Entry-level cybersecurity searches in Kenya can include security operations, governance, audit support, vulnerability management and identity administration. Choose one target path before building a portfolio. A collection of tool names without a documented problem, method and result does not demonstrate readiness.
Define a safe lab boundary
Use only systems and data you own or have explicit permission to test. A suitable beginner exercise can analyse synthetic authentication logs from a local lab. Document the components, fictional users, time zone and question you are investigating.
Do not scan public systems, attempt to access real accounts or publish secrets to make the exercise look realistic. Keep tokens and passwords out of screenshots and repositories. State clearly that the environment is simulated and the findings do not describe a real organisation.
Build an incident timeline
Generate harmless fictional events such as repeated failed logins followed by a successful login in the lab. Record timestamp, source, account, event, evidence location and confidence. Separate a suspicious pattern from a confirmed compromise; the logs may justify investigation without proving intent.
Write a short analyst note with what happened, what is known, what remains unknown and the recommended next verification step. Include the detection rule or search logic and one limitation. Avoid claiming that a single alert proves an attack.
Demonstrate repeatability
Add a README with setup, sample-data generation, commands or queries, expected output and cleanup. A reviewer should understand the exercise without access to your machine. If you used a tutorial, credit it and explain your independent modification.
Test at least one normal case and one edge case. Record a false positive and show how you refined the logic or documented the limitation. This is stronger evidence than presenting every alert as a success.
Write the technical CV accurately
List tools beside the task performed: parsed logs, built a dashboard, documented an incident timeline or reviewed access records. Do not claim production SOC experience from a home lab. Separate coursework, certifications, lab work and employment.
For governance or audit roles, lead with controls, evidence collection and report writing rather than forcing a SOC project into the application. For technical support experience, explain the security-relevant tasks you actually completed under an approved process.
Apply and prepare for interview
Check the live advert for degree, certification, shift and experience requirements. Prepare to explain one lab decision, one mistake and one improvement. Acknowledge when you would escalate rather than taking unauthorised action. Use the employer's verified portal, protect personal documents and never pay for placement.