Part of the Cybersecurity Career Coaching Guide — This article is one deep-dive in our complete coaching series.

Building Your Cybersecurity Portfolio from Scratch

By HADESS Team | February 28, 2026 | Updated: February 28, 2026 | 8 min read

Why a Portfolio Matters More Than You Think
What Belongs in a Security Portfolio
Home Lab Documentation
CTF Write-Ups
Security Tool Projects
Blog Posts and Technical Writing
Open-Source Contributions
Portfolio Structure and Presentation

Why a Portfolio Matters More Than You Think

A cybersecurity portfolio is the difference between telling a hiring manager you can do something and showing them. Certifications prove you studied. A portfolio proves you practiced.

This matters most for people without direct security job experience — career changers, recent graduates, and self-taught practitioners. When your resume cannot list a previous SOC analyst role, your portfolio demonstrates that you have the hands-on skills the job requires.

Even experienced practitioners benefit from portfolios. A security engineer who documents their architecture decisions, a penetration tester who publishes methodology write-ups, or a threat hunter who shares detection rules — these all build professional credibility.

The HADESS workspace provides structured lab environments for building portfolio-worthy projects. But any lab environment works — the key is documentation.

What Belongs in a Security Portfolio

Home lab documentation. Detailed write-ups of your lab environment, including architecture diagrams, tool configurations, and scenarios you have run. This shows you can build and operate security infrastructure.

CTF write-ups. Solutions to Capture the Flag challenges that show your analysis and exploitation methodology. These demonstrate practical offensive and analytical skills.

Security tool projects. Scripts, automation tools, or detection rules you have built. Python scripts for log analysis, YARA rules for malware detection, Sigma rules for SIEM detection — anything that solves a real security problem.

Technical blog posts. Articles explaining security concepts, tool comparisons, or threat analyses. Writing about security demonstrates deep understanding and communication ability.

Vulnerability research. If you have found and responsibly disclosed vulnerabilities, document the process (without exposing sensitive details). This is gold for offensive security portfolios.

Open-source contributions. Pull requests to security tools, documentation improvements, or community plugins. These show collaborative work and code quality.

Home Lab Documentation

Your home lab is the foundation of your portfolio. Here is what to document:

Network diagram. Draw the architecture — VMs, network segments, services, and how they connect. Tools like draw.io or even a clean hand-drawn diagram work. Include IP ranges, operating systems, and the purpose of each component.

Installation and configuration guides. Write up how you set up each tool. A Security Onion deployment guide, a Splunk configuration walkthrough, or a pfSense firewall setup. Write it clearly enough that someone else could follow it.

Attack and defense scenarios. Document specific scenarios you have run:

“I configured a phishing simulation using GoPhish targeting my lab users, then investigated the resulting alerts in Security Onion”
“I deployed a vulnerable web application (DVWA) and performed a full penetration test, documenting each finding”
“I generated malicious traffic using Atomic Red Team and tuned Splunk detection rules to identify the activity”

Each scenario should include: setup, execution, analysis, findings, and lessons learned.

Example SOC Analyst lab portfolio:
1. Security Onion deployment and configuration
2. Splunk instance with custom dashboards for common attack patterns
3. 5 documented alert investigation walkthroughs
4. 3 custom detection rules with explanation of the threat they detect
5. An incident response playbook for a common scenario

Practice building these in the HADESS workspace with guided lab environments, then document them for your portfolio.

CTF Write-Ups

CTF write-ups show your problem-solving methodology. Good write-ups include:

The challenge description. What were you given? What was the objective?

Your approach. How did you analyze the problem? What tools did you use? What was your thought process?

Dead ends. What did you try that did not work? This shows perseverance and learning ability. Hiring managers appreciate seeing how you handle failure.

The solution. Step-by-step walkthrough of how you solved it, with screenshots or command output.

Lessons learned. What did this challenge teach you? What would you do differently?

Platforms for CTF practice: TryHackMe, HackTheBox, PicoCTF, OverTheWire. Start with guided challenges and progress to harder ones.

Aim for 10-15 well-documented write-ups across different categories (web exploitation, cryptography, forensics, reverse engineering). Quality over quantity — one detailed write-up beats five one-paragraph summaries.

Security Tool Projects

Building tools demonstrates programming ability and security understanding. Projects do not need to be large — small, focused utilities are better than ambitious unfinished projects.

Starter projects:

A Python script that parses firewall logs and identifies the top 10 blocked IPs with geolocation data
A Bash script that checks a Linux system against CIS benchmark hardening standards
A PowerShell script that audits Active Directory for common misconfigurations
A YARA rule set for detecting common malware families
A Sigma rule pack for detecting MITRE ATT&CK techniques in SIEM logs

Intermediate projects:

A web application vulnerability scanner that checks for common misconfigurations
An automated phishing analysis tool that extracts IOCs from suspicious emails
A threat intelligence feed aggregator that normalizes data from multiple sources
A compliance audit automation script for SOC 2 or ISO 27001 controls

Host your code on GitHub with clear README files explaining what the tool does, how to use it, and why you built it. Clean code with comments and documentation signals professionalism.

Build your scripting and automation skills with the HADESS skills catalog — modules on Python, Bash, PowerShell, and security automation.

Blog Posts and Technical Writing

Writing about security is one of the highest-impact portfolio activities. It demonstrates deep understanding, communication skills, and initiative — three things every hiring manager values.

Topic ideas:

A comparison of two SIEM platforms you have used in your lab
A walkthrough of setting up a specific security tool
An analysis of a recent CVE and how to detect or mitigate it
A guide to a specific MITRE ATT&CK technique with detection strategies
Lessons learned from a CTF challenge or lab scenario

Where to publish: GitHub Pages (free), Medium, dev.to, or a personal blog. The platform matters less than the content quality.

Writing tips:

Write like a practitioner, not a textbook. First person is fine.
Include screenshots, command output, and configuration examples
Link to relevant resources — SANS publications, NIST documentation, and tool documentation
Keep posts focused — one topic per post, 800-1,500 words

Open-Source Contributions

Contributing to security tools shows collaboration skills and code quality. Start small:

Documentation improvements. Fix typos, add examples, improve installation guides for tools you use. This is the lowest barrier to entry.

Bug reports. If you find bugs while using security tools, file well-documented issue reports. Include reproduction steps, expected behavior, and actual behavior.

Small features or fixes. Once you are comfortable with a tool’s codebase, submit pull requests for minor improvements. Detection rule additions, parser improvements, or UI fixes.

Security tools accepting contributions: Sigma (detection rules), Atomic Red Team (attack simulations), YARA rules repositories, Prowler (cloud security), ScoutSuite, and many more.

Portfolio Structure and Presentation

GitHub as your hub. Create a well-organized GitHub profile with:

A profile README introducing yourself and your security focus
Separate repositories for projects, CTF write-ups, and lab documentation
Clean code, clear READMEs, and consistent formatting

LinkedIn integration. Link your GitHub projects from your LinkedIn profile. Use the Featured section to highlight your best work.

Resume integration. Reference specific portfolio items in your resume. “Built automated log analysis tool (github.com/you/tool)” is more compelling than “experienced with log analysis.” Use the resume builder to structure this.

Keep it current. Add new work regularly. A portfolio with all contributions from 6 months ago looks abandoned. Aim for 1-2 new items per month.

Consider coaching for portfolio review — a coach who hires security professionals can tell you which projects are strongest and what is missing.

Related Guides in This Series

Take the Next Step

Build portfolio projects in structured labs. The HADESS workspace provides guided lab environments for hands-on practice that translates directly to portfolio content.

Get portfolio feedback from a coach. HADESS coaching includes portfolio review as part of career development sessions.

Get started free — Create your HADESS account and start building your cybersecurity portfolio today.

Frequently Asked Questions

How many portfolio items do I need?

Quality matters more than quantity. 5-8 well-documented items across different categories (lab documentation, CTF write-ups, tool projects, blog posts) is a strong portfolio. One excellent project beats ten rushed ones.

Can I use my portfolio for penetration testing job applications?

Absolutely. Pentesting portfolios should emphasize CTF write-ups, vulnerability analyses, and tool development. Avoid including details of any unauthorized testing.

Should I put my portfolio on a personal website?

GitHub is sufficient for most purposes. A personal website adds polish but is not necessary. If you create one, keep it simple — your work should be the focus, not the design.

What if I built something but the code is messy?

Clean it up before publishing. Add comments, organize functions, write a README. The code does not need to be production quality, but it should be readable and documented.

—

HADESS Team consists of cybersecurity practitioners, hiring managers, and career strategists who have collectively spent 50+ years in the field.

Building Your Cybersecurity Portfolio from Scratch

Table of Contents