A screen displays an alert, a colleague asks whether an access should be cut off, and the manager wants to know whether operations can continue. For someone looking for their first job in cybersecurity in Morocco, this scene sometimes seems more intimidating than a technical exercise. It forces you to make sense of incomplete information, choose what deserves verification and explain what you actually know. It is also a good way to prepare an application: showing a working method, rather than merely listing software names.
The news from September provides a concrete starting point. EMSI announced a cyber crisis management exercise with Cybersup, scheduled from September 23 to 25, 2026 in Casablanca, Rabat, Marrakech and Tangier. Its institutional announcement mentions 665 students and work combining analysis, decisions and cooperation. We do not have an independent assessment of the participants' results here. This guide therefore attributes no performance to them and does not turn this educational exercise into a promise of employment.
The subject goes beyond a school event. The summary of the national cybersecurity strategy published by the DGSSI includes skills development and incident preparedness among its orientations. This situates the value of such learning; it measures neither the number of positions open today nor a beginner's salary. Jawb's analysis focuses on a more accessible question: how do you present your ability to work rigorously when you do not yet have long experience?
Choosing a mission before choosing a job title
Cybersecurity covers different activities. A job posting may ask you to monitor alerts, administer equipment, support audits or document procedures. The title alone is not enough to know what you will do. Read the missions, the expected tools, the level of autonomy, the working hours and the composition of the team. The same expression can refer to a supervised junior position in one company and a much broader role elsewhere. Your application must start from these concrete differences.
Build a small reading grid with three columns: what you have practiced, what you understand but still need to exercise, and what you do not know. This distinction prevents you from presenting a course you recently discovered as a mastered skill. It also makes your search more precise. If you enjoy analyzing and writing, a supervised investigation mission may interest you; if you prefer configurations and daily operations, look at network and systems needs. These are avenues to compare with job postings, without locking your career path into a box.
On Jawb's job postings, examine each employer's criteria before applying. A search in Casablanca does not imply that the position is accessible from any city; a position in Rabat may require regular presence. Check the location, possible travel and the contract. Note the questions that remain open so you can ask the recruiter, rather than filling in the blanks with your assumptions.
In a crisis, start with the available facts
To practice, imagine an explicitly fictional scenario: a small company receives a report of an unusual connection on a test account. You only have access to a few logs and a description of the problem. The first task is to note the visible facts: time, system concerned, source of the report and actions already taken. Separate them from your hypotheses. An unusual connection alone does not allow you to describe a full attack or claim that data has been stolen.
A good note distinguishes "observed," "to be verified" and "not available." This simple classification helps another person take over your work without having to guess your reasoning. If a time is ambiguous, specify the known time zone or the uncertainty. If a log covers only part of the period, say so. You do not improve your result by hiding the limits of your data; on the contrary, you show that you know how to protect the quality of a conclusion.
In an application, this discipline can be reflected in a short example: you organized observations, identified missing information and passed on a summary to a supervisor. Explain your exact role and the limits of the exercise. Do not use "management of a real attack" for schoolwork. Educational experience deserves to be presented, but its context must remain visible. A recruiter can then understand what you actually learned.
Proposing an action without exceeding your authorization
In an urgent situation, the urge to fix everything immediately is understandable. However, a technical action can interrupt a service, erase a useful trace or affect users who are not concerned. In an exercise, get into the habit of writing down what you propose, why, what effect you expect and who must approve it. This is how you prepare a readable decision. You are not claiming that every situation requires the same treatment, because the environment, the risk and the procedures vary.
For the fictional test account scenario, you could request a verification of the activity and consult the planned escalation procedure. A reasonable proposal must mention the necessary information and the competent authority. A junior candidate does not have to invent a company procedure to impress. They can say that they would ask for instructions, document their observation and act within the scope entrusted to them. Professional responsibility also includes the ability to recognize that scope.
This rule applies to your personal preparation. Use only an environment that you own or for which you have explicit authorization. An exercise on fictional data can show your reasoning without targeting a third-party site. Do not attach screenshots containing credentials, private addresses or information from a former employer to an application. The skills you want to demonstrate do not require disclosing what has been entrusted to you.
Making communication useful to the team
The person reading your message does not necessarily have the same technical level as you. Prepare two versions of an exercise summary: a note intended for the technical team and a status update understandable by a business manager. The facts remain identical; the presentation changes. The first can detail the observed elements and the remaining verifications. The second explains what is affected, what the team knows and the next planned step, without piling up acronyms.
Avoid spectacular phrasing. "Everything is compromised" or "no risk" are strong conclusions that require solid evidence. In an exercise, a sentence like "we confirmed unusual activity on the test account; its origin remains to be verified" better situates the uncertainty. It is not less professional because it is cautious. It allows others to understand the situation and adjust their decisions to what is actually known.
You can explain this skill in an interview with a fictional example announced as such, then a school or internship experience if you have one. Present the recipient, the essential information and what you deliberately left out. The recruiter can then assess your ability to summarize. Writing a clear message does not replace technical knowledge; it makes its use more effective in collective work.
Preparing a deliverable that can be reviewed
A useful exercise record does not need to be voluminous. Start with a page that states the fictional context, your mission, the elements received and the limits. Add a short timeline, the open questions and the proposed decisions. End with what you would improve in the next session. This document shows your organization. It must allow an outside reader to distinguish your personal contribution from the group's work and observations from interpretations.
If you used a tool, explain what it was used for in this specific case. A screenshot of a dashboard does not automatically demonstrate analysis. Specify what you looked for, what information you retained and why it mattered. You can hide unnecessary data and replace examples with fictional values, indicating this adaptation. The goal is to make your approach understandable, not to reproduce a confidential environment.
Our professional portfolio guide helps you organize several achievements. Here, choose a case directly related to the target mission. A portfolio filled with unrelated work makes reading more difficult. Prefer a well-explained piece that you are able to comment on without reciting. Check that the link opens, that the file is readable and that you are authorized to share the elements it contains.
Adapting your CV without inventing professional maturity
On your CV, a cyber crisis exercise can appear under projects or education. Name the context, the period and your responsibility. A precise wording would be, if it matches your actual experience: "preparation of a timeline and a summary in an incident management exercise." It explains more than a line simply stating "cybersecurity expert." Do not reuse this example if you did not do this work; use it to find wording faithful to your own background.
For tools and languages, indicate a level you can demonstrate. Having taken an introductory course does not mean you can administer a production installation on your own. If you worked under supervision, this clarification does not diminish you: it situates your experience. The recruiter also wants to know what support will be needed. An honest application allows you to discuss this concretely, whereas an exaggerated list creates a gap from the very first questions.
Then reread your CV alongside the job posting. Do the most relevant elements appear quickly? Are your availability and contact details up to date? Does the document distinguish internships, projects and jobs? You can use CV submission on Jawb to complete your profile, then follow the specific procedures for each posting. Submitting a CV does not guarantee contact, but it allows you to present your information within the process provided by the site.
In an interview, also explain what you do not know
An interview may put you in front of a question whose answer is not immediately obvious. Take a moment to rephrase the problem and ask for the missing information. Explain what you would check first, what would make you change your hypothesis and when you would call on a colleague. This approach does not exempt you from answering technical questions; it gives the recruiter a glimpse of how you reason when the context is incomplete.
Prepare a presentation of your exercise in a few steps: situation, role, observations, proposed decision and lesson learned. Do not recount a collective success as if you had achieved everything alone. If a proposal turned out to be of little use, explain what allowed you to correct it. A precise learning experience can be more interesting than a story in which no difficulty exists. You do not have to invent a catastrophe or a feat to make your background worthy of attention.
Also question the employer. Who supervises the position? What procedures are available? How does onboarding work? What knowledge must be operational from day one? If particular working hours are mentioned, ask about their exact organization. These questions help you understand the reality of the work. They do not replace reading the contract, but they prevent reducing the decision to a flattering title or a list of known tools.
For recruiters, assessing a proportionate approach
An employer looking for a junior profile can offer a short fictional case, directly related to the tasks of the position. They must specify the available information, the expected time and the level of autonomy being assessed. Asking for a free real assignment or access to third-party systems is not necessary to observe the candidate's method. A prepared grid allows responses to be compared on consistent criteria: reading of facts, formulation of limits, priorities and clarity of the report.
The result deserves to be discussed, not just scored. Ask why the person retained a hypothesis and what they would want to verify next. Distinguish a misunderstanding, a missing piece of knowledge and an ambiguous instruction. A beginner may need training without being incapable of progressing. Conversely, a fluent presentation is not enough to demonstrate a technical skill. The assessment must retain its link to the real missions and the planned support.
A concrete preparation plan for your next application
Start by selecting a job posting and analyzing its missions. Then choose an authorized exercise, simple enough to be completed and explained. Prepare a fact note, a timeline, an escalation proposal and a short summary. Have the whole thing reviewed by someone who does not know the scenario. Their questions will show you where your document assumes too much knowledge or mixes an observation with a conclusion. Correct these points before attaching a document to your application.
Finally, keep a place for the fundamentals that the posting actually requires. Communication and decision-making exercises complement your learning of networks, systems or controls; they do not replace it. Make an honest assessment of what you can demonstrate today and what you want to learn in the position. In the search for a first job in cybersecurity in Morocco, this consistency between knowledge, method and discourse is a useful working base, without shortcuts or any guarantee of recruitment.
Original guide and analysis by the Jawb editorial team, October 2, 2026. The news references come from the EMSI institutional announcement and the strategy published by the DGSSI. The exercises described are fictional and constitute neither a company operational procedure nor an assessment of the event. The image is a generated illustration representing two fictional professionals at work.
