How to Turn a 4-Week Project Into Verified Cyber Experience

If you've finished a Level 3 in cybersecurity, a bootcamp, or a self-study path, you've hit the wall that stops most career changers: qualifications without experience, and job ads that ask for two years of it. The standard advice — apply anyway, volunteer, build a home lab — is sound but rarely leads anywhere concrete.

A scoped project is a more direct route. It produces something a hiring manager can actually evaluate: evidence that you delivered work, for a real organisation, over a defined period, with a defined output.

Here's what the process looks like end to end, using the Microsoft 365 security review as the example.

Step 1: Your profile determines what you're matched to

Projects are matched to your capability, not chosen at random. A Level 3 candidate is matched to templates calibrated to Level 3 knowledge — M365 reviews, phishing-awareness work, asset inventories, policy documentation. Not penetration tests, not incident response, not anything that requires skills you don't yet have.

The Resume Builder is the first practical step here. Your CV is what the matching uses to understand your background — so it needs to accurately reflect your Level 3 modules, any tools you've practised with, and the transferable experience from your previous career. If you've come from restaurant management, that includes the operational and compliance elements, not just the customer-facing ones.

Step 2: The project is scoped before you start

A template isn't an open-ended request to help. It's a defined piece of work with five specific elements:

Scope. What's included — for the M365 review, that's an MFA and access audit, a basic security checklist, and a recommendations report. What's excluded is equally important: no system changes, no remediation work, no ongoing support.

Duration. Four to six weeks, with a defined end date. This matters for you and for the organisation — it's a bounded commitment, not an indefinite arrangement.

Outputs. The deliverables the organisation will receive. These are the things you'll be able to point to afterwards as evidence of your work.

Prerequisites. The knowledge you need to deliver it — for M365 review, Level 3 cyber plus familiarity with Microsoft 365 fundamentals.

Supervision. The review process that ensures the deliverables are sound before they reach the organisation.

Step 3: The organisation is approached with a concrete proposal

This is the part that makes the model work. The organisation isn't asked whether it wants an intern or whether it has a cybersecurity need. It's presented with a proposal: a scoped M365 security review, delivered over four to six weeks by a supervised candidate, at no cost, with defined outputs.

Their decision is yes, no, or modify the scope. That's a much easier decision than inventing a role, and it's why organisations say yes to projects they'd say no to as internships.

Step 4: You deliver the work

The delivery is where the real learning happens — and it's genuinely different from coursework. You're working with an organisation's actual environment, not a lab. You have to communicate with a non-technical stakeholder. You have to produce documentation that someone else will read and act on.

The supervision model isn't a formality. Every deliverable is reviewed before it reaches the organisation, which protects both of you: the organisation receives work that's been checked, and you get feedback on your output before it's final. For a first project, that feedback is often the most valuable part.

Step 5: The project becomes verified experience

On completion, the project is added to your GetJobzi profile as a verified entry:

Microsoft 365 Security Review — 6 weeks — completed for a verified UK charity. Deliverables: MFA and access audit, security checklist, recommendations report. Skills demonstrated: M365 administration, access control, security documentation, stakeholder communication.

The "verified" part matters. The organisation has confirmed the work was done. The deliverables exist. The duration is accurate. This is not self-reported experience — it's evidence with a paper trail.

Step 6: It goes on your CV and into your applications

This is where the Resume Builder and Cover Letter Optimiser come back in. The completed project gives you something substantive to add — and the Resume Builder's keyword extraction helps you phrase it in the language the roles you're targeting are screening for.

For a SOC Analyst application, that might mean emphasising the access-control and security-documentation elements. For an IT support role, the M365 administration and stakeholder communication. The same project can be framed differently depending on what the JD prioritises.

The Job Search Agent then surfaces the roles where delivered work is valued over credentials — which includes many MSPs, public sector employers, and organisations that explicitly hire on aptitude.

What one project changes

The difference isn't just a CV line. Before the project, you're a candidate with a qualification and no evidence. After it, you're a candidate who has delivered a defined piece of security work for a real organisation, with deliverables that can be discussed in an interview.

In an interview, that changes the conversation. Instead of "tell me about your coursework," the question becomes "tell me about the M365 review you did" — and you have specific, concrete things to say. That's the difference between being assessed on potential and being assessed on what you've actually done.