Hey,
Most people prepare hard for the interview. Then they get the job and freeze on day one.
This week is about what comes after the offer: how to start well, and how to practise it before you even have the job.
🔥 This Week's Insight: The First 90 Days Aren't About Proving How Much You Know
Here's a pattern I see all the time. Someone lands their first security role and tries to prove themselves immediately. They talk a lot, suggest big changes, and quietly hope nobody notices what they don't know yet.
It rarely works. The first 90 days are about three different things: learning how the place works, delivering one small useful thing, and building trust.
Here's a simple structure to follow.
Days 1-30: Listen and map
Your job is to understand the landscape, not change it.
Meet the people. Who owns what? Who do you ask when you're stuck?
Learn the systems. What tools are in use, and where do the logs and records live?
Learn the process. How does a ticket move? When do you escalate, and to whom?
Read what already exists. Policies, past incident write-ups, recent audit findings, if you're allowed to see them.
Keep a notes file. Write down every question and every unfamiliar term, then answer them one by one.
Days 31-60: Deliver one small useful thing
Pick something small, visible and finishable. Not a grand redesign. A one-page runbook for the alert that wastes the most time. A checklist for a task people keep getting wrong. A tidied evidence folder. Then show someone the before and after.
Small and finished beats big and half done, because it proves you can take something from problem to useful result.
Days 61-90: Own something, and ask what success looks like next
Take ownership of one recurring task or area, and share a short update on how it's going. Then ask your manager: "What does success look like over the next few months, and how will my development be supported?"
An example, to show the structure (adapt it to your role):
Phase SOC analyst GRC analyst Days 1-30 Map how alerts flow and escalate. Read the last three incident write-ups. Map which frameworks are in scope and who owns each control. Read the last audit findings. Days 31-60 Write a one-page runbook for the most repeated alert. Tidy the evidence for one control and draft a missing procedure. Days 61-90 Own the quality of triage notes for one alert type, and propose one tuning change. Own the evidence calendar for one control area and run a small control test.
🛠️ Free Tool of the Week: The Skills Gap Tool
Once you're in, the learning doesn't stop. Choose your role and it shows where you stand against what employers ask for, so you know what to keep learning and what to learn next.
Free, with no signup to see your results
Useful before you start a role and again at day 90
Best used alongside real job postings in your own area
💡 Career Advice From the Hiring Table
On day one, ask your manager: "What would a great first 90 days look like?"
It shows you're thinking like a colleague, not just an employee. And it gets you something most new starters never have: a clear target.
Two practical points:
Write the answer down and check in at 30, 60 and 90 days. "Here's what I've done against what we agreed" is a strong conversation.
"I don't know yet, here's how I'll find out" is a good answer. Pretending to know is what costs you trust.
🎯 Your One Action This Week
Write your own 30-60-90 plan for the job you want, even before you have it.
Pick one target role.
Open one real junior job posting for it.
For each phase, write two or three bullets: what you'd learn, what small thing you'd deliver, and what you'd own.
Keep it to one page.
Then bring it to your next interview. "Here's how I'd approach my first 90 days" is a memorable thing for a candidate to say.
All you need is a job ad and half an hour.
🧰 Free Tools, If You Haven't Tried Them Yet
🧭 Not sure which path? path.mpcybersecurity.co.uk matches your background and working style to one path.
📊 Not sure what to study next? skills.mpcybersecurity.co.uk shows what's missing for your target role.
🧠 Preparing for Security+? practice.mpcybersecurity.co.uk gives you an explanation on every answer.
📄 Ready to apply, but hearing nothing? cv.mpcybersecurity.co.uk shows what the software sees first.
All free. No signup required to see your results.
🔜 A Look Behind the Curtain: What's Inside the Community
Everything in this issue is free, and you can do all of it on your own. Plenty of people do. If you'd like someone to check your work, here's a small look at what members actually get.
A real work ticket, every week
This is a snippet from one of this week's challenges. (Northwind Health is a fictional company.)
Ticket from your manager: "The network team says one laptop looks 'chatty' on DNS, but nothing has alerted. Can you look at yesterday's DNS logs, tell me whether the laptop looks infected, and what we do first?"
00:00:03 10.20.4.37 a8f3kq91zx.cdn-sync.example.net TXT NOERROR
00:01:02 10.20.4.37 m2p7w0tb5e.cdn-sync.example.net TXT NOERROR
03:14:01 10.20.4.37 r4t8n2ju7s.cdn-sync.example.net TXT NOERROR
Your deliverables: a verdict with three indicators, an explanation of why a second periodic host is probably harmless, your first four containment actions in order, and a detection idea.
Every challenge is scored on accuracy, reasoning and communication. Members review each other's work, then compare against my model answer.
A scenario question, every weekday
"You start a new security job on Monday. By Friday your manager wants to know what's most likely to hurt the company. You have no budget and no tools. What do you do each day?"
Members post their answer and their reasoning, and I read and reply.
Six-week study plans for every path
SOC, GRC, IAM, Cloud and Pentest, at about 3-4 hours a week, with weekly checklists, ending in a project you can put on your GitHub.
And the rest
A live Q&A with me every Wednesday at 8pm GMT. Study groups by path. CV, LinkedIn and GitHub templates. And CV and portfolio reviews from someone who hires for these roles.
No guarantees, and I can't promise you a job. The more you get involved, the more you get out of it. It's $39 a month, and you can cancel any time.
Hit reply and tell me the first thing you'd do in your first week. I read every one, and it helps me decide what to cover next.
See you next week.
Marius Poskus Global VP of Cybersecurity / CISO CTRL+ALT+DEFEND
Skool Community | YouTube | LinkedIn
You're receiving this because you downloaded a resource from CTRL+ALT+DEFEND or subscribed to the newsletter. Next week: GRC in plain English, what a GRC analyst actually does.