Quick answer: A cyber security portfolio is a collection of practical work that proves your skills, such as a documented home lab, capture-the-flag write-ups, scripts on GitHub and sample reports. Host it on GitHub or a simple personal site, explain what you did and why in each project, and link it from your CV and LinkedIn profile.
Entry-level security roles attract many applicants with similar certifications. A portfolio shows what you can actually do, which is what hiring managers want to see. This guide covers what to include, how to present it and which projects suit different career paths.
Portfolio projects by career path
| Target role | Best portfolio projects | Skills demonstrated |
|---|---|---|
| SOC analyst | SIEM lab with detection rules, alert triage write-ups | Log analysis, detection, investigation |
| Penetration tester | CTF and lab machine write-ups, legal bug bounty reports | Enumeration, exploitation, reporting |
| Cloud security | Hardened cloud account with infrastructure as code | IAM, configuration, automation |
| GRC analyst | Sample gap analysis or risk register against NIST CSF | Frameworks, risk, communication |
| Security engineer | Scripts and tools for automation or hardening | Programming, systems, problem solving |
Match your projects to the job you want. Three strong, relevant projects are worth more than ten unrelated ones, because they show depth and focus.
What to include
- A home lab. Document the setup, the tools you installed and what you tested. A diagram helps.
- Write-ups. Explain how you solved CTF challenges or investigated a sample incident, including what did not work.
- Code. Small scripts for log parsing, scanning automation or alert enrichment show practical ability.
- Reports. A clear incident or risk report proves you can communicate with non-technical readers.
- Certifications and learning. List them, but let projects carry the weight.
How to present your portfolio
- Use a clean GitHub profile with a pinned README that summarizes your best work.
- Give each project a short summary: the goal, tools used, what you found and what you learned.
- Never publish real company data, live credentials or details of systems you are not authorized to test.
- Add the link to your CV, LinkedIn and cover letter.
- Update it every few months so it shows steady progress.
Ethics and legality
Only test systems you own or have written permission to test, such as your own lab, deliberately vulnerable practice machines or public bug bounty programs with clear rules. Employers look closely at how candidates handle this.
For career context, read about penetration tester vs cyber security analyst roles, how to plan a successful cyber security career and options for training with job placement or a cyber security bootcamp. Ideas for projects are in our list of cyber security research topics. The NICE Workforce Framework describes the skills each role needs, which helps you choose projects, and the US Bureau of Labor Statistics outlines the analyst role in detail.
Frequently asked questions
Do I need a portfolio to get a cyber security job?
It is not mandatory, but it is one of the most effective ways to stand out for entry-level roles, especially without prior security experience.
Where should I host my cyber security portfolio?
GitHub is the most common choice. A simple personal website that links to your GitHub projects also works well.
How many projects should a portfolio have?
Three to five well-documented projects relevant to your target role are usually enough.
Can I include CTF challenges?
Yes, but check the platform’s rules. Some ask you not to publish write-ups for active challenges.
Conclusion
A focused portfolio turns claims into evidence. Build a lab, document real investigations, share clean code and write clearly. Keep it relevant to the role you want, and it will do more for your applications than another line on your CV.
