Types of hackers & the careers ahead

The word "hacker" carries a lot of baggage. Before you can decide what kind of security person you want to become, you need the real map — who's who, and the surprising variety of careers this field contains.

What a "hacker" really is

Strip away the movies and a hacker is simply:

Someone who deeply understands how a system works and can make it do things it wasn't designed to do.

That skill, by itself, is neither good nor evil. A locksmith and a burglar have the exact same knowledge of locks. The difference is intent and permission — not knowledge.

The "hats": good, bad, and in between

The field traditionally sorts hackers by the colour of an imaginary hat, borrowed from old cowboy films where the hero wore white and the villain wore black.

[The three hats]

The three hats explained

• White hat — the good guys, also called ethical hackers. They break in with permission to find weaknesses and help fix them before criminals do. They're hired by companies or work through official programs. This is what you are training to become.
• Black hat — the criminals. They break in without permission to steal, damage, or spy. This is illegal and can lead to prison. We study how they think so we can defend — we never act like them.
• Grey hat — the murky middle. They might poke at a system without permission but without meaning harm (e.g., finding a flaw and reporting it uninvited). Intentions may be good, but because there was no permission, what they do is usually still illegal and risky.

The single line separating a white hat from a criminal is permission. Same skills, same tools — but the ethical hacker was invited. Sub-lesson 1.4 is entirely about this line.

Beyond the three hats — a few more labels worth knowing

The hat system is a useful simplification, but you'll encounter several more specific labels throughout this course and the wider industry:

• Script kiddie — someone with limited technical skill who runs pre-built attack tools written by others, often without fully understanding how they work. Not a skill level to aspire to, but a genuinely common starting point many professionals honestly admit to — the difference is whether you keep learning why the tools work, which this entire course is built around.
• Hacktivist — an attacker motivated by political or social causes rather than money, defacing websites or leaking data to make a statement. Legally, hacktivism is treated the same as any other unauthorized access, regardless of motive.
• State-sponsored actor / APT (Advanced Persistent Threat) — hackers working for or on behalf of a national government, typically extremely well-resourced, patient, and focused on long-term espionage or sabotage rather than quick financial gain. "Persistent" is the key word — these groups often maintain covert access to a target network for months or years before being discovered, referenced again in Path 10's attackers and kill chain lesson.

Red team, blue team, and purple team — a preview

You'll see these three terms constantly once you reach Path 16's advanced material, so it's worth planting the vocabulary now:

• Red team — plays the attacker's role, testing an organization's defenses through realistic, often prolonged simulated attacks (broader in scope and duration than a typical pentest engagement).
• Blue team — plays the defender's role, monitoring, detecting, and responding to those simulated (or real) attacks.
• Purple team — not a separate group of people, but a collaborative approach where red and blue teams actively share findings with each other during an engagement, specifically to improve detection faster than either working in isolation would — Path 16 has a dedicated purple teaming lab built around exactly this idea.

The jobs you can aim for

"Cybersecurity" isn't one job — it's a whole industry, the way "medicine" contains surgeons, nurses, and pharmacists. Here are the most popular roles:

Let's meet each role briefly. You'll see the full career details in the Careers page and in the roadmap at the end of Paths 11, 09, and 10.

SOC Analyst

SOC stands for Security Operations Centre — a kind of security control room. These analysts watch alerts and network activity in real time, spot attacks as they happen, and respond.

SOC Analyst is one of the most common first jobs in security. Entry-friendly, and it gives you a broad view of real-world attacks.

Penetration Tester ("pentester")

Paid to legally break into a company's systems, then write a report explaining exactly how, so the holes can be closed. Very hands-on, offensive, and hands-on-keyboard.

Bug Bounty Hunter

An independent hacker who finds flaws in companies' websites through official programs and earns a cash reward for each valid one. Work from home, on your own schedule, for companies worldwide. Path 15 covers this in depth.

AppSec (Application Security) Engineer

Works alongside software developers to build safe software from the start, so bugs never ship. Great if you also enjoy building things.

Cloud Security Engineer

Secures the huge systems companies run on cloud services (Amazon, Microsoft, Google). Fast-growing and in high demand. Path 16 covers this.

Digital Forensics & Incident Responder (DFIR)

The detective. When an attack happens, they investigate what the attacker did, how they got in, and how to recover. Path 16 covers this too.

GRC / Security Analyst

Governance, Risk & Compliance — the strategic side: managing risk, writing policy, making sure the organisation meets security standards. Great for people who love organisation and structured thinking.

AI Red Teamer (new frontier)

Adversarially tests AI systems (like ChatGPT-style products) for safety and security flaws. Path 18 covers this brand-new field.

The rough salary shape (just so you know)

Salaries vary enormously by country, but a rough shape looks like this:

You don't have to choose your specialisation now. As you move through this course you'll naturally discover what excites you — breaking things, defending them, investigating them, or building safe ones.

Which paths in this course lead to which jobs?

Here's the quick map — see the Careers page for all eight.

An ethical hacker and a criminal can have identical skills and use identical tools. What single thing separates them?

Key terms

• White / black / grey hat — ethical, criminal, and in-between hackers.
• SOC — Security Operations Centre; a real-time defence team.
• Pentester — a professional who legally breaks in and reports how.
• DFIR — Digital Forensics & Incident Response; the investigators.
• GRC — Governance, Risk & Compliance; the strategic side.

Recap

• A hacker is someone who deeply understands and can bend systems — the skill is neutral.
• Permission is the one line between ethical and criminal.
• Security is many careers: SOC, pentest, bug bounty, AppSec, cloud, forensics, GRC, AI red team.
• You can wait to choose — clarity comes from working through the course.

References

• Cyberseek — US cybersecurity career pathway — interactive map of security roles and how they connect.
• SANS Cybersecurity Career Roadmap — a comprehensive career guide from a top training organisation.
• TryHackMe Career Paths — hands-on paths mapped to real roles.
• Cyber Career Framework — UK Cyber Security Council — 16 cyber specialisms with role descriptions.

Next up → A tour of common cyberattacks