How to get into cybersecurity (2026): the doors in, measured on open postings

What hiring companies ask of a newcomer, measured on the security roles open right now, and a route from the job you hold today to a first offer.

On 11 November 2026 this board read 2,144 open security postings straight from the careers systems of 296 employers. Only 62 of them had a title that marks a starting rung: junior, associate, tier 1, intern, apprentice or graduate. That is fewer than three in every hundred. Every other posting was written for someone who has already done security work, or the work right next to it, somewhere else. Anyone asking how to get into cybersecurity should begin with that ratio, because it resolves a contradiction that confuses most newcomers: the field keeps growing and keeps reporting a shortage of skills, yet the first security job is famously hard to land.

The growth is real. The US Bureau of Labor Statistics expects employment of information security analysts to rise 21% between 2025 and 2035, with about 14,100 openings in an average year, and it put the median pay for the occupation at $129,180 in 2025 - BLS Occupational Outlook Handbook. What the headline leaves out is who fills those openings. When ISC2 asked 929 hiring managers in six countries whom they would consider for an entry-level security seat, 90% said they would take a candidate whose only background was IT work, and 89% a candidate whose only credential was an entry-level security certification; both ranked ahead of candidates who had only a relevant degree - ISC2 2025 hiring trends study. In practice, the way into security usually runs through the job beside it, and picking that neighbouring job well is most of the strategy.

This guide is built on that evidence. Figures about the postings come from this board's own pages, which re-read every employer each hour. Each is dated to 11 November 2026 and links to the page where today's number lives, and the counts a page can read live (how many roles of a kind are open, for one) are read again whenever you load this guide. Figures from outside the board are cited to the page that states them.

Contents

1. The route on one page
2. What today's open postings say about the field
3. Why security rarely hires beginners, and where it does
4. The doors in, by the job you hold now
5. The skills a first interview tests
6. Certifications: what postings name, and which to sit first
7. Degrees, bootcamps and teaching yourself
8. What the first job pays, and how pay climbs
9. Remote work, shifts and location
10. Government work, clearances and DoD 8140
11. Students: internships and graduate roles
12. What AI changes about the first security job
13. A twelve-month plan
14. Applying: reading postings, showing proof, spotting fake offers
15. Questions people ask before they start

1. The route on one page

If you want the route before the reasoning, here it is. Most people who break in follow some version of these five moves, whether or not they ever wrote them down.

1. Start from a neighbouring job. IT support, systems or network administration, software development, cloud engineering, audit and compliance each lead to a particular kind of security seat. If you hold none of them, an IT support job is the most reliable first step.
2. Learn four foundations to working depth: how networks move data, how Windows and Linux run processes and accounts, how to search logs, and enough of one scripting language to automate a dull task.
3. Sit one certification that postings for your target seat actually name. For a security operations or general analyst seat that is usually CompTIA Security+. Leave the certifications that require five years of experience for later, since none of them can be fully awarded before you have the years.
4. Build proof you can hand over: a small lab, two or three written investigations, and a public repository with scripts or detection rules.
5. Apply where juniors are trained: SOC analyst and associate engineer seats, managed security providers, consultancies, defense contractors, and the graduate programs of large employers.

How long this takes depends mostly on the first move. This board's guide to security operations puts the usual time to a first SOC seat at 6 to 18 months, shorter for someone already working a help desk or running servers. Someone with no technical job at all should plan on two stages, an IT role first and the security move second. Skipping the first stage is possible, and later sections show where it works, but with fewer than 3% of postings written for beginners it is the harder road.

The rest of this guide explains why each move matters, what the postings say about it, and how to do it well.

2. What today's open postings say about the field

The board sorts every open role it reads into ten kinds of security work. The chart counts each kind as the board stands at the moment you open this page, so the bars move as employers open and close roles.

When this guide was written, security engineering was the largest kind by a wide margin, with 615 open roles or about 29% of the board. Security operations and incident response came second with 308, followed by security leadership (236), governance, risk and compliance (215) and application security (209). Penetration testing and red teaming, the work most people imagine when they think of a career in hacking, held 93 roles, a little over 4%. That proportion should shape a beginner's plan more than any course brochure. Most security employment is building and running defenses and proving to auditors, customers and boards that those defenses work. Offensive work is a small specialty, and it mostly recruits people who spent time on the defensive or engineering side first.

The postings also say who they are looking for. The SOC and incident response salary page groups postings by the level word in their titles. On 11 November, 130 operations roles stated a salary: 80 of them were senior, staff, principal, lead or manager seats, 42 carried no level word, and only 8 were intern or junior seats. The equivalent GRC salary table had no intern or junior row with a stated salary at all. The board's own note on those tables is worth keeping in mind when you read a posting: a title with no level word is usually a mid-level seat, not a beginner's one.

The 62 roles that did mark a starting rung were spread across 41 employers. By specialty, security engineering had the most (23), then security operations (17), GRC and threat intelligence (5 each), application security and penetration testing (4 each), cloud security (2), and identity and access management and security architecture (1 each). The entry-level roles page lists them as they stand today, each checked against the employer's careers system on every read, with a line on what the first job in each specialty usually involves.

One caution about the money figures that follow. The board reads employers that publish their openings through modern applicant tracking systems (Greenhouse, Ashby, Lever, Workday and a few others), which tilts it toward software companies, security vendors, cloud providers and well-funded startups. Those employers pay well above the economy-wide figures, and only about half of the roles on the board (1,048 of 2,144 on 11 November) print a salary range at all. So the board's pay figures describe what this part of the market offers to the roles that state pay, not every security job in the country. Where the difference matters, this guide sets the board's figure beside the government's.

3. Why security rarely hires beginners, and where it does

The scarcity of junior seats is not an accident of fashion. It follows from what security work actually is.

Strip away the tools and almost every security job comes down to one judgment made over and over: is what this system is doing expected, or is it hostile? An analyst looks at a sign-in from an unusual country and decides. An engineer looks at a firewall rule and decides whether it opens more than the business needs. A GRC analyst looks at an access review and decides whether the people who can reach the payroll system should be able to. In each case, spotting the abnormal requires a detailed picture of the normal: how a healthy Windows laptop behaves, what a routine change ticket looks like, which accounts a finance team ordinarily touches. That picture comes from having run systems, which is why the job beside security is such a strong predictor of who gets hired into it.

The second force is the cost of a wrong call. If a junior support technician closes a ticket too early, a user reopens it. If a junior analyst closes a real intrusion as a false positive, an attacker may sit inside the network for weeks. Managers buy down that risk by hiring people who have already seen what normal looks like, or by surrounding a beginner with enough structure and review to catch mistakes. That structure costs money. Among the hiring managers ISC2 surveyed, 56% said a new entry-level hire typically takes four to nine months to work independently, and 45% said they spend between $1,000 and $4,999 training each one - ISC2 2025 hiring trends study. A junior hire is an investment that pays back only after several months.

From those two forces you can predict where junior seats exist, and the postings bear the prediction out. Beginners are hired where the training structure already exists and the work comes in volume:

• Managed detection and response providers and large in-house SOCs, which run around the clock, have shift leads to review a junior's calls, and need people on every shift. An associate SOC analyst role at Expel, for example, was open on 11 November with a stated range of $85,000 to $90,000 a year, remote.
• Security vendors that run their own operations and professional services teams. Palo Alto Networks, CrowdStrike and Tanium all had junior or intern security seats open the same day.
• Defense and aerospace companies, which recruit in cohorts and can sponsor clearances. Rocket Lab had six junior or intern security seats open, SpaceX and Thales four each, and Anduril Industries a new-grad security engineering role.
• Consultancies and resellers such as GuidePoint Security, which had two junior seats open, and where associates learn on client engagements.

Notice who is missing from that list: the small company with a security team of two. It may badly need help, but it has nobody free to teach a beginner, so its postings tend to ask for years of experience even when the work itself is routine.

That same survey also shows why the postings can look impossible. About a third of the hiring managers said they expect the CISSP for entry-level (34%) and junior (33%) hires, and 38% said they require the CISA for entry-level positions, even though both certifications need five years of professional experience before they can be awarded - ISC2 2025 hiring trends study. A requirements list is partly a wish list. When you meet the core of a junior posting (the foundations, one relevant certification or equivalent experience, and evidence you can do the work), apply even if you miss some of the extras.

Finally, the shortage and the hard job market are not two competing stories. ISC2's 2025 workforce study, which surveyed 16,029 practitioners, found that 88% of respondents' organizations had suffered at least one significant security consequence in the past year because of a skills shortage. In the same study, respondents at large organizations reported hiring freezes (49%), budget cuts (46%) and layoffs (32%) - ISC2 2025 Cybersecurity Workforce Study. Both can be true at once. Teams are short of people who can already do the work, while budgets in a given year decide whether they can afford to train someone who cannot yet. The shortage is mostly a shortage of experience, and your plan should be about acquiring experience as fast as possible, inside or beside security.

4. The doors in, by the job you hold now

Every first security job is reached from somewhere. The table maps the usual starting points to the security seat each one leads to and the part of your current work that carries over. The sections under it go through each door in turn.

From IT support or the help desk

This is the most common door, and for good reason. A support technician spends every day resetting passwords, reimaging laptops, chasing printer faults and answering tickets about why someone cannot reach a shared drive. All of it builds the picture of normal that SOC triage depends on. When ISC2's hiring managers filled security seats from inside their own organizations, most recruited from IT (85%) and from help desk and technical support (68%) - ISC2 2025 hiring trends study.

Support work is also a large field, and many of its roles ask for some college or an associate's degree rather than a bachelor's. The BLS counted 903,100 computer support specialist jobs in 2025, with a median pay of $62,890, and although it expects that occupation to shrink 3% by 2035, it still projects about 48,700 openings a year as people retire or change careers - BLS Occupational Outlook Handbook. That is more than three times the yearly openings it projects for information security analysts, which is exactly why the support desk works as a waiting room for security.

To use this door well, volunteer for the security-adjacent tickets: phishing reports, account lockouts, endpoint agent alerts, access requests. Ask to shadow whoever handles the security tooling. When a junior SOC or IAM role opens internally, you will be the candidate who already knows the environment, which is often worth more to the hiring manager than any certificate.

From systems or network administration

Administrators already do half of security engineering without the title. They patch, configure logging, manage group policies, set firewall rules and own the backup that saves the company after ransomware. The BLS put the median pay of network and computer systems administrators at $99,130 in 2025, and it expects the occupation to shrink 4% by 2035 - BLS Occupational Outlook Handbook. Set beside the $129,180 median for security analysts and the 21% growth projected for them, the move is as much about the direction of the work as about the pay.

The usual targets are security engineer seats that run endpoint, network and logging tools, and SOC seats at companies that value deep platform knowledge. On 11 November the junior security engineering roles that stated pay offered a typical $103,000 to $166,000 a year, well above the junior operations band; the board describes those seats as usually filled after a few years in IT or software. If you administer cloud accounts, cloud security is the natural next step; read the cloud security guide before you decide.

From software development or cloud engineering

Developers rarely need to start over. Application security teams want people who can read a pull request, recognise an injection flaw or a broken authorization check, and talk to the engineers who wrote it as peers. The junior application security roles with stated pay on 11 November offered a typical $112,000 to $173,000 a year. Cloud and platform engineers move the same way into cloud security, where the daily work is identity policies, network boundaries and guardrails written as code.

The gap to close is usually security vocabulary and threat thinking rather than technical skill. Learn the common classes of web vulnerability, practise threat modelling on a system you built, and contribute security fixes in your current job so your next résumé shows them. The application security guide describes the work in detail.

From audit, compliance, legal or risk

GRC (governance, risk and compliance) is the door most often overlooked by people who assume security is purely technical. GRC analysts map controls to frameworks such as SOC 2, ISO 27001 and NIST, collect evidence for audits, answer the security questionnaires that customers send before buying, and help leaders decide which risks to accept. People who have run audits, written policies or managed vendor reviews already do recognisable parts of this job.

GRC is not a low-paid corner of the field on this board. GRC postings stated a typical $154,000 to $322,000 a year on 11 November, with the middle at $176,000, and postings with no level word in the title had a middle of $162,000. Most of those are experienced seats, so a career changer should expect to start lower, but the ceiling is high. Technical literacy still matters: a GRC analyst who can read a cloud configuration and tell whether a control is really in place is far more valuable than one who only checks boxes. The GRC guide covers the work and the usual route.

From military or government service

Veterans of cyber, signals and intelligence units bring two things employers struggle to find: operational experience under pressure and, often, an active security clearance. Section 10 covers cleared work in detail. The short version is that a clearance is sponsored by an employer for a specific need and cannot be bought or obtained on your own, so a veteran who already holds one is unusually valuable to defense contractors. On 11 November, 148 open roles on the board asked for a clearance.

From a classroom

Students have a door nobody else has: internships, co-ops and graduate programs that are explicitly built for people without experience. They are scarce (29 internships and co-ops and 7 new-grad roles were open on 11 November) and they open early. Section 11 covers them.

From no technical job at all

This is the hardest starting point, and it is worth being honest about the options. The first is to take an IT support job and use the first door above; it adds a stage, but it is the path the hiring data favours most clearly. The second is to aim directly at tier 1 SOC seats at managed security providers and large SOCs, armed with Security+, a home lab and written investigations; this works for some people, particularly those willing to work nights and weekends, but the pool of such seats is small. The third, for people whose background is in writing, policy, finance or law, is GRC, where clear writing and organisation count as much as technical depth at the start.

What rarely works is aiming at penetration testing as a first job. Only 4 junior penetration testing roles were open on the board on 11 November, and their postings usually expect certifications or a portfolio of lab work. Offensive skills are worth building, and they make you a better defender, but treat them as a direction for year two or three rather than a way in.

5. The skills a first interview tests

Security postings list dozens of tools, but first interviews come back to the same small set of foundations. They are what lets you form the picture of normal described in section 3, and no certificate substitutes for them.

Networking. You should be able to explain what happens, layer by layer, when a browser loads a page: name resolution through DNS, the TCP handshake, TLS, the HTTP request. Know the common ports, what a proxy and a firewall each see, and what network address translation hides. Most alerts and most incident timelines are, at bottom, network events.

Operating systems. On Windows, know processes and their parent processes, services, scheduled tasks, the registry run keys attackers like, user and admin accounts, and the event log entries for sign-ins and process creation. On Linux, know users and permissions, cron, systemd services, and where the logs live. When an alert says a Word document launched an encoded PowerShell command, the interviewer wants to hear why that parent and child pair is suspicious.

Logs and search. Security operations is largely searching. Learn one SIEM query language well (Splunk's SPL or Microsoft's KQL are the common ones) and practise turning a question into a query: which accounts signed in from more than one country within an hour, which hosts reached a newly registered domain this week.

Identity. Accounts run through almost every case an analyst works, from access reviews to account takeover. Understand single sign-on, multi-factor authentication and its weaknesses (push fatigue, stolen session tokens), and how identity providers such as Okta and Microsoft Entra ID log what happens.

Scripting. Python or PowerShell, at the level of parsing a log file, calling an API and automating a repetitive lookup. You do not need to be a software engineer, but an analyst who cannot automate anything spends the day doing what a script could do.

Writing. Every security job produces text: incident notes, shift handovers, risk assessments, audit responses. The analysts who move up fastest are the ones whose notes a stranger can follow.

The hiring managers in ISC2's survey ranked teamwork, problem solving and analytical thinking above specific technical areas such as data security and cloud security when judging early-career candidates, and only 18% believed entry-level staff could handle cloud security tasks - ISC2 2025 hiring trends study. In other words, they expect to teach the specialist tooling and they screen for how you think.

How to show the skills instead of claiming them

Because the first job is hard to get without experience, the most valuable thing you can build is evidence that substitutes for it. Three kinds work.

• A home lab. Two or three virtual machines, a free SIEM (Splunk's free tier, the Elastic stack or Wazuh), logs flowing in from each machine. Then attack your own lab with well-known techniques and see what the logs show.
• Written investigations. Work through the alert and log datasets on blue-team practice platforms such as Blue Team Labs Online, LetsDefend and CyberDefenders, or the attack-and-defend rooms on TryHackMe and Hack The Box, and write up two or three cases the way a SOC would: what fired, what you checked, what you concluded, what you would change. A clear write-up is the closest thing to a work sample a beginner can offer.
• A public repository. Scripts that save time, detection rules mapped to the MITRE ATT&CK techniques they catch, a small tool that parses a log format. Hiring managers open these.

The US government's NICE Workforce Framework for Cybersecurity is a useful map while you build. NIST describes it as a common language for the work, the knowledge and the skills cybersecurity jobs involve, used by employers, educators and learners for career discovery and hiring - NIST NICE Framework Resource Center. Reading the tasks listed for the role you want tells you what a posting is really asking for underneath its tool names.

When you reach the interview stage, expect a SOC triage walk-through, an incident scenario that unfolds in stages, a technical round in your specialty and a conversation with the hiring manager. In the triage round the order of your thinking is what gets scored: is the alert real, how far does it reach, how bad is it, and only then how to contain it. The board's security interview practice lets you rehearse each round with written feedback on every answer.

6. Certifications: what postings name, and which to sit first

Certifications are where newcomers spend the most money and the most anxiety, so it is worth looking at what employers actually write into their postings. The certifications page counts every posting that names a certification, either as a requirement or as a plus. On 11 November, 26.2% of the 2,144 open postings named at least one of the certifications it tracks. Put the other way, nearly three postings in four named none.

The ranking surprises people. The CISSP led with 359 postings (16.7%), followed by GIAC certifications (10.1%), the CISM (6.9%), the CISA (5.6%) and the OSCP (5.5%). CompTIA Security+, the certification most beginners are told to get, appeared in 89 postings (4.2%), and CySA+ in 1.1%. To read this correctly you have to separate certifications a beginner can earn from those a beginner cannot.

The certifications you cannot finish yet

Three of the five most-named certifications, the CISSP, the CISM and the CISA, require years of professional experience before the issuer will award them. The CISSP requires five years of cumulative, paid, full-time work in at least two of its eight domains; a relevant degree or an approved credential can each cover one year, and part-time work and documented internships can count - ISC2 CISSP experience requirements. The CISM asks for five or more years of work across at least three of its four domains, gained within the ten years before you apply - ISACA. The CISA and CRISC, both also from ISACA, likewise ask for years of verified work.

These certifications top the count because senior seats dominate the postings, not because juniors need them, and the certifications page lists them apart as the ones that gate senior and leadership roles. The CISSP, CISM, CISA and CRISC are all named most in GRC postings. There is one useful wrinkle for beginners: ISC2 lets someone who passes the CISSP exam without the experience become an Associate of ISC2, with six years to earn the five years required - ISC2 CISSP experience requirements. It is an expensive and demanding exam to sit that early, though, and most people are better served by an entry certification and a job.

The certifications a beginner can sit

CompTIA Security+ is the default first certification for operations and analyst seats. Security operations and incident response is the specialty whose postings name it most, and it satisfies the US Department of Defense baseline that 26 of the open postings cited on 11 November. Timing matters right now: CompTIA lists Security+ V8, exam code SY0-801, as expected to launch on or around 17 November 2026, with a maximum of 90 questions in 90 minutes, a passing score of 750 on a 100 to 900 scale, and a recommendation of two years of hands-on experience as a security administrator - CompTIA Security+ V8. That recommendation is advice rather than a requirement. If you are buying study material this month, make sure it matches the exam version you will actually sit, since each version follows its own outline.

CompTIA CySA+ is the analyst-focused step after Security+. Few postings name it (23 on 11 November), and those that do had a middle stated salary of $106,000 a year, the lowest of any certification on the list, which points to less senior analyst seats. That makes it more relevant to a beginner than its small count suggests.

GIAC certifications (GSEC, GCIH, GPEN and many others) were named in 216 postings, the second-highest count, and GIAC lists no prerequisites for its security essentials exam, a proctored test of 106 questions over four hours with a 72% passing score - GIAC GSEC. That page shows no price and points candidates to SANS-aligned training as preparation, so work out the full cost of course and exam before you plan around one. Once you are employed, it is worth asking whether your employer's training budget covers it.

The OSCP from OffSec is the hands-on penetration testing certification, named in 117 postings and asked for most in penetration testing and red team roles. OffSec sets no formal prerequisites but recommends solid networking, Windows and Linux administration and some scripting; the exam is a 24-hour practical, and the course plus one exam attempt costs $1,749 - OffSec PEN-200. It is a demanding second or third certification for most people rather than a first one. Where postings name an ethical hacking certification, the board counted 117 for the OSCP against 59 for EC-Council's CEH.

ISC2's Certified in Cybersecurity (CC) needs no work experience - ISC2 CC. Until this year ISC2 offered its training and exam free through a program it called One Million Certified in Cybersecurity. That program stopped taking new participants on 20 May 2026; people who already hold an unexpired exam code can sit the exam until 31 December 2026, and the exam is now sold like any other ISC2 exam. ISC2 says more than a million people enrolled and more than 65,000 earned the CC through it - ISC2. The board's certification count does not track the CC, so this guide cannot tell you how often postings name it. In ISC2's own 2025 survey, hiring managers put the CC, CASP+ and Security+ at the top of the certifications they require for early-career roles - ISC2 2025 hiring trends study.

The pay figures are not a certification's value

The certifications page also shows the middle salary of the postings that name each certification, and it is easy to misread. Postings naming the CISSP stated a middle of $188,000 a year. Postings naming no certification at all stated a middle of $214,000, higher than for any certification on the list. That does not mean a certification lowers your pay. It reflects which jobs name certifications. The CISSP is named most in GRC postings, a specialty whose middle of $176,000 sits below the $205,000 middle of every security posting read, and the postings that name nothing are a different mix of seniority and specialty altogether. The gap comes from who is hiring for what, not from the certificate, so the salary attached to a certification tells you what kind of role asks for it rather than what it adds to your pay.

A sensible sequence

Read the table below as a default to adjust, not a prescription. The guiding principle is to sit the certification that postings for your target seat name, then let experience do the rest.

7. Degrees, bootcamps and teaching yourself

The BLS lists a bachelor's degree as the typical entry-level education for information security analysts, along with less than five years of experience in a related occupation - BLS Occupational Outlook Handbook. That describes the people who hold the job across the whole economy. It does not mean a degree is the gate for every first seat.

The hiring managers in ISC2's survey weighed the three kinds of qualification almost equally when asked which attributes were critical in an early-career candidate: IT or security certifications (47%), IT experience (44%) and relevant education (43%). When they were asked whether they would consider a candidate who had only one of those, though, experience and certifications came out ahead of a degree on its own. And among managers recruiting from colleges, 27% had found entry-level candidates in undergraduate programs outside computer science, IT or security - ISC2 2025 hiring trends study.

From first principles, a degree helps most in three situations: when an employer runs a graduate program that recruits from campuses, when a government contract or agency posting lists a degree as a hard requirement, and when you are young enough that a degree also buys you internships, which section 11 shows are a real pipeline. For a career changer with a job and bills, a full degree is rarely the fastest route; a certification, a lab and a move into the neighbouring IT role usually is. A degree can still matter later, for management and some government seats, and many employers pay for one part-time.

Bootcamps sell a compressed version of what you can assemble yourself: a curriculum, labs, an exam voucher and some career coaching. Whether one is worth its price comes down to what it adds beyond those parts. Before paying, ask for placement outcomes that name employers and job titles, ask whether the price includes an exam voucher and which certification, and ask what share of graduates were already working in IT. A program that cannot answer those questions concretely is selling hope. Be especially wary of anything presented as part of a job offer: a real employer pays for the training it requires.

Teaching yourself is entirely viable, given that most hiring managers will consider a candidate whose only credential is an entry certification. The cost is discipline rather than money. Free and low-cost resources cover every foundation in section 5, the major cloud providers offer free tiers to practise on, and the blue-team practice platforms supply realistic data to investigate. The gap self-taught candidates have to close is proof, which is why the lab and the written investigations matter more for them than for anyone.

8. What the first job pays, and how pay climbs

Pay is where the gap between headlines and reality is widest, so it helps to look at the ladder from its bottom rung.

The BLS medians cover every employer in the country, from hospitals and county governments to banks and software companies: $62,890 for computer support specialists, $99,130 for network and computer systems administrators, and $129,180 for information security analysts in 2025. The climb from the support desk to a security analyst seat roughly doubles median pay, which is the economic reason the IT-first route is worth its extra stage.

On this board, which leans toward software companies, vendors and cloud providers, the figures run higher, and the first rung is clearer. The 62 junior roles open on 11 November included 23 distinct salary ranges from 15 employers; their middle was $92,900 a year, and 38 of the 62 roles stated no salary at all. By specialty, junior operations seats stated a typical $45,800 to $101,000, junior engineering seats $103,000 to $166,000, and junior application security seats $112,000 to $173,000. The spread is the lesson. The first operations job pays least, and it is also the seat most open to people arriving from outside the field, while junior engineering and application security seats assume a technical career already behind you.

Within security operations, the SOC salary page shows how pay climbs with the level in the title. On 11 November, intern seats stated a middle equivalent to about $45,800 a year, roles with no level word $157,000, and senior, staff and principal roles $192,000. The 13 lead and manager roles with a salary had a middle of $174,000, below the senior specialists who manage nobody, so in operations the technical track paid at least as well as the management track on these postings. Across the whole specialty, which includes detection engineers and incident response leaders as well as analysts, postings stated a typical $145,000 to $314,000 a year with the middle at $177,000.

The job titles matter too. On the highest-paying cybersecurity jobs ranking, postings titled SOC analyst had a middle of $158,000 and those titled plain security analyst $99,400, the lowest of the 18 jobs ranked, while CISO and VP of Security seats led at $305,000. A first analyst job is the bottom of a ladder that rises steeply for people who keep building skills, especially toward engineering, detection and architecture.

Two practical points follow. First, judge an offer against the right comparison: a junior analyst offer of $70,000 at a regional managed provider sits inside the junior operations band above and may be fair, even though the board's overall middle is far higher, because it is a different rung and often a different kind of employer. The board's salary calculator sets an offer against the band open postings state for a specialty and seniority. Second, because pay rises so sharply with each rung, the large raises come from moving up a rung or into a better-paid specialty, whether you do that inside your employer or by changing employers.

9. Remote work, shifts and location

Security has a reputation as a remote-friendly field, and the postings partly support it. On 11 November, 691 of the 2,145 roles on the board (32%) were listed as remote, and in security operations and incident response the share was higher: 121 of 308 roles, or 39%. Right now there are 121 remote SOC and incident response roles open out of 309; the remote security operations roles are listed by employer.

Remote work did not mean lower pay in operations: remote SOC and incident response postings stated a middle of $186,000 against $172,000 for on-site and hybrid ones. GRC ran the other way, with a remote middle of $164,000 against $189,000 on-site or hybrid. These middles mix every seniority level, so read them as a sign that operations does not pay remote seats at a discount, not as a rule about any one employer.

For a beginner the more important fact is that remote seats are contested by everyone, nationwide, including experienced people. A junior applying only to remote roles is competing in the widest possible pool for the smallest number of seats. Some remote junior roles do exist (the Expel associate analyst seat mentioned earlier, or a Security Operations Engineer I role at Samsara with a stated range of $95,200 to $144,000), but an on-site or hybrid seat at a SOC near you, especially one that needs night and weekend cover, is usually easier to win.

Shift work is part of the trade at the start. Teams that watch systems around the clock need people on every shift, and newer analysts often take nights and weekends while senior and engineering roles are mostly daytime with an occasional on-call week. Treat a year of shifts as the price of the experience that opens everything else, and ask about the rotation in the interview. If you want to see where security roles cluster geographically, the security jobs by city pages count them by metro area.

10. Government work, clearances and DoD 8140

Government agencies, defense contractors and the companies that sell to them hire for security under rules of their own, and a newcomer should know them before applying.

On 11 November, 148 open roles on the board asked for a security clearance, either one you already hold or one you must be able to obtain, at 33 employers. The cleared roles page sorts them by the highest level each names: 47 asked for Top Secret, 30 for TS/SCI, 16 for TS/SCI with a polygraph and 15 for Secret. Cleared postings stated a typical $151,000 to $305,000 a year, and the polygraph tier had the highest middle at $206,000.

Two facts about clearances shape a newcomer's options. First, you cannot get one on your own. Under the federal rules for industrial security, a contractor may request clearance eligibility only for its own employees or consultants, only as many as its contracts actually require, and never to build up a pool of cleared staff in advance - 32 CFR 117.10, via Cornell Law School. In practice an employer has to hire you into a role that needs a clearance and sponsor the investigation. Second, clearances are effectively limited to US citizens: the same rule allows a limited access authorization for a non-citizen only in rare cases where unique skills are needed for a specific contract, and not for Top Secret information. If you are a citizen without a clearance, the realistic route is to apply for roles whose postings say the hire must be able to obtain one: those are the postings written for someone the employer is prepared to sponsor.

The other rule set is the Department of Defense's qualification policy for its cyber workforce. DoD Manual 8140.03, issued in February 2023, replaced the older 8570 manual and lets experience serve as an alternative to the foundational areas of education, training and certification - Nextgov. Postings still cite both names; 26 of the 2,144 open postings on 11 November mentioned DoD 8570 or 8140, and Security+ is a certification that meets the baseline those postings refer to. If defense work is your target, it is the first credential to plan for.

A warning that belongs here: anyone who offers to sell you a clearance, speed one up, or hire you into a cleared seat for a fee is running a scam. Clearances are sponsored by the employer and investigated by the government at no cost to you.

11. Students: internships and graduate roles

Students are the one group the market explicitly builds doors for. Internships are a real pipeline: 55% of the hiring managers ISC2 surveyed used them to source early-career security staff, and 46% used apprenticeships - ISC2 2025 hiring trends study.

The internships page showed 29 internships and co-ops and 7 new-grad roles at 23 employers on 11 November. Interns with stated pay were offered a typical $22 to $71 an hour, with the middle at $28. New-grad security roles stated a typical $144,000 to $183,000 a year for the first year, from the ranges in their own postings. Their titles read as software and security engineering seats at companies such as SpaceX, Applied Intuition and Anduril Industries, so programming ability matters there.

Timing is the part students most easily get wrong. Of the 29 internships open on 11 November, 12 already named 2027 in their titles, which means employers were filling programs that start up to a year later. A student who starts looking in spring for the coming summer may find the largest programs already closed. Start in the autumn of the year before.

Internships also count toward certification experience. ISC2 accepts paid or unpaid internships toward the CISSP experience requirement if you can document them on the organisation's letterhead - ISC2 CISSP experience requirements, so keep the paperwork from every security internship you do.

What makes a student's application stand out is the same as for anyone else, only more so: a home lab, write-ups, participation in capture-the-flag competitions or a campus security club, and a clear statement of which kind of security work you want. An internship application that says "anything in cyber" competes poorly against one that says "detection engineering, and here are three rules I wrote".

12. What AI changes about the first security job

The obvious worry is that AI will take the first rung away. The honest answer is that it is changing the rung rather than removing it, and the change favours a particular kind of beginner.

Begin with what tier 1 work is. A large part of it is triaging alerts that match known patterns: confirming that a sign-in alert was a user on a VPN, that a malware detection was quarantined, that a phishing report was spam. That is exactly the kind of work automation absorbs first, because the patterns are known and the evidence is in structured logs. As this board's security operations guide describes, automated response playbooks and AI assistants already close some routine alerts and draft summaries. ISC2's 2025 workforce study found that 69% of respondents were already using AI security tools or planning to - ISC2 2025 Cybersecurity Workforce Study.

What remains for people is the part that requires judgment across systems: the alert that does not match a pattern, the investigation that spans an identity provider, a laptop and a cloud account, the call on whether to wake the incident commander at 3 a.m. Junior analysts who can write their own detections, query data quickly and automate the repetitive half of their job are the ones teams keep and promote. The skills in section 5 (search, scripting, writing) are therefore not optional extras. They are what makes a beginner more useful than a script.

AI has also created a new corner of the field. The board's AI security roles, work that keeps AI systems themselves safe from attack (prompt injection testing, protecting model weights and training data, securing the agents companies ship), numbered 229 at 110 employers on 11 November, with a typical $178,000 to $350,000 a year and 84 of them remote. Almost all are senior roles today. For a beginner they are a direction to grow toward from application security or engineering, not a door in, but a beginner who understands both security fundamentals and how language models fail will find that combination rare and valued.

13. A twelve-month plan

The plan below assumes about ten hours a week of study alongside a full-time job, and a target of a security operations or analyst seat, the first security job most people from outside engineering aim for. Adjust the content for other doors (a developer heading for application security spends the study time on web vulnerabilities and threat modelling instead), but keep the shape: foundations, a certification, proof, then applications, with the applications starting earlier than feels comfortable.

Months 1 and 2: decide and lay foundations. Choose your door from section 4 and read the guide for the kind of work it leads to; the ten kinds of security work are each described with a day in the life and worked examples. Then spend these weeks on networking and operating systems. By the end you should be able to explain a web request end to end, find a process's parent on Windows, and read a Linux log without help. If you are not yet working in IT, start applying for help desk and support roles now, not later.

Months 3 and 4: the certification. Study for Security+ (or the certification your door calls for) and book the exam for the end of month 4, because a booked date is what turns reading into studying. Keep a notebook of every concept you had to look up twice. Make sure your study material matches the exam version you will sit.

Months 4 to 6: the lab and the first proof. Build the home lab described in section 5, send it logs, and attack it with documented techniques so you can see what each looks like in the data. Work through investigations on a blue-team practice platform and publish two or three write-ups. Put your scripts and detection rules in a public repository.

Months 6 to 9: applications. Start applying once you have the certification and two write-ups, not when you feel ready. Target junior SOC analyst, associate security engineer, IAM analyst and GRC analyst seats, managed detection and response providers, consultancies, and defense contractors that sponsor clearances. Apply to postings where you meet the core even if you miss some preferred items. Rehearse the interview rounds, especially the triage walk-through. If you are in IT already, tell your manager and the security team that you want to move; an internal move is often the shortest route, because you already know the systems.

Months 9 to 12: widen or deepen. If no offer has come, widen before you deepen. Add on-site and shift roles, roles in other cities, cleared roles that say the hire must be able to obtain a clearance, and adjacent seats such as security-focused IT administration or vulnerability management. Keep publishing write-ups, because each one is a new talking point in an interview. If an offer has come, the next year's goal is different: learn everything the seat can teach, volunteer for incidents, and start building toward the specialty you want in year three.

Twelve months is not a promise. Some people move sooner, especially from inside IT; others take longer, especially from outside it. What the plan does ensure is that you spend the time on the things hiring managers actually weigh, in the order that compounds.

14. Applying: reading postings, showing proof, spotting fake offers

Read the posting for its core, not its wish list. Most postings mix three kinds of requirement: the foundations the job truly depends on, the tools this team happens to use, and preferences that someone added to an old template. Tools are learnable in weeks, and a hiring manager knows it. The foundations are what you must show. If a junior posting asks for three years of experience and a CISSP, remember that ISC2 found a third of hiring managers ask for that certification at entry level even though nobody at entry level can hold it.

Make the résumé about evidence. Every line should say what you did and what it changed: "wrote a PowerShell script that cut account-lockout ticket handling from 15 minutes to 2", "investigated 40 simulated alerts and published three write-ups", "collected SOC 2 evidence for 60 controls". A list of tools you have heard of persuades nobody; a link to a write-up persuades many.

Use the board to aim. The entry-level roles and internships pages show today's junior seats with the salary each states, and the certifications page tells you which credentials the postings in your target specialty actually name. Each page offers a weekly email of new roles if you would rather not check by hand.

Know what a fake offer looks like. Fraudsters copy real employers' names and aim some tricks squarely at people trying to enter security, who expect to buy vouchers and labs and hope for remote work. The pattern is consistent. You are asked to pay before you start, for a Security+ voucher, a bootcamp, a lab subscription, a background check or a laptop. The interview asks you to install remote-access software or run code from a repository. A check arrives to buy home-lab equipment, you pay their vendor, and the check bounces. Someone offers a clearance for a fee. The whole process happens in a messaging app with no people you can look up. You are asked for a sign-in, a multi-factor code or an identity document before any written offer. A real employer pays for what it requires and identifies you only after the offer, in its own HR system. The board's job scam checker matches a message's links and senders against the real domains and careers boards of the employers it follows.

15. Questions people ask before they start

Can someone with zero experience get hired in cybersecurity?

Yes, but rarely straight into a security title. Only about 3% of the open postings on 11 November were written for beginners, so most people with no experience enter through an IT support role, an internship, or a tier 1 SOC seat at a managed provider. The fastest honest route for someone with no technical background is usually an IT job first, then the move, as section 4 describes.

How many months does the move into security usually take?

This board's guide to security operations puts the time to a first SOC role at 6 to 18 months, with people already working in IT at the faster end. From a non-technical job, plan for longer, because the neighbouring IT stage comes first.

Do I need a degree?

Not for most first seats. ISC2's hiring managers ranked certifications and IT experience about level with education, and most would consider a candidate with only IT experience or only an entry certification. A degree helps with graduate programs, some government postings and later management roles.

Which certification makes the best first one for security work?

For operations and analyst seats, CompTIA Security+, which also meets the Department of Defense baseline that some postings cite. Do not start with the CISSP, CISM or CISA; they require five years of experience before they are awarded, which is why they are named mostly in senior postings. Section 6 has a sequence for each door.

Is cybersecurity oversaturated with beginners?

The entry level is crowded relative to the number of seats written for it, which is a different thing from the field being full. The BLS still projects 21% growth for security analysts over 2025 to 2035, and in ISC2's 2025 study 88% of respondents said a skills shortage had caused their organisation at least one significant security consequence in the past year. The squeeze is at the first rung, which is why the neighbouring-job route and visible proof matter so much.

Is programming required for a security career?

You need to script, not to be a software engineer. Enough Python or PowerShell to parse a log, call an API and automate a lookup is the bar for operations and GRC. Application security and security engineering expect real programming ability.

Can I start in penetration testing or ethical hacking?

It is unusual. Penetration testing and red team roles were about 4% of the board on 11 November, and only 4 of them were junior, with postings that usually expect certifications or a portfolio of lab work. The OSCP, the certification those postings name most, is a demanding exam. Build offensive skills alongside a defensive first job.

Are entry-level security jobs remote?

Some are, but most first jobs are on-site, hybrid or shift-based. In operations, 39% of roles were remote on 11 November, while only 17 operations roles, remote or not, were junior seats. Applying only to remote roles puts a beginner in the most competitive pool there is.

What salary comes with a beginner's security role?

On this board, junior roles that stated pay had a middle of about $92,900 a year on 11 November, with junior operations seats lower and junior engineering seats higher. Across the whole US economy, the BLS put the median for information security analysts at $129,180 in 2025, a figure that includes experienced analysts. Section 8 walks the ladder rung by rung.