Is cyber security a good career in the UK? The complete 2026 guide to breaking in

If you have ever typed "is cyber security a good career uk" into Google at midnight, you are not alone. Thousands of people every month are asking the same thing: graduates who can't get a first job, people stuck in retail or warehouse work, career changers in their 30s and 40s, and IT support staff who want to move up.

Most of the answers you'll find are either written by course sellers who want you to believe a certificate is all you need, or by senior professionals who forgot what it was like to start. This guide is different. It is long because the question deserves a proper answer, but we have written it in plain English. No jargon without an explanation, no made-up statistics, and no pretending it's easier than it is.

By the end, you'll know:

• what cyber security actually is, explained simply
• why it matters so much to the UK right now, and how big the market really is
• what the jobs are, what people do all day, and what they get paid
• the honest truth about breaking in with no experience
• which certifications to get, in which order, and how long it takes
• how to get the hands-on experience that employers ask for
• a realistic step-by-step plan you can start this week

Every number in this guide comes from a named source, mostly UK government research published in 2025 and 2026. You'll find the full list of sources at the bottom.

What is cyber security, in plain English?

Cyber security is the job of protecting computers, networks, data and the people who use them from being attacked, stolen from or switched off.

Think of a business like a house. The house has valuables inside: customer details, bank information, staff records, the systems that keep the lights on. Cyber security is everything that keeps the wrong people out of that house and spots them quickly if they get in.

• The locks on the doors are passwords, multi-factor authentication and access controls. They decide who is allowed in.
• The alarm system is security monitoring. Tools watch for anything unusual, such as someone logging in from another country at 3am.
• The security guard watching the cameras is the security analyst. They look at the alerts, decide what is real and what is a false alarm, and act.
• The building inspector is the penetration tester. They are paid to try to break in, legally, so the weak spots can be fixed before a real criminal finds them.
• The insurance and rules are governance, risk and compliance. These people make sure the business follows the law and has a plan for when things go wrong.

The three things cyber security protects

Professionals often talk about the "CIA triad". It has nothing to do with spies. It stands for three simple ideas:

1. Confidentiality: only the right people can see the information. Your medical records should only be seen by your doctor, not by a hacker selling them online.
2. Integrity: the information is accurate and hasn't been tampered with. If someone changes the bank details on an invoice, the business pays a criminal instead of a supplier.
3. Availability: systems work when people need them. If a hospital's systems are locked by ransomware, appointments are cancelled and patients are put at risk.

Almost every job in cyber security is about protecting one or more of those three things.

What does a cyber attack actually look like?

Hollywood shows hackers in hoodies typing fast in dark rooms. Real attacks are usually far more boring, and that is exactly why they work. The most common ones in the UK are:

• Phishing: a fake email or text that tricks someone into clicking a link, entering a password or opening an attachment. It is the most common type of attack UK businesses report.
• Social engineering by phone (vishing): someone rings the IT help desk pretending to be a member of staff who is locked out, and asks for a password reset. Reports suggest some of the biggest UK retail attacks of 2025 started exactly this way.
• Ransomware: criminals get into a network, lock or steal the files, and demand payment to unlock them or not publish them.
• Exploiting unpatched systems: attackers scan the internet for software that hasn't been updated and use known weaknesses to get in.
• Insider mistakes: a laptop left on a train, a spreadsheet emailed to the wrong person, a cloud storage folder accidentally made public.

Notice something? Most of these are not about clever code. They are about people, processes and basic hygiene. That is good news if you are worried you aren't "techy enough". A huge amount of cyber security is about understanding how people and businesses work.

Why does cyber security matter so much right now?

Because in the last two years, cyber attacks in the UK stopped being an IT problem and became a national economic problem.

2025: the year attacks hit the high street

In April 2025, Marks & Spencer was hit by a cyber attack that forced it to suspend online orders for weeks. The retailer later put the cost at around £300 million. The Co-op and Harrods were targeted in the same wave. The Cyber Monitoring Centre, an independent body that rates UK cyber events a bit like hurricanes, estimated the combined cost of the retail attacks at between £270 million and £440 million.

Then, at the end of August 2025, Jaguar Land Rover was attacked. Its factories were shut from 1 September for around five weeks. The Cyber Monitoring Centre called it "the most economically damaging cyber event to hit the UK", estimating the cost to the UK economy at around £1.9 billion and saying more than 5,000 UK organisations were affected through the supply chain: parts makers, dealerships and local businesses. The government stepped in with a £1.5 billion loan guarantee to protect suppliers.

These weren't small companies with no IT department. These were household names with large security budgets. If they can be hit, anyone can.

The numbers behind the headlines

The National Cyber Security Centre (NCSC), which is part of GCHQ, is the UK's lead agency for cyber attacks. In its Annual Review 2025, it reported handling 429 cyber incidents. Nearly half (204) were classed as nationally significant, meaning they had a serious impact on government, essential services, the economy or a large part of the population. That was the highest number it had ever recorded, and the number of the most severe "highly significant" incidents rose by around 50% for the third year in a row.

The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses and 28% of charities identified a cyber breach or attack in the previous 12 months. That is roughly 612,000 businesses. And those are only the ones that noticed and were willing to say so.

AI is making it faster and cheaper to attack

Criminals now use AI tools to write convincing phishing emails in perfect English, clone voices and scan for weaknesses at scale. At the same time, businesses are rushing to adopt AI themselves. The same government survey found that nearly a third of businesses (31%) are using, adopting or considering AI, but only around a quarter of those have cyber security measures in place to manage the risks.

In plain English: more doors are being built, faster, and fewer of them have locks.

Why this matters for you

Every one of those attacks needs people to prevent it, detect it, respond to it and clean up afterwards. Boards that used to see security as a cost are now seeing it as survival. The NCSC's chief executive put it bluntly at the launch of the Annual Review: cyber security is now a matter of business survival and national resilience.

That shift is why cyber security is one of the few areas of tech where demand has held up while other parts of the jobs market have slowed down.

Which parts of the UK depend most on cyber security?

Every organisation needs security, but some sectors carry particularly high stakes. Understanding them helps you see where the jobs are and why the work matters.

Healthcare and the NHS

Hospitals, GP surgeries and the companies that supply them hold some of the most sensitive data there is. They also rely on systems being available around the clock: if a pathology lab or appointment system goes down, operations are cancelled and patients wait. Attacks on NHS suppliers in recent years have shown that a single breach at a third-party provider can disrupt care across whole regions. Healthcare security teams focus heavily on availability, supplier risk and protecting patient records.

Finance, banking and insurance

Banks and insurers are prime targets because that's where the money is. They're also heavily regulated, so they employ large security, fraud, risk and compliance teams. For job hunters, financial services is one of the best-paying areas of cyber security, and it values people who understand risk and regulation as much as technology.

Retail and e-commerce

The 2025 attacks on M&S, the Co-op and Harrods showed how exposed retailers are. They handle huge volumes of card payments and customer data, rely on online sales and depend on complex supply chains. One compromised account can stop deliveries, close online shops and empty shelves.

Manufacturing and the supply chain

The Jaguar Land Rover attack showed that when a large manufacturer goes down, thousands of smaller suppliers go down with it. Modern factories run on connected systems known as operational technology (OT). Protecting OT is a growing specialism, and manufacturers are investing in security as never before.

Government, local councils and policing

Central government, councils and police forces hold data on every citizen and run services people can't do without: benefits, council tax, social care and emergency response. Public sector security roles often come with structured training, good pensions and the chance to work on nationally important problems.

Education

Schools, colleges and universities are attacked regularly. They hold data on children and young people, have large numbers of users and often have limited budgets. The government's breaches survey covers education separately because the issue is so widespread.

Energy, water, transport and telecoms

These are critical national infrastructure: the services that keep the country running. Attacks here can affect millions of people at once, which is why the government is introducing tougher rules for these sectors and their suppliers. Security roles in infrastructure are often well paid and may require security clearance.

Small businesses and charities

There are millions of small businesses in the UK, and most have no dedicated security staff. Many outsource security to managed service providers, which is one reason MSSPs are such big employers of junior analysts. The government's breaches survey found that the share of small businesses doing cyber risk assessments fell back to 41% in 2025/26, showing how much basic work is still needed.

How big is the UK cyber security market?

Every year the Department for Science, Innovation and Technology (DSIT) publishes a detailed study of the UK cyber security sector. The 2026 edition, published in May 2026, gives the clearest picture of the market:

Source: DSIT, Cyber Security Sectoral Analysis 2026.

To put that growth in context: in 2020 the sector's revenue was around £8.9 billion. Five years later it is £14.7 billion. Employment in the sector rose from about 46,700 to about 69,600 over the same period.

Two different numbers: the "sector" and the "workforce"

You'll see two employment figures quoted, and it's worth understanding the difference:

• The cyber security sector (around 69,600 people) means people working at companies whose business is cyber security: security consultancies, managed security providers and software vendors.
• The cyber security workforce (around 145,900 people as of December 2025, according to DSIT's 2026 skills study) includes everyone in a cyber role anywhere: the security team at a bank, the NHS, a supermarket, a council or a law firm.

The second number matters more for job hunters. It means more than half of cyber jobs are not at "cyber companies" at all. They are inside ordinary organisations in every industry.

It's not just London

London still dominates, with 33% of cyber firms' office locations and around 30% of sector employment. But just over half of all cyber office locations (51%) are outside London and the South East. The North West has 9%, the South West 8%, and Scotland and the East of England 7% each. Cheltenham (home to GCHQ), Manchester, Belfast, Bristol, Edinburgh and Leeds all have well-established cyber clusters. And a growing share of security monitoring work can be done remotely.

Who is buying cyber security?

Service-led firms, the ones that provide people and expertise rather than software, generated around £8.4 billion of sector revenue in 2025, compared with £6.4 billion for product-led firms. That's important: cyber security is still very much a people business. Tools help, but organisations are paying for skilled humans who can use those tools well.

DSIT also counted 111 UK firms now offering security for AI systems, 68% more than its previous baseline. That's a sign of where some of the next wave of jobs is coming from.

Is cyber security a good career in the UK?

Here's the honest answer, with the good and the bad laid out side by side.

Why it's a good career

1. The pay is well above the UK average. DSIT's 2026 skills study analysed cyber job adverts across 2025 and found an average advertised salary of £60,800 and a median of £58,050, up 6% on the year before. In London the average was £70,200. For comparison, the median salary for full-time employees across the whole UK is under £40,000 (ONS).

2. Demand isn't going away. Attacks are rising, regulation is tightening and businesses are more dependent on technology every year. Core cyber job adverts rose 7% in 2025 to 34,932, around 2,900 new adverts every month, and that doesn't include another 32,000 "cyber-enabled" roles where security is a big part of a wider IT job.

3. Employers are short of skills. DSIT's research found that 57% of UK businesses have a basic technical cyber security skills gap, up from 49% the year before. These are businesses where the people in charge of cyber security lack confidence doing basic tasks like setting up firewalls, controlling who has admin access or removing malware.

4. You don't need a degree. Many cyber professionals came in through IT support, the armed forces, the police, apprenticeships or self-study plus certifications. Employers care far more about what you can do than where you studied.

5. It's meaningful. You are protecting hospitals, schools, charities, people's savings and the companies that employ thousands of people. When it goes right, nobody notices, and that's the point.

6. It's varied, and you can specialise. Some people love the investigative side. Others love breaking things. Others prefer policy, risk and talking to people. There is a path for analytical people, creative people and people-people.

7. Remote and hybrid work is common. Plenty of security monitoring, testing and compliance work can be done from anywhere with a good connection.

The honest downsides

1. The front door is narrow. This is the big one. Only 16% of core cyber security adverts in 2025 asked for less than one year of experience. In 2022 it was 25%. Meanwhile 64% asked for between two and six years. So while there are plenty of jobs overall, competition for the true entry-level ones is fierce.

2. Graduates are not walking straight in. DSIT's research found that among recent cyber security graduates, the unemployment rate was 11%, compared with 6% for all graduates, and only around 30% went into cyber security professional roles. A degree on its own is not the golden ticket it is sold as.

3. Employers are drowning in applications. Employers interviewed for the DSIT study reported high volumes of applications and a growing number of AI-generated CVs, which makes it harder for good candidates to stand out.

4. Entry-level pay is lower than the headlines. The £60,800 average is pulled up by senior and specialist roles. Starting salaries are more modest. We cover real numbers below.

5. Some roles involve shifts. Security operations centres (SOCs) often run 24/7, so junior analyst jobs can involve nights and weekends.

6. You never stop learning. Attackers change their methods constantly, so you have to keep up. Some people love this. Others find it tiring.

The verdict

Cyber security is a strong long-term career with excellent pay progression and real job security. But the bottleneck is getting in. The people who succeed are not necessarily the cleverest. They are the ones who find a way to get real, hands-on experience on their CV before they apply, so they're competing for the 64% of jobs that want experience, rather than fighting over the 16% that don't.

The rest of this guide is about how to do exactly that.

What do cyber security professionals actually do all day?

Job titles in cyber security can be confusing, so let's start with what the work looks like, then map it to job titles.

A day in the life of a junior SOC analyst (example)

This is an illustrative example based on typical entry-level SOC work, not a specific person.

8:00am. Priya logs in and reads the handover notes from the night shift. Two alerts are still open: a user who failed to log in 40 times, and a laptop that tried to connect to a suspicious website.

8:30am. She checks the failed logins in the SIEM (the tool that collects logs from across the company). The attempts all came from the same office building, and the user had just changed their password. It's someone using an old saved password on their phone. False alarm. She documents it and closes the ticket.

9:15am. The suspicious website alert is more interesting. She looks up the website address in a threat intelligence tool. It's linked to a known phishing campaign. She checks the user's email and finds a fake "DocuSign" message. Three other people received it.

10:00am. She escalates to a senior analyst, who agrees it's real. Priya removes the email from all four inboxes, blocks the website, and asks the IT help desk to reset the user's password just in case.

11:30am. Team stand-up. Everyone shares what they're working on. Priya explains the phishing campaign in two minutes, in plain language.

1:00pm. She writes a short incident report: what happened, what she did, and what the company should change. Good report writing is a big part of the job.

2:30pm. Quiet period. She works through a training lab on investigating Windows event logs.

4:00pm. A new alert: someone has been given admin rights on a server outside of normal change processes. She checks with the IT team. It was approved but not logged properly. She flags the process gap.

5:00pm. Handover notes for the next shift.

Notice what the job actually needs: curiosity, careful checking, following a process, clear writing and the confidence to escalate. Yes, there's technical knowledge involved, but it's learnable.

The main families of cyber security roles

Which roles are employers advertising most?

According to DSIT's analysis of 2025 cyber job adverts, the most common core cyber roles advertised were:

1. Security manager: 27% of adverts
2. Security analyst: 26%
3. Security engineer: 21%
4. Security consultant: 10%

For beginners, the security analyst family is the most realistic target. It's the second most advertised role, and junior analyst and SOC roles are where most people start.

Which skills are employers asking for?

The same DSIT research found the skills appearing most often in core cyber adverts in 2025 were:

• Cyber security in general: 66%
• Auditing: 22%
• Governance: 20%
• ISO/IEC 27001 (the international standard for information security management): 20%
• Risk management: 19%
• Incident response: 18%
• Automation: 15%
• AI skills: 9%, more than double the 4% in 2024

That list is a useful reality check. A lot of employer demand isn't for hacking at all. It's for people who understand risk, standards, audits and how to respond when things go wrong. Those are skills career changers from finance, operations, compliance, the police or the forces often already partly have.

Which cyber security jobs can you get as a beginner?

Here are the most realistic first roles for someone breaking in, and what each one involves.

1. SOC analyst (tier 1) or junior security analyst

The classic entry point. You monitor security alerts, investigate the suspicious ones and escalate real incidents. You'll learn SIEM tools such as Microsoft Sentinel or Splunk, and how attacks actually unfold. Many SOCs work shifts.

Typical first certifications: CompTIA Security+, then CySA+.

2. IT support or service desk analyst (the stepping stone)

Not a cyber role on paper, but one of the most common routes in. You learn how real business networks, accounts and devices work, and you'll handle password resets, access requests and suspicious-email reports every day. As the 2025 retail attacks showed, the help desk is on the front line. Many SOC analysts started here.

Typical first certification: CompTIA A+.

3. Junior GRC or information security analyst

Supporting audits, keeping risk registers up to date, checking that policies are being followed, helping with ISO 27001 or Cyber Essentials certification. Great for organised people who write well.

4. Vulnerability management analyst

Running scanning tools, prioritising which weaknesses to fix first and chasing teams to patch. A good bridge between operations and engineering.

5. Junior penetration tester

Very competitive at entry level, and most people get here after a year or two in another security or IT role. If ethical hacking is your dream, start in a SOC or vulnerability role and build up to it.

Typical certification path: Security+, then PenTest+, and later more specialist exams.

6. Cyber security apprenticeship

A real job with training built in. You earn while you learn. The catch: they are competitive, and DSIT's research found cyber-specific apprenticeship enrolments fell 15% between 2023/24 and 2024/25. There are fewer places than people who want them. We cover apprenticeships in more detail in our cyber security apprenticeship guide.

How much do cyber security jobs pay in the UK?

Salaries in cyber security vary a lot by role, location and seniority. Here's what the best available data says.

The overall market

DSIT's analysis of 2025 cyber job adverts found:

• Average advertised salary: £60,800 (up 3%)
• Median advertised salary: £58,050 (up 6%)
• London average: £70,200

One important caveat from the same study: 76% of core cyber job adverts didn't show a salary at all, so these figures are based on the minority that did.

Entry-level salaries

Starting salaries are lower than those averages. Industry salary guides published in 2026 put most UK entry-level cyber roles at roughly £25,000 to £37,000 outside London, with London entry-level roles at banks and consultancies typically £35,000 to £48,000. Payscale's 2026 data puts the average junior SOC analyst base salary at around £29,500.

How fast does it grow?

This is where cyber security really pays off. The biggest salary jumps usually happen between years two and five, once you've moved from monitoring alerts to investigating, engineering or specialising. Experienced analysts, engineers and consultants commonly earn £50,000 to £80,000, and senior leadership and specialist roles can go well beyond £100,000.

Ranges are indicative, drawn from DSIT advertised-salary data and 2026 UK salary guides listed in our sources. Individual offers vary.

What pushes your salary up fastest

• Real, hands-on experience with tools employers use (SIEM, EDR, cloud platforms)
• Recognised certifications at the right stage of your career
• Specialising in high-demand areas like cloud security, incident response or penetration testing
• Security clearance (for government, defence and some financial roles)
• Communication skills: the ability to explain risk to non-technical people is worth real money

What does a cyber security career look like over 10 years?

One of the best things about cyber security is that the first job isn't the destination. It's the launch pad. Here's what a typical progression can look like. Every career is different, but this gives you a sense of the shape.

Years 0 to 1: getting in

You're in your first role: SOC analyst tier 1, IT support with security duties or a junior GRC analyst. You're learning how real organisations work, building confidence with tools and handling a lot of alerts and tickets. Your main job is to become reliable: someone who follows the process, documents properly and knows when to escalate.

Focus: fundamentals, Security+ and CySA+, communication, good habits.

Years 1 to 3: building depth

You move from triaging alerts to investigating them properly. You might become a tier 2 analyst, join an incident response team, move into vulnerability management or take on more responsibility for audits and risk. This is usually where the first big pay rise comes.

Focus: a specialism, deeper technical skills (scripting, cloud, detection), and owning small projects end to end.

Years 3 to 5: specialising

By now you're choosing a direction. Common paths include:

• Detection engineering and threat hunting: building the rules that catch attackers and proactively searching for them
• Incident response: leading investigations when serious attacks happen
• Cloud security engineering: securing Azure, AWS or Google Cloud environments
• Penetration testing and red teaming: attacking systems legally to find weaknesses
• Security architecture: designing secure systems from the start
• GRC and risk leadership: running audit programmes, advising senior leaders and owning compliance

Focus: advanced certifications in your specialism, mentoring juniors and building a reputation.

Years 5 to 10: leading or mastering

From here, people tend to go one of two ways. Some become leaders: SOC managers, heads of security and eventually chief information security officers (CISOs) who report to the board. Others become deep specialists: principal consultants, senior researchers or expert testers who are paid for rare skills. Both paths are well paid. Remember, security manager was the single most advertised core cyber role in 2025.

Focus: leadership, strategy and business skills, or world-class depth in one area.

The important point

Almost everyone at the top of this ladder started with a junior role and real experience. There's no shortcut that skips the first rung, but there are ways to step onto it much faster.

Can you get into cyber security with no experience?

Yes, but not by applying for jobs with a certificate and hoping. Let's be completely honest about why so many people get stuck.

The experience trap

Here's the loop millions of job seekers know too well:

1. You need a job to get experience.
2. You need experience to get a job.
3. Every "entry level" advert asks for one to two years of experience.
4. Go back to step 1.

In cyber security this trap is especially tight. Remember that only 16% of core cyber adverts in 2025 were open to people with less than a year of experience. And many of those still list "some exposure to a SOC environment" or "experience with SIEM tools" as desirable.

Why employers ask for experience (it isn't just being awkward)

Put yourself in a hiring manager's shoes. A junior analyst who has never worked in a real environment needs months of hand-holding. They don't know how tickets flow, how to write an incident note, how to speak to a frustrated user or when to escalate. In security, a mistake can be expensive. So employers use "experience" as a shortcut for "has already proved they can work in a real team, on real systems, without breaking things".

Understanding this changes your strategy. You don't need two years in a job titled "Security Analyst". You need evidence that you can do the work. That evidence can come from several places, which we cover in detail later:

• a structured work placement on real projects
• an IT support role with security responsibilities
• a home lab you've built and documented
• capture-the-flag (CTF) competitions and practical labs
• volunteering to help a charity or small business with security basics

The candidates who get hired from zero aren't the ones with the most certificates. They're the ones who can say in an interview: "Let me tell you about a real incident I investigated."

Who actually breaks in from scratch?

People from all sorts of backgrounds move into cyber security every year. DSIT estimated that around 8,600 people entered the cyber workforce through formal education and training routes in 2025, and its research expects the UK to need about 10,200 new people a year from 2026 to keep up with demand and replace people who leave. Some of the most common backgrounds for career changers include:

• IT support and service desk: the most common stepping stone
• The armed forces and police: discipline, procedure, investigation and often security clearance
• Finance, audit and compliance: a natural fit for GRC and risk roles
• Retail and hospitality managers: handling pressure, people and processes
• Teachers and trainers: explaining complex things simply, which is valuable in awareness and consultancy roles
• Graduates of any subject: analytical thinking and writing skills

Do you need a degree to work in cyber security?

No. Most employers in cyber security do not require a degree for junior roles, and many senior professionals don't have one. What they want is evidence of skills: certifications, practical experience and the ability to explain your thinking.

What about a cyber security degree?

A degree can help, especially for graduate schemes at large employers and some government roles. But the numbers show it isn't enough on its own:

• The UK produced around 7,950 cyber security graduates in 2023/24, up 14%, with 24,770 students enrolled.
• Among recent graduates, 60% were in full-time work, but the unemployment rate was 11%, almost double the 6% average for all graduates.
• Only around 30% went into cyber security professional roles.

Source: DSIT, Cyber Security Skills in the UK Labour Market 2026.

That's not a criticism of degrees. It shows the same problem everyone else faces: employers want practical experience, and most degrees don't provide enough of it.

If you already have a degree in another subject

You're in a good position. Your degree proves you can learn, research and write. Pair it with two or three industry certifications and some real hands-on experience, and you can compete with cyber graduates. We've written a dedicated guide on graduate cyber security jobs if that's you.

Do you need to know coding for cyber security?

Not to start. Plenty of entry-level roles, especially in SOC monitoring, GRC and IT support, need little or no coding.

That said, a little scripting goes a long way as you progress:

• PowerShell helps you investigate and automate tasks on Windows systems.
• Python is useful for automating repetitive analysis, working with data and, later, penetration testing.
• Bash helps on Linux systems.
• KQL or SPL are query languages used inside SIEM tools. They're closer to Excel formulas than to "real" programming.

Automation appeared in 15% of core cyber adverts in 2025, so it's worth learning the basics in your first year or two. But don't let "I can't code" stop you from starting. Learn it alongside the job.

Which cyber security certifications should you get first?

Certifications are the language employers and recruiters use to filter CVs. The right ones, in the right order, make you visible. The wrong ones, or too many with no experience behind them, waste money.

The CompTIA ladder: the most common route for beginners

CompTIA certifications are vendor-neutral (not tied to one company's products) and are widely recognised by UK employers and recruiters. The usual order is:

Security+ is the one most often named in UK junior security adverts. If you only take one certification before applying for security analyst roles, make it that one. You can read our full CompTIA Security+ guide and CompTIA Network+ guide.

Do you need A+ and Network+ first?

Not strictly. Some people go straight to Security+. But if you're coming from a non-IT background, A+ and Network+ build the foundations that make Security+ (and real security work) make sense. Most security work is about understanding what "normal" looks like on a network so you can spot what isn't. You can't do that without the basics.

Other entry-level options you'll see mentioned

• ISC2 Certified in Cybersecurity (CC): a beginner-level certification from the organisation behind the CISSP.
• Google Cybersecurity Certificate: an online beginner course; useful learning, but less recognised by UK employers than Security+.
• Microsoft SC-900: foundations of Microsoft security, useful if you're targeting Microsoft-heavy employers.
• Cyber Essentials: this is a UK government-backed certification for businesses, not individuals, but understanding it is valuable for GRC roles.

The certification mistake to avoid

Collecting certificate after certificate with no practical experience. We regularly speak to people with three or four certifications who still can't get an interview. Recruiters see "certified, no experience" all day. Certifications open the door. Experience gets you through it. Our cyber security qualifications guide covers this in more depth.

How long does it take to learn cyber security?

It depends on where you're starting and how much time you have. Here are realistic timelines for someone studying around an hour or two a day.

"Job-ready" doesn't just mean "passed the exams". It means you can talk confidently in an interview about real work you've done. That's why the fastest routes run training and experience at the same time, rather than one after the other.

Why most people take longer than they need to

The most common pattern we see:

1. Spend six months on courses.
2. Pass a certification.
3. Spend another six months applying for jobs with no response.
4. Realise employers want experience.
5. Start looking for experience, a year after starting.

If you build experience from week one, you skip most of that dead time.

How do you get real cyber security experience?

This is the most important section of the guide. Here are the routes that actually work, from free to structured, with the honest pros and cons of each.

1. Build a home lab (free to low cost)

A home lab is a small practice network you build on your own computer using free virtualisation software (such as VirtualBox or VMware Workstation). You might set up:

• a Windows machine and a Linux machine
• a free SIEM such as Wazuh or the Elastic stack collecting their logs
• a deliberately vulnerable machine to practise on
• a basic firewall such as pfSense

Then you attack your own lab, watch the alerts appear and write up what you found.

Pros: free or cheap, teaches you a lot, gives you things to talk about. Cons: employers know it's not a real business environment. It's good evidence of interest, but on its own it rarely counts as "experience".

Tip: document everything. A short write-up on a blog or GitHub, with screenshots, turns a hobby into evidence.

2. Practical labs and capture-the-flag (CTF) challenges

Platforms like TryHackMe, Hack The Box and Blue Team Labs give you guided, hands-on exercises in a browser: investigating logs, analysing phishing emails, finding vulnerabilities. CTF competitions turn these into timed puzzles.

Pros: structured, fun, recognised by many technical hiring managers. Your rank or completed paths can go on your CV. Cons: still simulated. Strong for skills, weaker as proof you can work in a real team.

3. Volunteer your skills

Charities, community groups, local clubs and small businesses often have no security help at all. With permission, you could help them:

• turn on multi-factor authentication for email accounts
• write a simple password and phishing policy
• check their website and devices are up to date
• work through the Cyber Essentials question set with them
• run a short phishing awareness session for staff

Pros: real organisation, real people, real outcomes you can talk about. Cons: it takes effort to find, there's no structure or mentor, and you must be careful to stay within what you've been asked and allowed to do. Never test systems you haven't been given written permission to test.

4. Get an IT support job first

Taking a help desk or IT support role and then moving into security after 6 to 18 months is one of the most reliable routes in. You'll handle real users, real tickets, account access and suspicious emails. Ask to shadow the security team, volunteer for security-related tasks and get Security+ while you're there.

Pros: paid, real experience, a well-trodden path. Cons: it adds time, and IT support roles are competitive too. Some people get stuck in support for years. Read our entry-level cyber security jobs guide for how to plan the move.

5. Apprenticeships and internships

A cyber apprenticeship gives you a real job and training at the same time. Internships give you a few weeks or months inside a company.

Pros: excellent if you get one. Cons: very competitive, often limited to certain ages or locations, and apprenticeship places have been falling. Internships are often aimed at current students. See our guides to cyber security apprenticeships and cyber security internships.

6. A structured remote work placement

This is the route we built Experiencely around, so we'll be upfront about that. A structured placement puts you on a live project for a real business, with a mentor, for a fixed period. You do real work, such as reviewing alerts, documenting incidents, supporting vulnerability scans or helping with security policies, and you finish with references and examples you can talk about in interviews.

Pros: real business, real work, a mentor, done remotely around your current job, and it fixes the "no experience" line on your CV. Cons: it's a paid programme rather than free, so it's an investment. Make sure any provider is clear about what the work involves, how long it lasts and what happens if you don't get a job.

Which route is right for you?

Many successful candidates combine two or three of these. A typical strong profile looks like this:

• Certifications: Security+ (plus A+ and Network+ if new to IT)
• Practical skills: a home lab or a few completed lab paths, written up
• Real experience: three months or more of hands-on work on a real project, in a support role or through volunteering
• Story: two or three specific examples you can talk through in an interview

A step-by-step plan to break into cyber security

Here's a realistic plan for someone starting with no experience and around an hour a day. Adjust the pace to suit your life.

Weeks 1 to 2: get clear on your target

• Read job adverts for "junior security analyst", "SOC analyst" and "IT support analyst" in your area and remotely. Save 10 of them.
• Highlight the skills, tools and certifications that come up again and again.
• Pick a target role. For most people this is SOC analyst or junior security analyst, with IT support as a back-up.
• Set up a LinkedIn profile that says what you're working towards, not just what you've done.

Months 1 to 2: build your foundations

• Start CompTIA A+ (or go straight to Network+ if you already know your way around computers).
• Learn how networks work: IP addresses, DNS, ports and protocols, and how a website request actually travels.
• Set up a simple home lab with a Windows and a Linux virtual machine.
• Start getting experience now, not later. This is the step most people skip.

Months 2 to 4: move into security

• Study for Security+.
• Learn the basics of a SIEM tool and how to read logs.
• Learn common attacks: phishing, brute force, malware, privilege escalation.
• Document every piece of hands-on work you do, with dates, tools and outcomes.

Months 4 to 6: specialise and apply

• Move on to CySA+ if you're aiming for SOC roles.
• Rewrite your CV around your real experience and projects (see the CV section below).
• Prepare three STAR stories from your hands-on work (Situation, Task, Action, Result).
• Apply to 5 to 10 well-matched roles a week, rather than 50 random ones.
• Follow up applications on LinkedIn with a short, polite message to the hiring manager.

Month 6 onwards: keep momentum

• Keep practising, keep documenting, keep applying.
• Consider PenTest+ or a cloud security certification once you're working.
• Join a local cyber community such as a BSides event, an OWASP chapter or a meet-up. Many jobs are filled through people who know people.

Is it too late to get into cyber security at 30, 40 or 50?

No. Cyber security is one of the most career-changer-friendly areas of tech, because so much of the job depends on judgement, communication and understanding how organisations work: things you build over a career.

What career changers bring that 21-year-olds don't

• Professionalism: you already know how to handle a manager, a deadline and a difficult customer.
• Business understanding: you know why a breach of payroll data is a disaster, not just a technical problem.
• Communication: explaining risk to a board or a frightened member of staff is a huge part of the job.
• Domain knowledge: someone from finance understands financial fraud; someone from healthcare understands patient data; someone from retail understands payment systems.

Making the switch work

• Lead with your transferable skills. A former retail manager who handled incidents, audits and staff training has more relevant experience than they think.
• Target roles that use your background. Ex-auditors and compliance staff often move fastest into GRC. Ex-police into investigations and incident response. Ex-IT into SOC.
• Be realistic about the first salary. You may take a short-term step sideways or down. The trade-off is a career where pay typically rises fast once you have two or three years behind you.
• Get experience while you're still employed. A remote placement or volunteering you can fit around your current job removes the risk of quitting before you have an offer.

Our guide to how to get into cyber security covers the career change route step by step.

I'm a graduate. How do I turn my degree into a cyber security job?

Whether your degree is in cyber security, computing or something completely different, the challenge is the same: graduate competition is intense, and employers want proof you can work in a real environment.

What to do in your first three months after graduating

1. Get Security+ if you don't have it. It's the clearest signal to UK employers.
2. Get real experience fast. A three-month placement, an internship or even a part-time IT support job changes how recruiters see your CV.
3. Turn your dissertation or final project into a portfolio piece if it was relevant. Write a short, plain-English summary.
4. Apply for graduate schemes early. Large employers and government departments often open applications many months before the start date.
5. Don't ignore smaller employers. Managed security service providers (MSSPs) and mid-sized companies often hire juniors who can start quickly.

If you're stuck in a non-graduate job

Lots of graduates end up in retail, hospitality or warehouse work while they apply. There's no shame in it, and it can be useful: handling pressure and people is valuable. But don't let it become a holding pattern. Use evenings or mornings to build certifications and experience, so that in three to six months your CV looks completely different.

How do you write a cyber security CV with no experience?

Recruiters often spend just seconds on a first look at a CV. Here's how to make those seconds count.

Structure that works

1. Name and contact details, plus a LinkedIn link and a GitHub or blog link if you have one.
2. A three-line profile that says what you are aiming for and why you're credible. For example: "Security+ certified junior analyst with three months' hands-on experience monitoring alerts and documenting incidents on a live client project. Background in retail operations management. Looking for a SOC analyst role."
3. Certifications, near the top, with dates.
4. Relevant experience: placements, projects, volunteering and IT support work, written like a job, with specific tasks and tools.
5. Technical skills: tools and technologies you have actually used (SIEM tools, Windows and Linux, Active Directory, Wireshark, Nmap and so on).
6. Previous employment, with transferable achievements, kept short.
7. Education.

Turn tasks into evidence

Weak: "Monitored security alerts."

Strong: "Triaged security alerts in Microsoft Sentinel for a live client project, identified a phishing campaign targeting four users and documented the incident and recommended actions for the client."

Use real numbers where you have them. Name the tools. Say what happened as a result.

What to avoid

• Long lists of every course you've ever started. Pick the relevant ones.
• "Passionate about cyber security" with no evidence. Show it instead.
• Generic AI-written CVs. Employers are reporting a rise in these, and they all sound the same. Write it in your own words.
• A home lab described as "work experience". Be honest. Call it a project. Honesty matters a lot in a profession built on trust.

Our free CV review can check yours before you send it.

What questions come up in junior cyber security interviews?

Interviews for junior roles usually mix technical questions, scenario questions and competency questions. Here are common examples and what the interviewer is really looking for.

"What is the difference between a vulnerability, a threat and a risk?" A vulnerability is a weakness (an unpatched server). A threat is something that could exploit it (a ransomware group). Risk is the likelihood and impact of that happening. They want to see clear thinking, not textbook definitions.

"Walk me through what happens when you type a website address into a browser." This tests networking basics: DNS lookup, TCP connection, HTTPS and the server response. Network+ knowledge pays off here.

"You see an alert that a user logged in from the UK and then from Brazil 10 minutes later. What do you do?" They want your process: check whether it's a VPN or travel, look at what the account did, check for other signs of compromise, contain if needed (for example, reset credentials or disable the session), escalate and document.

"How would you spot a phishing email?" Check the sender address, links, urgency, unusual requests and attachments. Bonus points for mentioning email headers and reporting processes.

"What's the CIA triad?" Confidentiality, integrity, availability. Give a real-world example of each.

"Tell me about a time you dealt with a stressful situation." A competency question. Use a STAR story. This is where real experience on a placement or in a job is gold: you have a genuine story rather than a hypothetical one.

"What have you been doing to keep learning?" Mention specific labs, news sources (the NCSC website is a good one), podcasts or projects.

"Why cyber security?" Be genuine. "I like problem solving and I want a career that matters" beats "I heard it pays well", even if both are true.

Where are the cyber security jobs in the UK?

By location

London has the most jobs and the highest pay, with about a third of cyber firms' office locations. But more than half are elsewhere, with strong clusters in:

• The South East and Thames Valley (Reading, Oxford, Guildford)
• Cheltenham and the South West (around GCHQ, Bristol)
• Manchester and the North West
• Scotland (Edinburgh and Glasgow)
• Northern Ireland (Belfast has a well-known cyber cluster)
• Yorkshire, the Midlands and Wales, all growing

By type of employer

• Managed security service providers (MSSPs): run SOCs for many clients at once. A common first employer for analysts.
• Banks, insurers and financial services: big security teams and strong pay.
• The public sector: central government, the NHS, local councils and policing. Often more structured training.
• Defence and government contractors: often require security clearance.
• Consultancies: advisory and testing work across many clients.
• Every other industry: retail, manufacturing, education, energy and charities all need security people, as 2025 showed.

Remote work

Remote and hybrid roles are common, particularly for SOC monitoring, GRC and consultancy. Fully remote entry-level roles are more competitive because you're up against candidates from across the country, so strong evidence of experience matters even more.

What does the future of cyber security careers look like?

Will AI replace cyber security jobs?

Unlikely, at least in the way people fear. AI is changing the work, not removing the need for people. It's being used to sort alerts faster and summarise incidents, which means junior analysts spend less time on repetitive tasks and more on judgement. At the same time, attackers are using AI too, and businesses adopting AI need people to secure it.

DSIT's research found that AI skills appeared in 9% of core cyber adverts in 2025, more than double the year before, and that the number of UK firms offering security for AI systems rose 68%. The smart move is to learn how AI tools are used in security alongside your core skills.

Regulation is increasing

The government has been bringing in stronger rules for organisations that provide essential services and the companies that supply them, including the Cyber Security and Resilience Bill. More regulation means more demand for people who understand compliance, risk and incident reporting.

Cloud keeps growing

As more businesses run on Microsoft Azure, Amazon Web Services and Google Cloud, cloud security skills are increasingly valuable. Once you're established, cloud security is one of the strongest specialisms to move into.

The skills gap is changing, not disappearing

The headline shortage of cyber workers has eased since the post-pandemic hiring boom, as more graduates and trainees have come through. But DSIT's research shows the gap in experienced, practical skills remains. Employers told researchers that candidates combining technical skills with people skills are especially hard to find. In other words: the market isn't short of people with certificates. It's short of people who can actually do the job.

How to choose a cyber security course or training provider

The cyber training market is crowded, and quality varies hugely. Before you hand over any money, ask these questions.

1. What exactly do I get at the end?

A certificate of completion from a course provider is not the same as an industry certification. Check whether the course prepares you for recognised exams such as CompTIA Security+, and whether exam vouchers are included or cost extra.

2. Is there real experience, or just labs?

Labs and simulations are useful, but they're not the same as working on a real project for a real business. Ask specifically: "Will I work on live projects for real organisations? For how long? What will I actually do?"

3. Who will help me when I get stuck?

Self-paced video courses have high drop-out rates because people get stuck and lose momentum. Check whether there's a named mentor or tutor, and how quickly they respond.

4. What happens after the training?

Do they help with your CV, LinkedIn and interview preparation? Do they introduce you to employers? Or does support end when the videos do?

5. What's the guarantee, and what are the conditions?

Be wary of anyone promising a guaranteed job or a specific salary with no conditions. A fair guarantee has clear, reasonable terms, such as completing the programme and actively applying, and those terms should be written down before you pay.

6. Can I fit it around my life?

If you're working full-time or have caring responsibilities, check the real weekly time commitment and whether sessions are at fixed times or flexible.

7. What do real past students say?

Look for reviews on independent sites such as Trustpilot and Google, not just quotes on the provider's own website. Look for specific stories, not just star ratings.

8. Is the price clear?

Watch out for hidden costs: exam fees, resits, "premium" support tiers, or finance agreements with high interest. Ask for the total cost in writing.

9. Is it free, and is free right for you?

There are excellent free resources for learning, and our guide to free cyber security courses lists some of them. Free courses are great for finding out whether you enjoy the subject. Where they usually fall short is structure, mentoring, exam vouchers and, most of all, real experience. Our cyber security course guide and cyber security training guide go into more detail on choosing.

What are the most common mistakes beginners make?

1. Studying forever and never applying. There is always another course. At some point you have to start.
2. Collecting certifications instead of experience. Three certificates and no experience loses to one certificate and three months of real work.
3. Applying for 200 jobs with the same CV. Tailor your CV to each role and apply to fewer, better-matched jobs.
4. Aiming straight for penetration testing. It's the most glamorous role and the hardest to start in. Most testers start in other roles first.
5. Ignoring IT support. It's not a step backwards. It's one of the most reliable routes in.
6. Underselling previous experience. Your old job is full of transferable skills. Translate them.
7. Testing systems without permission. Never, ever do this. It's illegal under the Computer Misuse Act 1990 and will end a career before it starts.
8. Going it alone. Mentors, communities and structured programmes shorten the journey enormously.
9. Falling for "guaranteed six-figure salary" promises. If it sounds too good to be true, it is. Ask any provider exactly what's included and what happens if it doesn't work out.

How does Experiencely help you break into cyber security?

We built Experiencely because we kept seeing the same problem: talented people with certificates and no way to get the experience employers demand.

Our Cyber Security programme puts training and real experience side by side:

• Five CompTIA certifications: A+, Network+, Security+, CySA+ and PenTest+, with training, labs, practice exams and exam vouchers included.
• A live, remote placement within 48 hours: you're placed on a real security project for a real business, not a simulation.
• Three months of hands-on experience at around one hour a day, so you can fit it around your current job.
• A mentor when you get stuck.
• CV and interview support built around the real work you've done.
• A 60-day guarantee: complete your experience, apply actively with our support, and if you're not hired within 60 days, you get your money back. Read the full terms.

One price for the whole programme: £2,495. Already hold some of the certifications? Skip them. Same programme, same price, same guarantee.

You can see the full details on our Cyber Security programme page, watch our free webinar, or book a free call to talk through whether it's right for you.

Cyber security vs IT support vs cloud vs networking: which path suits you?

If you're new to tech, it can be hard to tell these areas apart. Here's a simple way to think about them, using the house analogy again.

The good news is that these paths overlap heavily. Security people need to understand networks, cloud and how users work. Many people start in IT support or networking and move into security, and many security people later specialise in cloud security. Whatever you start with is rarely wasted.

If you love helping people and solving everyday problems, IT support is a great start, with security as the next step. If you're drawn to investigation, risk and protecting things, go for security from the start. If you like building and designing systems, networking or cloud first, then security engineering.

Cyber security jargon, explained simply

You'll see these terms in job adverts, courses and interviews. Here's what they mean in plain English.

• Active Directory (AD): Microsoft's system for managing user accounts and permissions across a company's network. Attackers love it because controlling AD often means controlling everything.
• Blue team: the defenders. SOC analysts, incident responders and security engineers.
• Red team: the attackers, hired legally to test defences. Penetration testers and red teamers.
• Purple team: red and blue working together to improve defences.
• CVE: a public ID number for a known software vulnerability, such as CVE-2024-12345. Used to track and patch weaknesses.
• Cyber Essentials: a UK government-backed certification showing a business has basic protections in place. Required for many government contracts.
• DDoS (distributed denial of service): flooding a website or service with so much traffic that it falls over.
• EDR (endpoint detection and response): software on laptops and servers that spots and stops suspicious behaviour. Examples include Microsoft Defender for Endpoint and CrowdStrike.
• Firewall: a gatekeeper that controls which traffic is allowed in and out of a network.
• GRC (governance, risk and compliance): the policy, audit and risk side of security.
• Incident: a security event that has actually caused, or could cause, harm, as opposed to a false alarm.
• IOC (indicator of compromise): a clue that an attack has happened, such as a malicious file, a suspicious IP address or an unusual login.
• ISO 27001: the international standard for managing information security. Appeared in 20% of core UK cyber adverts in 2025.
• Malware: any malicious software: viruses, ransomware, spyware and so on.
• MFA (multi-factor authentication): needing a second proof of identity, such as a code on your phone, as well as a password. One of the simplest and most effective defences.
• MITRE ATT&CK: a free, widely used library of the techniques attackers use. Analysts use it to describe and investigate attacks.
• MSSP (managed security service provider): a company that runs security for other organisations, often including a 24/7 SOC.
• NCSC: the National Cyber Security Centre, the UK's lead organisation for cyber security and part of GCHQ.
• Patch: a software update that fixes a vulnerability.
• Penetration test (pen test): an authorised, simulated attack to find weaknesses.
• Phishing: tricking people into clicking links, opening files or giving away information, usually by email. Smishing is by text; vishing is by phone.
• Ransomware: malware that locks or steals data and demands payment.
• SIEM (security information and event management): a tool that collects logs from across a network and raises alerts. Microsoft Sentinel and Splunk are well-known examples.
• SOC (security operations centre): the team, and often the room, that monitors an organisation's security around the clock.
• Social engineering: manipulating people rather than computers, for example pretending to be the boss on the phone.
• Threat intelligence: information about who attackers are, what they're doing and how, used to defend better.
• Triage: quickly assessing alerts to decide which need attention first.
• Vulnerability: a weakness that could be exploited.
• Zero-day: a vulnerability attackers are exploiting before the software maker has released a fix.

Don't try to memorise all of this at once. You'll pick it up naturally as you study and, especially, as you do real work.

The bottom line

Cyber security is one of the best careers you can move into in the UK right now. The market is large and growing, the threat isn't going away, and the pay rewards people who stick with it.

But the honest truth is this: the skills are the easy part. Getting in is the hard part. With only around one in six core job adverts open to people with less than a year of experience, the people who succeed are the ones who stop waiting for permission and get real experience on their CV.

Pick your target role. Get the foundations. Get certified. And above all, get real, hands-on experience as early as you can. Do that, and you won't be competing for the narrow front door. You'll walk through the wider one.

Frequently asked questions

Sources

Figures are taken from the sources below. Salary ranges are indicative and individual offers vary. Last checked 9 November 2026.

1. DSIT: Cyber security sectoral analysis 2026
2. DSIT: Cyber security skills in the UK labour market 2026
3. DSIT and Home Office: Cyber security breaches survey 2025/2026
4. NCSC: Annual Review 2025, incident management
5. NCSC: UK experiencing four nationally significant cyber attacks every week
6. Computer Weekly: Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors
7. The Guardian: Jaguar Land Rover hack has cost UK economy £1.9bn
8. ICAEW: Cyber security industry profile
9. TryHackMe: Cyber security salaries in 2026
10. Payscale: Junior SOC analyst salary in the UK