Currently in the situation where I want to shoot for a security analyst/SOC job but while I'm studying for my Cysa+ I am also studying red-team tactics. Should I either pick one or the other? What if I want to do red-team eventually, would it benefit me if I had blue-team experience before switching?

Confused about what study path I should focus on if I'm not totally sure what route I want to go. Defending seems important but attacking and malware reverse engineering seems cool.

  • Why do you think that you should only do one or the other? What's the harm in doing both? Since you are aiming for a blue-team type job, why ask about not learning blue-team skills, and if you want to eventually do red-team work, why ask about not learning red-team skills? It looks like you want to do both. Does it matter if the skills complement or support each other? Just do both.
    – schroeder
    Commented Nov 9, 2022 at 8:41

1 Answer 1


Red-team and Blue-team skills are complementary if not transferrable based on my experience. Examples of this are wide ranging from a blue-team centric cybersecurity analyst being able to use their knowledge of exploitation to effectively threat model new systems to red-teamers being able to understand things like devops and secure code review to create better tooling.

You can't defend against what you don't understand so I implore you to look at red-team tactics. Based on the CYSA syllabus by CompTIA I would focus more on analysis and incident response, and look into malware reverse engineering later after passing one thing at a time.

Not the answer you're looking for? Browse other questions tagged .