Freelance Cybersecurity: Is It a Realistic Career in 2026?

# Review security headers on a client site (with written permission)
# pip install requests
import requests

EXPECTED = {
    "Strict-Transport-Security": "forces HTTPS",
    "Content-Security-Policy": "limits script sources",
    "X-Content-Type-Options": "prevents MIME sniffing",
    "Referrer-Policy": "limits referrer data",
}

def review(url: str):
    r = requests.get(url, timeout=10)
    for header, why in EXPECTED.items():
        status = "present" if header in r.headers else "MISSING"
        print(f"{header:28} {status:8} ({why})")

review("https://example.com")

#!/usr/bin/env bash
# Basic Linux hardening checks (run on a server you are authorised to review)
echo "== SSH settings =="
grep -Ei '^(PermitRootLogin|PasswordAuthentication)' /etc/ssh/sshd_config

echo "== Listening services =="
ss -tuln

echo "== Pending security updates (Debian/Ubuntu) =="
apt list --upgradable 2>/dev/null | head -20

echo "== Users with login shells =="
grep -E '(/bin/bash|/bin/sh)$' /etc/passwd | cut -d: -f1

Engagement: Configuration review for <Client>
Authorised by: <Name, Role> (signed, dated)

In scope:
  - www.client-example.com (web server headers, TLS settings)
  - Cloud account settings: read-only review role
Out of scope:
  - Any third-party services
  - Denial-of-service or social engineering tests
Window: <dates and times>
Contacts: <client technical contact>, <emergency contact>
Data: screenshots stored encrypted; deleted 30 days after report

import ipaddress

IN_SCOPE_NETS = [ipaddress.ip_network("203.0.113.0/28")]
IN_SCOPE_DOMAINS = {"www.client-example.com"}

def allowed(target: str) -> bool:
    try:
        ip = ipaddress.ip_address(target)
        return any(ip in net for net in IN_SCOPE_NETS)
    except ValueError:
        return target in IN_SCOPE_DOMAINS

for t in ["203.0.113.5", "198.51.100.9", "www.client-example.com", "other-site.com"]:
    print(f"{t:24} {'IN SCOPE' if allowed(t) else 'NOT ALLOWED - do not test'}")

Finding: Missing HTTP Strict-Transport-Security header
Severity: Medium
Affected: www.client-example.com
Evidence: response headers captured on <date> (screenshot 3)
Risk: users may be downgraded to HTTP on hostile networks
Recommendation: add
  Strict-Transport-Security: max-age=31536000; includeSubDomains
after confirming all subdomains support HTTPS.
References: vendor documentation for your web server

findings = [
    {"title": "SSH password login enabled", "severity": "High"},
    {"title": "Missing HSTS header", "severity": "Medium"},
    {"title": "Server version disclosed", "severity": "Low"},
]
order = {"High": 0, "Medium": 1, "Low": 2}
print("Executive summary")
for sev in order:
    n = sum(f["severity"] == sev for f in findings)
    print(f"  {sev:6} {n}")
print("\nFindings (most severe first)")
for f in sorted(findings, key=lambda f: order[f["severity"]]):
    print(f"  [{f['severity']}] {f['title']}")

Stage 1  Fundamentals: networking, Linux, Windows, security concepts
Stage 2  Entry role: SOC analyst, IT security support or similar
Stage 3  Specialise: cloud security, web security, GRC or IR
Stage 4  Credentials: relevant certifications for your specialism
Stage 5  Side work: small, defensive, well-scoped engagements
         (only if your employment terms allow it)
Stage 6  Freelance more fully once you have references and steady demand

Build proof without touching anyone else's systems:

- Home lab with vulnerable-by-design VMs
- Legal training platforms with practice targets
- Hardening write-ups for your own servers
- Awareness training slides for a club or college (with permission)
- Public bug bounty programmes, strictly within their published rules

[ ] Signed contract and authorisation
[ ] Scope with in-scope and out-of-scope lists
[ ] Time window and emergency contacts
[ ] Confidentiality and data handling terms
[ ] Report template ready
[ ] Payment terms and milestones agreed
[ ] Employer policy checked if you also have a job