How to Start a Career in Cybersecurity

Step-by-Step Path to Entry

These steps assume you are starting with no IT job and no degree. If you already work in IT, start at step 2.

1. Learn networking and operating system fundamentals — about 3 to 6 months of part-time study. You need to be able to read a packet capture in Wireshark, explain what DNS and DHCP do, and navigate both Windows Event Viewer and a Linux shell. CompTIA recommends Network+ plus two years in a security or systems administrator role before attempting Security+, although there is no required prerequisite (CompTIA, 2023).
2. Pass CompTIA Security+ (SY0-701) — about 8 to 12 weeks of study. The exam has a maximum of 90 questions mixing multiple-choice and performance-based items, runs 90 minutes, and requires a score of 750 on a 100-900 scale (CompTIA, 2023). The current version carries 28 objectives instead of the previous 35, with more weight on cloud security, security automation, and hybrid environments (uCertify). Budget $425 for the voucher from CompTIA's official store (2025 pricing).
3. Decide your degree position — a decision you can make in a week, then 2 to 4 years to execute. BLS (2025) lists a bachelor's degree in computer and information technology or a related field such as engineering or math as typical, and O\*NET survey data puts 52.6% of working analysts at bachelor's level, with 12.9% holding an associate's degree and 7.2% a post-secondary certificate. An associate's degree with a transfer agreement into a four-year program is the cheaper sequence if cost is the constraint.
4. Build a documented home lab — 3 to 6 months, run alongside steps 2 and 3. Stand up a virtual machine lab, install a free-tier SIEM, generate your own alerts, and write short incident reports on what you found. Capture-the-flag events and vulnerability scans against your own machines with Nmap give you something specific to talk about in an interview instead of abstract claims about being detail-oriented.
5. Take an adjacent IT role — 2 to 4 months of applying, then 1 to 3 years in post. Help desk, NOC, or junior sysadmin work is where most analysts get their experience, and BLS (2025) says the occupation typically needs less than five years of experience in a related occupation. Volunteer for the security-adjacent tickets: MFA enrollment, account lockouts, phishing triage, patch deployment.
6. Apply for SOC analyst or security analyst openings — 3 to 6 months of searching. BLS (2025) lists no on-the-job training requirement for the occupation, meaning employers expect you to arrive able to work the alert queue. Projected growth for information security analysts between 2025 and 2035 is 21%, described as much faster than average (BLS, 2025).
7. Plan your senior credential early — 5 years of logged experience, then roughly 3 months of exam preparation. CISSP requires a minimum of five years cumulative, full-time experience across two or more of the eight domains in the current exam outline (ISC2). A bachelor's or master's degree in computer science, IT, or a related field can satisfy up to one year, and an additional ISC2-approved credential can satisfy another (ISC2). The exam costs $749 and allows up to 4 hours for 125-175 questions (UMBC Training Centers). Pass it without the experience and you become an Associate of ISC2, with up to six years to earn the five years required (CertVerdict, 2026).
8. Pick a specialism in year two or three of security work — ongoing. Employers also ask for credentials such as Certified Ethical Hacker, CompTIA Cybersecurity Analyst, CompTIA Advanced Security Practitioner, Network+, and GIAC Information Security Fundamentals (King University, citing BLS, 2025). Choose the one that matches the work you are already doing rather than collecting all of them.

Entry Requirements at a Glance

• Education — bachelor's degree in computer and information technology, or a related field such as engineering or math. This is the typical entry-level education for information security analysts (BLS, 2025), and some employers prefer an MBA in information systems for senior roles (CareerOneStop, U.S. Department of Labor).
• Minimum acceptable education in practice — a high school diploma plus relevant industry training and certifications. BLS (2025) notes some workers enter this way; O\*NET rates the preparation needed as medium (Job Zone), not the highest band.
• At least one security certification. Many employers prefer candidates who hold one, with some certifications aimed at entry-level workers and others built for experienced professionals (BLS, 2025). CompTIA Security+ is the common entry choice; there is no required prerequisite to sit it (CompTIA, 2023).
• Exam budget of at least $425. That is the Security+ voucher price from CompTIA's official store (2025 pricing), before any training material or a retake.
• Under 5 years of related work experience. BLS (2025) and CareerOneStop both describe entrants as typically holding a bachelor's degree and fewer than five years of experience in a related occupation.
• A background check, and for federal or defence contract work, security clearance eligibility. Clearance standards are set by the sponsoring agency, not by you or the employer, and the process can add months between a job offer and a start date. Rules differ by agency and by contract — ask the recruiter which level the role requires before you apply.
• Employment age set by your employer and state labor law — practically, 18 for full-time work. Certification bodies do not generally gate entry-level exams on age, but employers hiring for roles with system administrator privileges set their own floor.
• Demonstrable hands-on evidence. BLS (2025) lists no on-the-job training for the occupation, so a home lab write-up, a CTF placing, or a documented patch project is the substitute for formal training nobody will give you.
• Tolerance for shift or on-call cover. Security operations centres in many organisations run 24/7; whether you work nights depends on the employer and whether the role is in-house or at a managed service provider.

Comparing Entry Routes

All three converge on the same experience requirement. The degree route costs the most and takes the longest but matches what BLS (2025) lists as typical, and it also shaves up to one year off the five-year CISSP experience requirement later (ISC2). The certification pivot is the fastest, but only works if you already hold, or can get, an IT job that touches systems or networks.