Starting a cybersecurity career with no experience is realistic, but the path is different from what most people expect. Security is generally not a first IT job. It is a specialisation that assumes you already understand how systems normally behave — because the entire discipline rests on noticing when they do not.
The route that works for most people: build genuine IT fundamentals, enter through an accessible role such as SOC analyst or IT support, add a recognised entry certification, then specialise. From a standing start, budget twelve to eighteen months.
Why is cybersecurity hard to enter directly?
Not gatekeeping — it is the nature of the work.
A security analyst investigating an alert has to answer: is this normal? Answering that requires knowing what normal looks like on a network, in an operating system, in an application's logs, in an identity system. You cannot recognise anomalous authentication behaviour without understanding how authentication normally works.
This is why "learn hacking tools" as a starting point disappoints so many people. The tools are the easy part. Interpreting what they tell you is the job, and interpretation requires foundations.
The core principle: security is applied systems knowledge. Every hour you spend understanding how things work normally pays back double when you are trying to work out why something is behaving strangely.
What are the realistic entry points?
| Entry role | Accessibility | What it builds | Moves into |
|---|---|---|---|
| SOC / security analyst | Moderate | Alert triage, incident response, broad exposure | Incident response, threat hunting, detection engineering |
| IT support / helpdesk | High | Systems, users, troubleshooting | Security analyst, sysadmin |
| GRC / compliance analyst | Moderate | Frameworks, risk, audit, policy | Security management, risk, audit |
| Network administrator | Moderate | Networking depth | Network security, architecture |
| Systems administrator | Moderate | Operating systems, identity, infrastructure | Security engineering, cloud security |
SOC analyst is the most common genuine entry point into security itself. The work — monitoring alerts, triaging, escalating — is demanding but structured, and it exposes you to a very wide range of scenarios quickly. It is one of the fastest ways to accumulate real security experience.
GRC is underrated as an entry route, particularly for career changers from audit, compliance, legal or process-heavy backgrounds. It requires less technical depth initially and your existing professional skills transfer directly.
What should you learn first?
In order. The sequencing matters as much as the content.
1. Networking (6–8 weeks)
Not optional, and the most common gap. You need TCP/IP, DNS, HTTP/HTTPS, routing and switching, firewalls, VPNs, and the ability to read a packet capture without panicking.
Most attacks traverse a network. If you cannot reason about network traffic, you cannot investigate them.
2. Operating systems, especially Linux (6–10 weeks)
- Linux: filesystem, permissions, processes, users, logs, services
- Windows: Active Directory, authentication, event logs, Group Policy
Windows matters more than security beginners expect — a large share of enterprise environments and enterprise attacks centre on Active Directory.
Start with Linux System Administration.
3. Security fundamentals (8–12 weeks)
- The CIA triad, threat modelling, defence in depth — the conceptual frame
- Common attack types and how they actually work
- Identity and access management
- Cryptography at a practical level: what it protects, what it does not
- Logging, monitoring and detection
- Incident response process
See Cybersecurity.
4. Scripting (ongoing)
Python and shell. You are automating analysis, parsing logs and understanding tooling — not building applications.
5. Cloud security (4–8 weeks)
Increasingly non-negotiable, since most environments are now at least partly cloud-hosted. Identity, network controls, logging and misconfiguration are the areas that matter most.
Unsure whether your fundamentals are strong enough to start on security specifically? A free demo session will tell you honestly. Book a free demo
Which certifications actually help?
Certifications carry more weight in security than in most IT fields, partly because employers use them as a proxy for baseline knowledge and partly because many roles have compliance-driven requirements.
For entry level: a vendor-neutral foundational security certification. CompTIA Security+ is the most widely recognised at this stage and appears in a large share of entry-level job descriptions. Its objectives have been revised over time to reflect cloud, zero-trust and AI-related content.
Sequence matters: get IT fundamentals first, then certify. Certifying on top of nothing produces a candidate who can answer multiple-choice questions and cannot investigate an alert, and that becomes obvious quickly in interviews.
For later specialisation: management-track and offensive-track certifications exist and are valuable, but choosing them before you have a direction is premature. Decide whether you are heading toward defence, offence, governance or engineering first.
For the offensive path specifically, see Ethical Hacking & Penetration Testing — but read the next section before assuming that is where you should start.
Should you start with ethical hacking?
Almost certainly not, and the reason is practical rather than moralistic.
Penetration testing requires you to understand systems well enough to find flaws in them. That means networking, operating systems, web application architecture, identity systems and often cloud platforms — before you can do the offensive work meaningfully. Starting with offensive tooling produces someone who can run scanners and cannot interpret the results.
There is also a professional reality that beginners underestimate: the report is the deliverable. Client-facing penetration testing is judged on whether the client can act on your findings. Excellent technical work with an unusable report has little value.
And the legal frame is absolute: testing systems without explicit written authorisation is a crime in most jurisdictions, regardless of intent. Any legitimate training in this area should make authorisation and scope a central topic rather than a footnote.
If offensive security is your goal, the sequence is: IT fundamentals ? defensive security ? then offensive specialisation.
How long does it take?
| Starting point | Realistic timeline to a security role |
|---|---|
| No IT background | 12–18 months, usually via a support or helpdesk role first |
| IT support / helpdesk | 6–12 months |
| Systems or network administrator | 6–9 months |
| Software developer | 6–12 months, often toward application or cloud security |
| Audit / compliance / risk background | 6–12 months, often toward GRC |
The pattern is consistent: existing IT exposure roughly halves the timeline. If you are starting from outside IT entirely, your first goal is an IT role, not a security role.
How do you get hired without security experience?
Build a homelab. Run vulnerable-by-design machines in an isolated environment, practise detection, set up a log collector, generate suspicious activity and try to catch it. This is the closest thing to real experience you can create yourself — and keep it isolated and legal.
Document your investigations. Write up what you found, how you found it, what you concluded and what you would do next. This demonstrates the analytical process that interviews actually test. It also builds the writing skill that security work depends on far more than beginners expect.
Learn to communicate risk. Security professionals spend a great deal of time explaining to non-security people why something matters and what to do about it. Candidates who can do this stand out immediately.
Expect scenario-based interviews. "You see this alert — what do you do?" is the standard format. Practise reasoning out loud: what would you check, what would that rule out, what next.
Your next step
If you are outside IT, target an IT support or systems role now and begin networking fundamentals in parallel. If you are already in IT, you are closer than you think — build security fundamentals on top of what you have and target SOC roles.
Either way, be sceptical of anything promising a security career in a few weeks. The field rewards depth, and the people who last in it are the ones who understood the systems before they tried to defend them.
Our security track follows the sequence in this article: Linux System Administration for foundations, Cybersecurity for defensive core, and Ethical Hacking & Penetration Testing for offensive specialisation once the groundwork is in place. All taught live by practitioners, with authorisation and ethics treated as core content rather than a disclaimer.
Book a free demo session to talk through where you should realistically start.