Network Security Engineer — career path
StationX Intermediate
Networks first, then the security of them: Network+ and CCNA for the plumbing, Security+ for the controls, then firewalls, IDS, segmentation and packet analysis on real machines.
4 courses · 33 sections · 208 lectures · 70 labs · ≈ 77 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Networking foundation
Subnets, routing, switching — the fluency the job is built on. Pick Network+ or CCNA (Step 2): most learners need one of them, not both.
follows the whole CompTIA Network+ (N10-009) roadmap: 8 courses · 77 sections · 529 lectures · 56 labs · ≈ 45 h of hands-on labs
Learn
- PathFollow the CompTIA Network+ (N10-009) path — the networking certification adverts ask for first
8 courses · 77 sections · 529 lectures · 56 labs · ≈ 45 h of hands-on labs
4 steps — Networking is the foundation security is built on. The recommended step between A+ and Security+.
Step 2 — Enterprise networking
Configure real Cisco kit the way enterprises run it.
follows the whole Cisco CCNA (200-301) roadmap: 5 courses · 83 sections · 510 lectures · 25 labs · ≈ 20 h of hands-on labs
Learn
- PathFollow the Cisco CCNA (200-301) path — the hands-on networking certification
5 courses · 83 sections · 510 lectures · 25 labs · ≈ 20 h of hands-on labs
3 steps — The networking certification employers know by name. Deeper and more vendor-specific than Network+, and the standard credential for network roles.
Step 3 — Security foundation
The controls you will be putting on the network.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the security baseline for the role
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 4 — Firewalls, IDS and traffic analysis
Build and tune the controls, segment cloud and virtual networks, then read the traffic they see. Vendor firewall certification (PCNSE, Fortinet FCP) and CCNP Security come next on the job; they are not sold here.
3 courses · 28 sections · 184 lectures · 59 labs
Learn
- CoursepfSense Fundamentals - Secure Your Network With pfSense (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 60 lectures
- Section 1: Introduction 1
- Section 2: Firewalls Refresher 2
- Section 3: pfSense Installation 2
- Section 4: Creating A Virtual Lab 4
- Section 5: pfSense Initial Setup 8
- Section 6: pfSense Firewall 11
- Section 7: pfBlockerNG 3
- Section 8: Snort IDS/IPS 7
- Section 9: Suricata IDS/IPS 7
- Section 10: Configuring a DMZ 12
- Section 11: Maintenance 3
- CourseSnort Intrusion Detection, Rule Writing, and PCAP Analysis (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
3 sections · 16 lectures
- Training Overview 2
- Lectures 1
- Hands-on Labs 13
- CourseThe Complete Cyber Security Course! Volume 2: Network Security (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
14 sections · 108 lectures
- Training Overview 2
- Introduction 6
- Goals and Learning Objectives - Volume 2 1
- Routers - Port and Vulnerability scanning 5
- Firewalls 14
- Network Attacks, Architecture and Isolation 5
- Wireless and Wi-Fi Security 8
- Network Monitoring for Threats 7
- How We Are Tracked Online 11
- Search Engines and Privacy 7
- Browser Security and Tracking Prevention 18
- Passwords and Authentication Methods 17
- Wrap Up 6
- Audio Version of Training 1
Practise
- LabsNetwork Security — 12 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Assess A High-Risk SystemDuration: 1 h
- Auditing Service AccountsDuration: 1 h
- Block Incoming Traffic on Known PortDuration: 1 h also on Step 3 (Security+)
- Holistic Network Identification and ProtectionDuration: 2 h
- Implement Single System Changes in FirewallDuration: 1 h
- Network Topology GenerationDuration: 2 h also on Step 3 (Security+)
- Protect Against BeaconingDuration: 1 h
- Rogue Device Identification and BlockingDuration: 1 h
- Setting Up SYSLOG Forwarding From a Windows SystemDuration: 1 h
- Sinkholing C2 TrafficDuration: 1 h
- Threat DesignationDuration: 1 h
- Windows System Hardening with PowerShellDuration: 2 h
- LabsNetwork Intrusion Detection — 8 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Comprehensive Threat ResponseDuration: 2 h
- Conduct Supplemental MonitoringDuration: 1 h
- Create Custom Snort RulesDuration: 1 h
- MITRE - AttackDuration: 1 h also on Step 3 (Security+)
- Monitoring for False PositivesDuration: 1 h
- Monitoring Network TrafficDuration: 1 h
- Monitoring Network Traffic for Potential IOA/IOCDuration: 1 h
- SNORT Configuration and Operation LabDuration: 1 h
- LabsNetwork Forensics — 15 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Analyze Browser-based Heap Spray AttackDuration: 1 h
- Automated in-Depth Packet DecodingDuration: 2 h
- Clonezilla_NetworkDuration: 1 h
- Identifying Intrusion and Mitigating Attacks with RHEL ServerDuration: 1 h
- Identifying Malicious CallbacksDuration: 1 h
- Identifying Malicious Network ConnectionsDuration: 1 h
- Incident Detection and IdentificationDuration: 3 h
- Nexpose: Analysis & Reporting (Executive, High Risk and Recommendation Reporting)Duration: 1 h
- Parse Files Out of Network TrafficDuration: 1 h
- Searching for Indicators of CompromiseDuration: 1 h
- Setting up Filters and Queries in KibanaDuration: 1 h
- Use pfTop to Analyze Network TrafficDuration: 1 h
- Verify Attributes of Identified SilentBanker IntrusionDuration: 1 h
- Verify Attributes of Intrusion Through Additional AnalysisDuration: 1 h
- Windows Event Log Manipulation via Windows Event ViewerDuration: 1 h also on Step 3 (Security+)
- Infra LabsImplement and Harden an Azure Networking Solution — 14 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Implement a Virtual Network Gateway in AzureLevel: AdvancedDuration: 1 h
- Implement an Azure ExpressRoute CircuitLevel: AdvancedDuration: 45 min
- Implement Name Resolution in AzureLevel: AdvancedDuration: 1 h
- Implement an Azure Virtual WANLevel: AdvancedDuration: 1 h
- Implement a Service Endpoint in AzureLevel: AdvancedDuration: 3 h
- Implement a Private Endpoint in AzureLevel: AdvancedDuration: 1 h
- Can You Implement and Harden an Azure Networking Solution?Level: ExpertDuration: 1 h
- Implement Azure Load Balancer in AzureLevel: AdvancedDuration: 1 h
- Implement Azure Traffic ManagerLevel: AdvancedDuration: 1 h
- Implement Azure Application GatewayLevel: AdvancedDuration: 1 h
- Implement Azure Front DoorLevel: AdvancedDuration: 1 h
- Implement Azure FirewallLevel: AdvancedDuration: 1 h
- Monitor Azure Virtual NetworkLevel: AdvancedDuration: 1 h
- Can You Implement and Monitor an Azure Networking Solution?Level: ExpertDuration: 1 h
- Infra LabsNSXT.2: VMware NSX-T Manage and Secure Network Traffic — 10 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Configure VRF LiteLevel: GuidedDuration: 30 min
- Configure the NSX Distributed FirewallLevel: GuidedDuration: 30 min
- Configure the NSX Gateway FirewallLevel: GuidedDuration: 30 min
- Configure Distributed Intrusion DetectionLevel: GuidedDuration: 30 min
- Can You Configure VRF Lite, NSX Distributed Firewall, NSX Gateway Firewall, and Distributed Intrusion Detection?Level: AdvancedDuration: 45 min
- Analyze web traffic with URL AnalysisLevel: GuidedDuration: 30 min
- Configure Network Address TranslationLevel: GuidedDuration: 30 min
- Configure Load BalancingLevel: GuidedDuration: 30 min
- Can You Configure URL Analysis, Network Address Translation, Load Balancing, and VPNs?Level: AdvancedDuration: 45 min
- Can you manage and secure network traffic with NSX-TLevel: ExpertDuration: 1 h
Step 5 — Run the network
The operations skills that keep a secure network up: firewalls and syslog, routing and SSH, host discovery, Snort tuning and packet captures.
1 course · 5 sections · 24 lectures · 11 labs
Learn
- CourseLinux Network Administration (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
5 sections · 24 lectures
- Training Overview 2
- Introduction 2
- Lab Setup 4
- Linux Network Administration 15
- Audio Version of the Training 1
Practise
- LabsNetwork Operations Specialist Training Series — 11 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Analyze Malicious Network TrafficDuration: 2 h
- Denial of Service PCAP AnalysisDuration: 1 h
- Host Identification Scanning via WindowsDuration: 1 h
- Host Identification Scanning with LinuxDuration: 1 h
- Identify Access to a LINUX Firewall Through SYSLOG ServiceDuration: 1 h
- Intro to Linux - Routing and SSH TunnelsDuration: 2 h
- LNX101 - Setting Up a Firewall With UFW and FirewalldDuration: 1 h
- LNX101 - Telnet vs. SSHDuration: 1 h
- Scanning with NmapDuration: 1 h
- Securing Linux - FirewallsDuration: 1 h
- Snort Signatures, IDS Tuning, and BlockingDuration: 1 h
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Network Security Engineer
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.