Computing and AI
Cybersecurity training in Morocco: a realistic roadmap for beginners
Jobs, foundations, labs and CTFs, Moroccan law and a 3-month plan: a realistic roadmap for students and career-changers starting out in cybersecurity.
Cybersecurity training in Morocco starts with solid foundations (networking, Linux, how the web works and a scripting language such as Python), then hands-on practice in labs and CTFs, and only after that a specialism. Most starter resources are free and online, as reachable from Tiznit as from Casablanca. The difference is made at the keyboard, not in front of videos.
This guide is for secondary school students, undergraduates and adults changing career. It does not promise a job in six weeks, but a sensible order, reliable resources, the Moroccan legal rules and a three-month plan.
Cybersecurity jobs in plain words
"Cybersecurity" covers very different jobs. Some people watch alerts, others write security policies, others look for weaknesses on behalf of a client.
| Job | What you actually do | Suits you if you like |
|---|---|---|
| SOC analyst | Watch alerts, sort out real attacks, escalate | Investigating, staying focused |
| Pentester | Look for weaknesses, with permission, then write a report | Taking things apart to understand them |
| GRC and compliance | Risk, security policies, audits, legal compliance | Organising, law, method |
| Cloud security | Secure accounts, permissions and networks in the cloud | Infrastructure, automation |
| Incident response | Contain an attack, analyse the traces, get everything running again | Staying calm |
The SOC (Security Operations Centre, the team that monitors security around the clock) is often a way in: you quickly learn to read logs and recognise an attack. Pentesting is attractive, but it demands very solid systems and networking knowledge. GRC (governance, risk and compliance) is more open to people coming from law, management or audit. No need to choose on day one: the foundations are the same for all these jobs.
Cybersecurity training in Morocco: a structured field
In Morocco, institutions and laws shape the field. Knowing them helps you understand what employers expect.
- The DGSSI (Direction Générale de la Sécurité des Systèmes d'Information), created in 2011 and attached to the National Defence Administration, is the national cybersecurity authority. Its official website publishes security bulletins, very useful for learning the vocabulary.
- maCERT, one of the DGSSI's directorates, is the national centre for monitoring, detecting and responding to cyber attacks.
- Law 05-20 on cybersecurity (2020) and its implementing decree (2021) set rules for government administrations, public bodies and critical infrastructure. The decree notably provides for security audits, which can include penetration tests, and for the qualification of service providers.
- Law 09-08 has governed personal data protection since 2009, overseen by the CNDP. A GRC profile needs to know both laws.
In July 2024 the DGSSI also presented a National Cybersecurity Strategy 2030, one of whose four pillars is capacity building: awareness, training, certification.
No salary figures or job counts here, for lack of a reliable source: read real job adverts in Morocco instead and note the skills that keep coming up.
The foundations to lay first
It is tempting to install "hacking" tools straight away. Without foundations, you press buttons without understanding, and you get stuck at the first surprise.
Networking
IP addresses, ports, TCP and UDP, DNS, HTTP: this is the playing field of every attack. Capture your own traffic with Wireshark and try to spot a DNS request in it.
Linux and the command line
Most servers and security tools run on Linux. You need to move around, manage file permissions, read logs, and start and stop services. The OverTheWire Bandit game is built exactly for this, one level at a time.
The web
Understand what an HTTP request, a cookie and a session are, and how a form talks to a database. The best-known web flaws (SQL injection, XSS) then start to make sense.
A scripting language: Python
You do not need to become a developer: small scripts that read a log file or automate a task are enough. Python is the most common choice, with a bit of Bash. If AI interests you too, our guide to learning AI as a beginner builds on the same foundations.
Technical English
Most documentation, tools, vulnerability alerts and write-ups are in English. You do not need to speak it perfectly, but you must read it without fear. Read a little every day and keep a personal glossary (vulnerability, privilege escalation, payload...).
Practise: labs, CTFs and choosing a specialism
Once the foundations are under way, practice should take up most of your time, on systems built to be attacked.
CTFs for beginners
A CTF (Capture The Flag) is a challenge where you have to find a "flag", a string of characters hidden in a vulnerable system or a file. The most beginner-friendly format is "Jeopardy" style: separate challenges sorted by category (web, cryptography, digital forensics...) and by difficulty. Where to start:
- picoCTF, created by Carnegie Mellon University for beginners (its practice platform is now called CyLab Security Academy).
- PortSwigger's Web Security Academy, free, with labs on the major web flaws.
- OverTheWire, for Linux, then more advanced topics.
- TryHackMe and Hack The Box, with partly free guided paths.
One simple rule: search on your own for 30 to 45 minutes before reading a hint, and a few days after reading a solution, redo the challenge without help. This is retrieval practice (Roediger and Karpicke, 2006): you remember better what you had to recall yourself. Later, the CTFtime website lists online competitions, and joining a team makes you progress fast.
Choosing a specialism
After a few months, your preferences show. Logs and investigation? SOC and incident response. Web challenges? Web pentesting. Infrastructure? Cloud security. Organising and explaining? GRC.
What about certifications?
A certification gives your revision a structure and sends a signal on a CV. The best known for beginners is CompTIA Security+, a general, vendor-neutral certification covering the core concepts of security. Its content changes (CompTIA announces a new version around November 2026): check the current version and the fee on the official website. But it does not replace practice: in an interview, you will be asked what you have done.
The law: only test what you are allowed to test
This is rule number one. In Morocco, articles 607-3 to 607-11 of the Penal Code, introduced by Law 07-03 of 2003, punish in particular fraudulent access to or remaining in an automated data processing system, disrupting how it works, and altering data. An attempt is punished like the offence itself, and the text also covers tools designed or specially adapted to commit these offences.
In practice:
- Train only on your own machines, in labs built for the purpose and in CTFs.
- No testing on the neighbour's Wi-Fi, your school's website or a friend's account, even "just to see".
- A real penetration test requires written permission, a scope and dates. A bug bounty programme requires strict respect of its rules.
- If you stumble on a flaw by chance, go no further and do not take any data.
This reminder is not legal advice. If in doubt, do not test.
A 3-month plan to get started
Allow around 5 to 8 hours a week. A computer with 8 GB of RAM runs a virtual machine, otherwise browser-based labs are enough. Adjust the pace, keep the order.
| Weeks | Goal | Concrete practice |
|---|---|---|
| 1 and 2 | Linux basics | Install a Linux virtual machine, first Bandit levels |
| 3 and 4 | Networking | Wireshark on your own traffic, IP, ports and DNS |
| 5 and 6 | The web | HTTP requests, first SQL injection and XSS labs |
| 7 and 8 | Python | A script that analyses a log file |
| 9 and 10 | First CTFs | Easy picoCTF challenges, one guided path a week |
| 11 and 12 | Direction and portfolio | Three published write-ups, a first team CTF |
After three months you will not be job-ready yet, which is normal, but you will know whether you enjoy the field and which job to aim for. For the next step (university degree, engineering school, vocational training), our guide to career guidance after the Bac helps you compare the routes.
Show what you can do
A cybersecurity recruiter wants to see how you reason.
- Write-ups: explain how you solved a challenge, mistakes included. Publish them only if the platform allows it, as many forbid sharing the solution to a challenge that is still live.
- A tidy GitHub: your scripts, your notes, the set-up of your lab.
- Your CTF results: your team's ranking and your strongest categories.
- A documented home lab: a few virtual machines and what you learnt from them.
Write some of this in English: it doubles as language practice. For younger members of the family, the way in is coding and robotics: see robotics and coding for kids.
If you would rather have guidance, the ApexTech programme at ApexTiz in Tiznit uses CyberStand, a platform with real Docker labs in the browser. Its cybersecurity track has 45 labs (network pentesting, web security, privilege escalation) and CTF-style challenges. The content is in English and trainers explain in darija or French, with at most 10 people per room and a workstation each, on site or remotely. The end-of-course certificate is issued by the centre, it is not a state diploma. And if you are self-motivated, the free resources in this guide are enough to get started.
Frequently asked questions
Can you learn cybersecurity without a computing degree?
Yes, to get started: the foundations and the practice are open to everyone, online. For a first job, many adverts ask for a degree or IT experience, so a solid portfolio and a recognised qualification remain real assets.
How long does it take to get started in cybersecurity?
Allow a few months of regular work to master the foundations and your first CTFs. Becoming job-ready takes considerably longer: be wary of promises of a new career in a few weeks.
Do you need to be good at maths for cybersecurity?
Not for most entry-level jobs: logic, rigour and curiosity matter more. Maths becomes important if you are aiming for cryptography.
Is ethical hacking legal in Morocco?
Yes, when it is authorised: on your machines, in labs, CTFs or an engagement with written permission. Accessing a system without permission is punished under articles 607-3 and following of the Penal Code, even as a mere attempt.
Want advice for your case?
Let's talk about your situation.
Message us on WhatsApp with the learner's level and what you are looking for. We usually reply the same day, with no obligation.