Find your next cyber security job — and the path to get there.

Not universally. The BLS lists a bachelor’s degree as the typical entry-level education for information security analysts, and many large employers and federal contractors still filter on it. But a large share of practitioners came in through IT support, networking, the military, or self-study plus a certification. If you do not have a degree, the substitute is demonstrable skill: a home lab, a public write-up portfolio, a relevant certification, and adjacent experience like help desk or sysadmin work.

For most career changers it is 9–18 months: build core IT and networking fundamentals, earn CompTIA Security+ (or ISC2 CC first if budget is tight), run a home lab you can talk about in detail, then target SOC analyst, IT support with security duties, or GRC analyst roles. Anyone promising a six-figure security job in eight weeks with no IT background is selling something. Our getting started roadmap lays out the whole sequence.

Both things are true at once. ISC2’s 2025 study found hiring freezes flat at 39% and layoffs affecting 24% of organisations — conditions stabilised rather than improved. At the same time the BLS projects 21% growth for information security analysts from 2025 to 2035, far above the average occupation. The practical read: entry-level is competitive and unglamorous, mid-level specialists with cloud, identity or detection engineering skills are in genuine demand.

CompTIA Security+ is the default first certification for most people — it is vendor-neutral, widely recognised by HR filters, and satisfies US DoD 8140 baseline requirements for several job categories. If cost is the blocker, ISC2’s Certified in Cybersecurity (CC) is a cheaper entry point. Save CISSP for when you have the five years of experience it requires; taking it early only earns you Associate status. Full breakdown on the certifications page.

It is possible but it is the hard mode. Remote-first security roles skew mid to senior, because juniors need supervision, shadowing and access to physical environments. Many SOC roles are shift-based and on-site or hybrid by design. A pragmatic plan: take a hybrid or on-site first role, build two years of real incident experience, then move remote where the market is genuinely open.

Only for US federal, defence and intelligence work — but in those markets it is decisive, and an active clearance commands a meaningful premium because employers avoid a months-long sponsorship process. You cannot get one on your own; a sponsoring employer or the military must initiate it. If you are near a defence hub, targeting a cleared-adjacent employer who sponsors is a legitimate career strategy.