Starting a career in cybersecurity: roles, skills and certifications

The main areas of work

• Security operations: analysts in a security operations centre, often called a SOC, monitor alerts, investigate suspicious activity and escalate incidents. This is a common entry point.
• Incident response and digital forensics: investigating breaches, containing them and working out what happened.
• Penetration testing and offensive security: testing systems by attacking them with permission, then reporting weaknesses.
• Security engineering and architecture: designing and building secure systems, networks and cloud environments.
• Application security: helping developers write and test secure software.
• Governance, risk and compliance: policies, audits, risk assessments and standards. A good fit for people from legal, audit or management backgrounds.
• Threat intelligence: researching attackers and their methods.
• Security awareness and training: helping people avoid mistakes in the first place.

Skills that help in almost every role

• Networking fundamentals: how IP addresses, DNS, routing and common protocols work.
• Operating systems: comfortable use of Windows and Linux, including the command line.
• Some scripting, often in Python or PowerShell, to automate repetitive tasks.
• Cloud basics on at least one major platform, since so much now runs there.
• Clear writing: reports, incident notes and explanations for non-specialists are a large part of the job.
• Curiosity and patience: much of security is reading logs and asking why something looks wrong.

Certifications

• ISC2 Certified in Cybersecurity (CC) is an entry-level certification with no work experience requirement.
• CompTIA Security+ is a widely recognised entry-level certification covering core security concepts, with no formal prerequisites. CompTIA's Network+ and A+ cover networking and IT support foundations.
• ISC2 CISSP is a well-known senior certification. It requires several years of relevant paid work experience, so it is a later goal rather than a starting point.
• Practical penetration testing certifications, such as those from OffSec, and in the UK the CREST examinations, are respected for hands-on testing roles.
• Cloud provider security certifications suit people working with a particular platform.

Building experience without a security job

• Set up a home lab with virtual machines to practise safely. Never test systems you do not own or have written permission to test.
• Use legal practice platforms and capture-the-flag challenges designed for learning.
• Write up what you learn in a blog or a public notes repository. It shows employers how you think and communicate.
• Join local and online communities, attend meetups and conferences, and volunteer where possible.
• Look for security tasks in your current job, such as helping with access reviews, patching or phishing awareness.

Applying for roles

1. Target realistic first roles: SOC analyst, IT support with security duties, junior security engineer or GRC analyst.
2. Read job adverts carefully. Requirements lists are often a wish list; apply if you meet most of them.
3. Show practical evidence: lab projects, write-ups and certifications together make a stronger case than any one alone.
4. Prepare to explain how you would investigate an alert or how a common attack works, in plain language.
5. Look for graduate schemes and apprenticeships, which many employers and public bodies offer.

Keep learning