I spent eight months trying to break into cybersecurity after a career in IT support. I read every “how to get into cyber” article I could find, bought four courses, and passed two certifications before landing my first security role. What I wish I’d known earlier: most of the advice online is written for people who are already in tech, dramatically understates how competitive the entry-level market actually is, and overestimates how much a certification alone will move the needle. This guide is an attempt to give a more accurate picture.
Quick Answer:
- Cybersecurity in 2026 is genuinely in demand but genuinely competitive at entry level — the “skills gap” is real at the mid-to-senior level, not at the entry level, where too many people are chasing too few roles that all want “entry-level candidates with 2-3 years of experience”
- The path that consistently works is: foundational IT knowledge first (networking, operating systems, basic scripting) → one or two certifications → a home lab with documented projects → applying aggressively with a specific role in mind rather than “cybersecurity” generically
- Salaries are strong but vary enormously by role type, location, and whether you’re in a regulated industry — entry-level SOC analyst in a mid-market city looks very different from a cloud security engineer at a tech company
The Honest State of the Entry-Level Market
The narrative you hear most often: there are 3.5 million unfilled cybersecurity jobs globally, companies are desperate, get your Security+ and you’ll have offers in weeks.
The reality in 2026: the unfilled jobs are almost entirely at the mid-to-senior level. Security architects, cloud security engineers, red teamers with five or more years of experience, threat intelligence analysts who can actually write a coherent threat report — those roles are hard to fill and employers know it. Entry-level SOC analyst roles, on the other hand, routinely receive hundreds of applications and often require one to two years of IT experience plus certifications just to get an interview.
This isn’t a reason to avoid the field. It’s a reason to understand what you’re actually competing for and what the realistic timeline looks like. Most people who enter through a structured path — IT support or sysadmin work first, then transition into security — get their first security role in one to two years. Most people who try to enter cybersecurity directly from an unrelated background without foundational IT experience take longer, sometimes significantly longer, regardless of how many certifications they collect.
(Based on job posting analysis, community data from Reddit’s r/cybersecurity and r/netsec, and hiring manager perspectives shared at security conferences in 2025-2026)
The Foundation: What You Actually Need to Know First
Cybersecurity is applied IT. You can’t secure what you don’t understand, and the people making hiring decisions know immediately whether a candidate understands the underlying technology or is just pattern-matching security concepts they’ve memorized for certifications.
Networking is non-negotiable. TCP/IP, DNS, HTTP/HTTPS, firewalls, VPNs, the OSI model, how packets actually move between systems — not at a trivia level, but at a “I can look at a packet capture and understand what’s happening” level. The CompTIA Network+ is a reasonable baseline, but more important is actually using Wireshark and actually setting up a small network in a home lab.
Operating systems — both Windows and Linux — matter more than most entry-level guidance suggests. In a SOC role, you’re reading Windows event logs, investigating process trees, looking at file system changes. In any defensive role, you’re working in Linux environments constantly. Being able to navigate a Linux command line, understand file permissions, and write basic bash scripts isn’t optional anymore.
Programming and scripting — you don’t need to be a developer. You do need to be able to read Python and PowerShell, write basic automation scripts, and understand what a piece of code does well enough to identify something suspicious. The Automate the Boring Stuff with Python resources are free and sufficient for building this foundation.
Certifications: Which Ones Actually Matter
The certification landscape is crowded and vendors have strong financial incentives to make their certifications seem essential. Here’s a clearer picture of what the market actually values.
CompTIA Security+ — the de facto entry-level baseline for many employers, particularly government contractors and regulated industries where DoD 8570 compliance applies. It’s broad rather than deep, and hiring managers know this. Having it checks a box; not having it can eliminate you from consideration for specific roles. Worth getting as a first certification, not as a final destination.
CompTIA CySA+ — a better signal of practical analytical ability than Security+, focused on threat detection and response. More relevant to SOC analyst roles specifically.
Certified Ethical Hacker (CEH) — widely marketed, less respected by practitioners than its name recognition would suggest. The EC-Council’s reputation in the security community is mixed. If your goal is penetration testing, OSCP (Offensive Security Certified Professional) is dramatically more respected but significantly harder and more expensive.
OSCP — the gold standard for offensive security roles. It’s performance-based (you actually have to compromise a network of machines in an exam environment), which is why security hiring managers take it seriously in a way they don’t take most multiple-choice certifications. Not the right starting point, but the right target if penetration testing is your goal.
Cloud security certifications (AWS Security Specialty, Azure Security Engineer Associate, Google Professional Cloud Security Engineer) — increasingly important as organizations move infrastructure to cloud. These pair well with general security knowledge and open doors to some of the highest-paying roles in the field. If you have existing cloud experience, adding the security specialty certification is one of the highest-ROI moves available.
For an honest assessment of how hard the Security+ actually is to pass and what studying for it realistically involves, how hard is CompTIA Security+ an honest assessment for 2026 covers the exam from the perspective of someone who’s actually taken it.
Building a Home Lab: The Thing That Actually Differentiates Candidates
Certifications prove you’ve studied. A home lab proves you’ve actually done it.
The bar for a useful home lab is lower than most guides suggest. You don’t need expensive hardware. A laptop with 16GB of RAM running VirtualBox or VMware Workstation Player can host enough virtual machines to do genuinely useful security work.
Minimum viable home lab:
- A Windows Server VM (Microsoft offers free evaluation versions)
- A Kali Linux VM for offensive tools
- An intentionally vulnerable target like Metasploitable or DVWA (Damn Vulnerable Web Application)
- A pfSense VM to simulate a firewall
What to actually do in it:
- Set up Active Directory on the Windows Server and then attack it — this teaches you both the defensive and offensive side of one of the most common enterprise environments
- Run network scans with nmap, capture and analyze traffic with Wireshark, try basic exploitation against the vulnerable targets
- Configure logging, forward logs to a SIEM (Splunk has a free version for home lab use), and write basic detection rules
- Document everything with screenshots and write-ups as if you’re explaining it to someone else
That documentation becomes your portfolio. Entry-level cybersecurity candidates with a GitHub repository of home lab write-ups and TryHackMe or HackTheBox completions consistently report getting more interviews than candidates with the same certifications but no demonstrable work.
Which Roles to Target at Entry Level
“Cybersecurity” encompasses roles so different from each other that treating it as one career path is misleading. Targeting a specific role type from the start shapes what you study, what certifications matter, and who you’re competing against.
SOC Analyst (Tier 1) — the most common entry point. You’re monitoring alerts, triaging potential incidents, escalating to higher tiers. The work is repetitive at Tier 1 and heavily tool-dependent. Good for learning a lot quickly about how real environments work; burning out in 18-24 months is common. The upside is that SOC experience opens doors to almost every other security role.
GRC (Governance, Risk, and Compliance) — underrated entry path, significantly less competitive than SOC roles, and well-suited to people transitioning from non-technical backgrounds who can combine risk analysis with communication skills. The certifications that matter here are CISA (Certified Information Systems Auditor) and eventually CISSP, not offensive tools.
Penetration Testing — the role most people think they want when they say “cybersecurity.” Also the most competitive at entry level and the one where hiring managers most consistently care about demonstrated skill over certifications. Bug bounty programs on platforms like HackerOne and Bugcrowd provide a legitimate path to building a demonstrable track record before your first job.
Cloud Security — high demand, lower competition than traditional security roles because the candidate pool is smaller. Requires cloud infrastructure knowledge on top of security knowledge, which raises the learning curve but also raises the salary ceiling. This is the fastest-growing segment of the market.
Threat Intelligence — needs analytical writing skills, research ability, and often language skills in addition to technical knowledge. Less saturated than SOC roles. The work involves tracking threat actor groups, analyzing malware, and producing reports that are actually readable by non-technical leadership.
Salary Reality in 2026
Salary ranges in cybersecurity are wide enough that specific numbers are more misleading than helpful without context. What matters more than a single number:
Role type matters more than title. A “cybersecurity analyst” at a financial services firm doing compliance work and a “cybersecurity analyst” at a tech company doing cloud detection engineering can have $40,000-$60,000 salary differences at the same experience level.
Location still matters significantly despite remote work. Fully remote senior security roles at companies headquartered in San Francisco or New York pay more than equivalent roles at regional companies in smaller markets, even if you’re doing the same work from the same desk. The “remote work equalizes salaries” narrative is not consistent with actual compensation data.
Regulated industries pay a premium. Financial services, healthcare, and defense contractors pay more for security talent than retail or hospitality at equivalent experience levels. The regulatory pressure they face (SOX, HIPAA, CMMC) makes security spending less discretionary and security talent more valued.
Government vs. private sector. Federal government security roles typically pay less than equivalent private sector roles but offer more job stability and sometimes better benefits. Government contractors (supporting federal agencies) often pay private-sector salaries while doing government-adjacent work.
For current salary ranges by specific role type, the cyber security salary calculator pulls current compensation data by role and location — more useful than static numbers that go out of date within a year.
The Degree Question
The cybersecurity field has a genuine split on whether a degree is necessary. The honest answer is: it depends heavily on what kind of role you’re targeting.
Government and defense contractor roles frequently require a degree as part of security clearance processes, and many federal job postings explicitly list degree requirements that aren’t negotiable. For those career paths, a degree in computer science, information systems, or cybersecurity is often a practical necessity.
Private sector tech companies and startups care significantly less about degrees and significantly more about demonstrated skill. The FAANG-tier companies and security-forward tech companies hire extensively from bootcamp graduates, self-taught practitioners with strong portfolios, and career changers with relevant experience — all without degrees.
The middle ground — mid-market companies in regulated industries — is inconsistent. Some treat degree requirements as hard filters; others explicitly list preferred but not required.
For a detailed analysis of whether a cybersecurity degree makes financial and practical sense given your specific situation, is a cybersecurity degree worth it works through the ROI calculation and alternatives.
The AI Factor: What’s Actually Changing
AI is changing cybersecurity work in ways that affect career strategy. The honest assessment is more nuanced than either “AI will replace security jobs” or “AI will create unlimited demand for security professionals.”
What AI is actually doing: automating Tier 1 SOC triage, writing better phishing emails that are harder to detect, accelerating malware development, and improving vulnerability scanning. The net effect is that purely reactive, alert-triage work at the lowest tier is becoming more automated. Analytical work — understanding why something is suspicious, assessing risk in context, communicating findings to leadership — is not being automated.
This means the Tier 1 SOC path that’s currently the most common entry point may become narrower over the next three to five years, while analytical, cloud, and adversarial roles remain in demand. For a longer-form look at how AI is reshaping the security job market specifically, will AI replace cybersecurity jobs covers which roles are most and least exposed.
A Realistic 12-Month Timeline
Months 1-3: Build networking and Linux fundamentals. CompTIA Network+ if you don’t already have it. Set up a basic home lab. Start TryHackMe’s free learning paths.
Months 4-6: Study for and pass CompTIA Security+. Continue home lab work. Pick a specific role type and start tailoring your path toward it.
Months 7-9: Deeper specialization based on role target. SOC path: SIEM practice, log analysis, alert triage simulations. Cloud path: AWS or Azure associate certification. Pentesting path: HackTheBox machines, start building toward OSCP prerequisites.
Months 10-12: Build and document portfolio. Network actively on LinkedIn with security practitioners and hiring managers. Apply aggressively with a specific role type in mind. Apply to 5-10 roles per week minimum — the pipeline is a numbers game at this stage.
This timeline assumes 8-10 hours per week of dedicated study and practice. Full-time study compresses it significantly. Starting from zero IT knowledge extends it.
FAQ
Do I need to know how to code to work in cybersecurity? You need to be able to read and write basic scripts, not build applications. Python and PowerShell are the most useful. The ability to look at a script and understand what it does — not write production code — is the realistic bar for most security roles.
Is cybersecurity a good career for people who hate sitting at a desk? Most cybersecurity work is desk work. Penetration testers occasionally do physical security assessments. Incident responders sometimes work on-site during major breaches. But the day-to-day for most security roles is screen, terminal, and meetings. If that sounds unappealing, it’s worth considering before investing heavily in the career pivot.
How important is networking (the people kind)? More important than most guides acknowledge. The security community is relatively tight-knit. Many roles are filled through referrals before they’re publicly posted. BSides conferences (affordable regional security conferences) are genuine career-accelerants in a way that online networking isn’t.
Can I get a cybersecurity job without experience? Rarely at pure security roles. More commonly through IT support or sysadmin roles that involve some security responsibility, then transitioning. The “get certified, get hired” pipeline is real but slow and requires significantly more applications than the certification marketing suggests.
Conclusion
Breaking into cybersecurity in 2026 is genuinely achievable but takes longer and requires more deliberate sequencing than the certification industry’s marketing suggests. The candidates who get hired fastest are the ones who build real foundational IT knowledge before layering security on top, who have documented home lab work that demonstrates they’ve actually used the tools, and who target a specific role type rather than applying generically to “cybersecurity.” The market is real, the salaries are strong, and the work is genuinely interesting — but the path is a marathon with a well-marked route, not a sprint to a certification exam.
