTheBox free tier, YouTube OSCP preparation series, and OffSec's free learning content to build most of the required skills, then pay only when you are genuinely exam-ready. OffSec also occasionally runs discounts and scholarship programmes that reduce the cost significantly.

Begin OSCP certification preparation by strengthening prerequisites — TCP/IP, the Linux command line, basic Bash/Python, and web application basics. Then follow a sequence: solve easy-to-moderate machines on HackTheBox or TryHackMe for 2–3 months, work through a structured course such as PEN-200 (or a stepping-stone like eJPT), and practise daily note-taking and report writing, since documentation is half the exam. Aim to comfortably solve a good number of lab machines before booking your exam date.

OSCP certification is valid for three years from the date it is issued. After it expires, you can renew it by passing a higher-level OffSec certification (such as OSEP) or by retaking the OSCP exam. Certificates issued before OffSec introduced this expiry policy do not expire, which is why some long-time professionals still list older OSCP credentials as lifetime.

There is no fixed OSCP certification salary, but in India the certificate typically moves you into penetration testing roles, where VAPT analysts with OSCP and 1–2 years of experience often earn around ₹6–12 LPA, and experienced security consultants with OSCP commonly cross ₹15–25 LPA. The certificate mainly boosts shortlisting and interview calls — your final offer still depends on practical interview performance and demonstrated skills.

Penetration testing in cyber security is an authorised, simulated attack on a system, network, or web application performed to find exploitable vulnerabilities before real attackers do. For example, a penetration tester may use Burp Suite to test a login page, discover an SQL injection flaw, and report it to the company with a fix recommendation. The key word is "authorised" — it is always done with written permission, which is what separates it from illegal hacking.

Start with a small core toolkit rather than everything at once: Nmap for network scanning and reconnaissance, Burp Suite for web application testing, Wireshark for packet analysis, Metasploit for understanding exploitation, and ffuf or Gobuster for directory discovery. Practise with these penetration testing tools only on legal lab environments such as HackTheBox, TryHackMe, DVWA, or OWASP Juice Shop — never on systems you do not have written permission to test.

To do security testing in web applications, follow a structured process: understand the application's functionality, map all endpoints and parameters, then test for the OWASP Top 10 issues — broken access control, injection flaws, XSS, authentication weaknesses, and security misconfiguration — mainly using Burp Suite. Document every finding with steps to reproduce, impact, and remediation advice, and always test with written authorisation. Practising on deliberately vulnerable applications like OWASP Juice Shop or DVWA is the safest way to build these skills.