How to Break Into Cybersecurity With No Experience
Most security analysts arrive from an IT help desk or systems job rather than straight from a course, and that detour shapes how you should plan.
By Harlan Voss · Oct 06, 2026 · 8 min read
Cybersecurity is not usually a first job. The U.S. Bureau of Labor Statistics (2025) reports that information security analysts typically need a bachelor's degree in a computer science field plus related work experience, and that many of them come from an IT department — often from a network and computer systems administrator role. Employers may also prefer candidates who hold a professional certification.
That means "no experience" realistically becomes "no security experience yet," and the path runs through a first technical job. This guide sets out the sequence, how long each stage tends to take, and what to have ready before you apply.
Step-by-Step Path
- Confirm which entry door you are using (1-2 weeks). The U.S. Bureau of Labor Statistics (2025) lists two routes: a bachelor's degree in computer and information technology or a related field such as engineering or math, or a high school diploma backed by relevant industry training and certifications. O*NET OnLine (U.S. Department of Labor, 2026) places the occupation in Job Zone Four, "Considerable Preparation Needed," where most jobs want a four-year degree but some do not. Decide which you can finance and finish.
- Build the underlying technical base (3-6 months, part time). Before security comes networking and operating systems: IP addressing and routing, the Linux and Windows command lines, user and permission models, and how a firewall rule is actually written. Set up two or three virtual machines at home and break and fix them.
- Complete the degree, or the certification route (2-4 years, or 3-9 months). If you take the degree, a computer science, information technology, engineering or mathematics major fits what BLS describes. If you take the certification route, pick a credential aimed at the entry level — the BLS (2025) points readers to CareerOneStop for information on security certifications, which lists what exists, who issues it and which are entry level versus experienced. Book the exam date before you start studying.
- Take a first IT job (apply over 2-4 months; hold it 12-24 months). Target the titles that feed the field: computer network support specialist, or network and computer systems administrator, which O*NET OnLine (2026) lists as a related occupation and BLS (2025) names as the common feeder role. Internal IT departments, managed service providers and consulting firms all hire at this level.
- Move into a security title (apply internally first). Reported job titles for the occupation include security analyst, IT security analyst, network security analyst, information systems security analyst and information systems security officer (O*NET OnLine, 2026). An internal transfer is usually the shortest route, because the hiring manager can see your ticket history.
- Learn the day-to-day work on the job (first 6-12 months in role). BLS (2025) describes the duties as monitoring networks for security breaches, maintaining firewalls and encryption software, checking systems for vulnerabilities, preparing incident reports, researching IT security trends, developing security standards and helping build disaster recovery plans. Employers typically expect some on-the-job training at this point, so ask what theirs looks like.
- Specialise (years 3-6). O*NET OnLine (2026) lists penetration testers, digital forensics analysts and information security engineers as related occupations. Specialist certification — in systems auditing, for example — is also available, and BLS (2025) notes some certifications are designed for experienced workers rather than beginners.
- Advance into leadership (years 6-12). BLS (2025) says analysts may lead a team, become the in-house expert in one security area, or move up to chief security officer or another computer and information systems manager role.
How Long It Takes
Timings below assume you are starting with no IT job and no degree in the field. They shift if you already work in IT, or if you are studying part time around a job.
Months 0-6 — foundations. You can configure a small home network, run a vulnerability scan against your own machines, read a firewall ruleset and write up what you found. If you chose the certification route, you have a booked exam date from the CareerOneStop certification list (U.S. Bureau of Labor Statistics, 2025).
Months 6-18 — first credential and first job. Either you are partway through a bachelor's in computer and information technology, or you have passed an entry-level security certification. The milestone that matters here is employment, not study: a help desk, computer network support specialist or junior systems role (O*NET OnLine, 2026).
Years 1-3 — the IT years. You are doing account administration, patching, backups and ticket escalation, ideally touching the security tooling. This is the "related work experience" BLS (2025) says employers expect. Many people graduate a degree during this stage while working.
Years 2-5 — the crossover. You hold a title such as security analyst, network security analyst or information systems security analyst. On-the-job training covers the employer's own monitoring stack and incident reporting process. Degree-holders who interned in IT often reach this point nearer year two; career changers without a degree more often near year five.
Years 5-10 — specialism or management. You either go deep (penetration testing, digital forensics, security engineering, systems auditing) or go wide toward information security officer and, later, chief security officer or computer and information systems manager (U.S. Bureau of Labor Statistics, 2025).
Two things stretch the timeline and vary by employer and state: some government and defence contractors run background checks that add months before a start date, and public-sector hiring cycles are typically slower than those at computer companies, consulting firms or business and financial companies — the three employer groups BLS (2025) names as the main ones. Before you fix a salary expectation to any stage, look up current wage data for your state on the BLS Occupational Outlook Handbook and CareerOneStop, and check the BLS projected employment growth for information security analysts for 2025-35 rather than relying on general claims about the field.
Before You Start
Work through this list and you will have something to attach to an application, not just an intention.
- Transcripts or diploma in hand. Official copies of your high school diploma, any college transcripts, and any prior IT coursework — employers and degree programmes both ask.
- A shortlist of two certifications from CareerOneStop, which the U.S. Bureau of Labor Statistics (2025) names as the source for information security certification information. Note for each: the issuing body, whether it is pitched at entry level or at experienced workers, the exam fee and the renewal requirement.
- A home lab you can describe in three sentences. At minimum: two virtual machines, a firewall between them with rules you wrote, and an encryption tool you have configured — three of the duties BLS (2025) lists for the occupation.
- One written vulnerability check and one incident report. Scan your own lab, then write the findings up in the format a manager would read: what was found, severity, what you changed, what you would recommend. Preparing incident reports is a named duty of the job; show you can do it.
- A résumé rewritten against real job titles. Use the terms O*NET OnLine (2026) reports for the occupation — information security specialist, IT security analyst, information systems security officer — and mirror them in your summary line.
- A target employer list of 20 organisations drawn from the sectors BLS (2025) identifies: computer companies, consulting firms, and business and financial companies, plus your local hospital systems, universities and state agencies.
- A printed wage check for your state from the BLS Occupational Outlook Handbook and CareerOneStop, so you can compare an offer against something real.
- A budget covering exam fees, retakes and any degree costs, with the date you will sit the first exam written on it.
Frequently asked questions
Can I do this without taking on degree debt?
Possibly. The U.S. Bureau of Labor Statistics (2025) states that while most information security analysts hold a bachelor's degree, some workers enter with a high school diploma plus relevant industry training and certifications. Community college coursework, employer tuition assistance and self-funded certification exams are all cheaper routes. The trade-off is that degree-preferring employers — common in finance and government — may screen you out regardless of skill.
Is this realistic while I work full time?
It is the normal pattern. Most people study for certifications or a part-time degree in evenings while holding an IT support job during the day, which also supplies the related work experience employers expect. Budget around eight to twelve hours a week of study. The slowest part is usually not the exam but waiting for a role to open where you already work.
Am I too old to switch into security at 40 or 50?
Age is less of a barrier here than in physically demanding trades, because the work is desk-based: monitoring networks, maintaining firewalls and encryption software, and writing security standards and disaster recovery plans. Prior careers in auditing, compliance, project management or military logistics map directly onto risk documentation and incident response. What you still need is hands-on time with the systems themselves.
Do I need to be a strong programmer or mathematician?
Not to start. The analyst duties BLS (2025) describes lean more on configuration, documentation and investigation than on software development. Scripting helps you automate scans and parse logs, and it becomes important if you move toward penetration testing or security engineering — both listed by O*NET OnLine (2026) as related occupations. Begin with networking and operating systems instead.
How do I judge whether an employer's offer is reasonable?
Compare it against published wage data rather than against what a course advertised. The BLS Occupational Outlook Handbook publishes pay for information security analysts, and CareerOneStop breaks figures down by state, which matters because the same title pays differently in different metro areas. Also compare the whole package: on-call rotation, shift cover for monitoring, certification renewal funding and training time.
Sources
- U.S. Bureau of Labor Statistics — Information Security Analysts : Occupational Outlook Handbook (2025)
- O*NET OnLine (U.S. Department of Labor) — 15-1212.00 - Information Security Analysts (2026)
Written by
Harlan Voss
Harlan covers the business of job-seeking itself — the coaches, platforms, and advice industries that have grown up around finding work. He writes with a skeptic's patience and a soft spot for anyone still trying.
