Tools & Resources · Free Download
Proof of Work: Small Security Wins That Compound
Proof of work here has nothing to do with blockchains. It means the literal thing: evidence that you have done the work. In cybersecurity careers that evidence has come to mean the intimidating mega-project: the polished home lab, the year-long portfolio piece you never quite start. This map argues the opposite. The strongest evidence of capability begins with something small enough to finish today: securing a relative's router, walking a local business through backups, 2FA and updates, triaging a phishing text for a friend, turning a dense GRC policy into a one-page guide. No budget, no permission needed, no waiting for perfect.
How the Map Works
The dashed arrows are the mechanism. Each small win feeds the next: the phishing text you triaged becomes a short write-up, the write-up becomes a five-minute lunch and learn, the talk becomes a conference slot. Keep making, explaining and helping in public, and the pieces compound into a body of work that hiring managers can actually see. Polishing skills in private yields nothing; shown work is what makes opportunities come to you.
The map grew out of a talk Shak gave at the FCA on proving capability through shown work, and out of the question that always follows it: volunteer work sounds great, but where do you actually find it? The answer is that security problems are everywhere once you start looking. The family router that has never seen an update, the shop with no backups, the group chat passing round a scam text. Shak's own version began on a train: a chance meeting with an old school mate turned into untangling fraudulent transactions on his Shopify store, a platform Shak had never touched and learnt as the problem demanded. Each of these might help exactly one person, and that is reason enough on its own. No act of help is too small to matter. The career unlock is what happens next: written down and shared, small acts of help compound into a body of work people can see.
The Four Clusters
- Dev & triage: read a build log, spot the SQL injection, lock down a router, call out the phishing text. Small technical wins you can document the same day.
- Pro bono & small business: set a family member up with a password manager, take a local shop through backups, 2FA and updates. Real users, real constraints, real proof.
- Writing & GRC: a "what broke and how I fixed it" post, a risk matrix, a one-page guide distilled from a policy nobody reads. Translation is a skill employers pay for.
- Speaking & events: a five-minute lunch and learn, a recorded walkthrough, a table conversation that becomes a talk. Every explanation compounds your reputation.
Who This Is For
- Career changers stuck waiting for their cybersecurity portfolio to feel "ready"
- Students and early-career analysts competing in a crowded market
- Practitioners who do good work in private and get overlooked in public
- Anyone asked for "experience" they can only get by showing evidence first
Turn the Map Into a Plan
The map shows the habit. The career guides show the path: role by role skills, portfolio projects that prove them, and the certification strategy for each track.
Get the Free 2026 Cybersecurity Career GuideBrowse every careers article in the Library →
Explore all free tools and downloads in Tools & Resources →