Safety Center

Cybersecurity Careers: Start With No Experience

You can start a cybersecurity career with no experience, but not overnight and not by buying one course. This guide gives you the honest roadmap: which roles are truly entry-level, how long each step usually takes, what entry pay looks like compared with the famous median, and what to do first.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Cybersecurity Salary Reality Checker

The honest starting point

Cybersecurity is a real career path, and it is also one of the most over-promised fields on the internet. Course adverts show a single salary figure and a short timeline, and they rarely say which jobs those figures describe. The first thing to understand is the difference between the field and the first job. The field is large and well paid at senior level. The first job is usually a junior, shift-based, process-driven role — and that is a good thing, because it is where you learn how real security work actually happens.

This guide is neutral: it sells nothing, recommends no course, and links to the primary sources — the US Bureau of Labor Statistics, the NIST NICE Framework and CISA's NICCS career resources — so you can check every claim yourself. Where figures conflict across sources, this page says so and gives the vintage, because a salary or timeline without a date is not a fact you can plan on.

What cybersecurity work actually is

At its core, cybersecurity is protecting systems, networks and data from unauthorised access, damage and theft. In practice that breaks into several families of work. Defensive work (often called blue team) means monitoring systems, investigating alerts, hardening machines and responding to incidents. Offensive work (red team) means testing systems for weaknesses with permission, so they can be fixed before an attacker finds them. Governance work means risk, policy, audit and compliance — the paperwork that makes security repeatable. And research work means finding and explaining new weaknesses responsibly.

Beginners rarely start in research or offensive testing. They start where the volume of work is: watching alerts, checking logs, resetting credentials after a phishing report, and writing clear notes about what they found. That work is unglamorous and it is the foundation of everything else. If you enjoy detective work — following a trail in logs, ruling things out, documenting evidence — you will enjoy the junior roles. If you only enjoy the idea of hacking, you will struggle, because most security work is careful, documented, routine investigation.

The realistic entry routes

There are four common routes in, and the best one depends on where you are starting from. First, the help-desk route: take an IT support or help-desk job, learn networking and Windows administration on the job, study security in the evenings, and apply for junior SOC roles after a year or so. This is the most travelled route, and employers trust it because you have already worked with real users and real systems.

Second, the career-changer route by background. Developers move toward application security; network engineers move toward network security; people from non-technical backgrounds often move toward governance, risk and compliance, or toward open-source intelligence (OSINT) and threat intelligence, where research and writing skills matter as much as technical depth. Third, the education route: a degree or a structured training programme, combined with labs. Fourth, self-study plus a portfolio: possible, but it demands the most discipline, because you must create your own proof of skill.

No route is a shortcut. Hiring managers in the field consistently say the same thing in different words: they want evidence you can do the work, not a list of courses you watched. That evidence can be a home lab, a documented investigation, a write-up of a practice incident, or a contribution to an open project. The companion guide on building a cybersecurity portfolio with no experience shows exactly what that proof looks like and what must never go in it.

Roles you can realistically aim for first

SOC analyst (Tier 1): the most realistic first security role. You monitor alerts, triage them, escalate real incidents and document everything. Shift work is common, including nights and weekends.
IT support / help desk with a security tilt: not a security title, but the most common stepping stone. You learn the systems you will later protect.
Junior security operations / security administrator: patching, account administration, firewall rule changes under supervision — the operational side of defence.
Governance, risk and compliance (GRC) analyst: a good fit for careful writers and organisers. Less hands-on technical work, more policy, audit and risk assessment.
Threat intelligence or OSINT junior roles: rarer at entry level, but reachable with a strong public portfolio of researched, sourced analysis. See our OSINT roadmap.

Roles that are usually not entry-level include penetration tester, incident-response lead, security architect and malware reverse engineer. They are real destinations — the penetration testing guide explains why — but applying for them with no experience is the most common beginner mistake, and it wastes months.

How long it really takes

Published guides disagree, and the disagreement is informative. Some guides describe around 6 months for a committed beginner following a focused plan; others describe 12–24 months for a full career change, and 18 months sits in the middle of that range. None of these is wrong and none is a promise: the difference is hours per week, starting knowledge, and whether you already work in IT.

A realistic planning frame is this. With 10–15 focused hours a week and no IT background, expect roughly a year before you are competitive for a junior SOC or help-desk role, and longer before a dedicated security title. With an IT background, or 20+ hours a week, that can compress substantially. With only a few hours a week, it stretches. What matters is not the calendar but the exit criteria: can you read a log and explain what happened, triage a practice alert with a written verdict, and explain networking fundamentals in an interview without notes? When the answer is yes, you are ready to apply.

A note on timelines. Any source that promises a specific job in a specific number of months is selling something. Use timelines as planning ranges, and judge yourself against skills you can demonstrate, not months that have passed.

Pay: the entry split that matters most

This is where beginners are most often misled, so read it carefully. The US Bureau of Labor Statistics (BLS) reported a median annual wage of $129,180 for information security analysts in May 2025, with projected growth of 21% from 2025 to 2035. An earlier BLS vintage reported $124,910 in May 2024 with 29% projected growth from 2024 to 2034. These are different vintages, not errors — always check which year a figure comes from.

That median describes the whole occupation: experienced analysts, engineers and architects. It is not entry-level pay. Entry-level SOC Tier 1 roles are commonly described in published guides in ranges around $50,000–$85,000 a year in the United States, with individual guides citing narrower bands inside that range (for example $50,000–$70,000, $55,000–$85,000 and $60,000–$80,000). Pay varies sharply by country, city, employer and shift pattern, and non-US figures are lower in many markets. Last checked: 14 November 2026.

The practical lesson: if a course promises the median salary in six months, it is quoting the wrong number for the wrong job. Plan your finances on entry-level pay, and treat the median as what the occupation pays once you have several years of experience. That is still a good outcome — it is just not the starting line.

Skills to build, in order

Networking fundamentals: IP addresses, DNS, ports, TCP vs UDP, what a firewall does, how a request travels. This is the single highest-value foundation.
Operating systems: Windows administration and Linux on the command line. Learn to read logs on both.
Security concepts: the CIA triad (confidentiality, integrity, availability), authentication vs authorisation, common attack types at concept level, and the MITRE ATT&CK framework as a map — see MITRE ATT&CK explained.
Hands-on investigation: triage practice alerts, analyse logs, write incident notes. The SOC analyst guide walks through a typical shift.
Communication: clear written reports. Hiring managers repeatedly call report writing the most underestimated skill in the field.

You do not need to learn programming to start, but basic scripting (for example Python or PowerShell) becomes valuable quickly: it lets you automate repetitive checks and parse logs. You also do not need to learn every tool. Employers would rather see deep comfort with a few tools — a SIEM interface, a packet capture, a Linux terminal — than a shallow list of twenty.

Certifications: useful, not magic

One entry-level certification helps your CV get read; a wall of them does not. The common first choice is CompTIA Security+, a broad entry-level certification. After that, the right next step depends on your direction: network-focused, cloud-focused, or governance-focused paths diverge quickly. Fees and exam versions change — Security+ fees have been reported differently across sources, so this site does not publish a fee. Check the current fee on the CompTIA website before booking. The full comparison, with issuer-primary sourcing and date-stamping, is in our certifications guide. Last checked: 14 November 2026.

Your first 90 days

Weeks 1–4: networking and operating-system basics, one hour a day, with notes you write yourself. Weeks 5–8: security concepts plus a home lab — a virtual machine, some log files to analyse, and your first written investigation. Weeks 9–12: a first documented project for your portfolio, a practice alert triage, and applications for help-desk and junior SOC roles. Throughout: read disclosed vulnerability reports and threat write-ups, and practise explaining them in plain English. If you can explain a vulnerability to a non-technical friend, you understand it.

Avoid the two classic traps. First, collecting certificates without ever doing the work — employers can tell in an interview. Second, practising on live systems without permission. Never scan, test or probe a system you do not own or have written permission to test. That is not a learning method; it is unlawful in many countries, and it will end a career before it starts. All practice belongs in labs, capture-the-flag platforms and authorised programmes — see security research for beginners for the legal-first rules.

Where to go next

If you want the day-to-day picture, read the SOC analyst guide next. If you are drawn to testing, read the penetration-testing guide — and take its destination-role warning seriously. If research appeals to you, the bug-bounty and OSINT guides show the legal-first paths. And whatever direction you choose, start the portfolio now: your first documented lab project is worth more than your tenth saved tutorial.

Sources

Last checked: 14 November 2026

Frequently asked questions

Can you start a cybersecurity career with no experience?

Yes. Most people enter through an adjacent role — IT support, help desk, networking or systems administration — and move into a junior security role from there. Direct entry into a security role is possible but rarer, and it usually takes a portfolio of hands-on lab work to prove your skills.

How long does it take to get a cybersecurity job?

It depends on your starting point and hours per week. Published guides give a wide range, from around 6 months for a committed beginner with a focused plan to 12–24 months for a full career change. Treat any single number as a claim, not a promise.

Do you need a degree to work in cybersecurity?

No degree is required for many entry-level roles, and employers increasingly hire on demonstrated skill. A degree can help, especially for some government or large-employer roles, but a strong lab portfolio, a first certification and help-desk experience are a proven route without one.

What salary should a beginner expect?

Expect entry-level pay, not the headline median. The US Bureau of Labor Statistics reported a median of $129,180 for information security analysts in May 2025, but that figure covers experienced analysts, engineers and architects. Entry-level SOC roles are commonly advertised in a much lower range — see the pay section below for the sourced ranges.

Which cybersecurity role should I aim for first?

For most beginners, SOC analyst (Tier 1) is the most realistic first security role. It teaches triage, logging and incident handling. Penetration testing is a destination role: employers usually want several years of adjacent experience first.

What should I learn first?

Networking, operating systems (Windows and Linux), and basic security concepts — in that order. Then add hands-on labs: analyse logs, triage practice alerts, and document what you did. One documented project beats ten certificates listed without proof.