To get into cybersecurity, start from the job closest to it, add one certification that fits your real stage, and read every clearance line before you spend time on an application. Most people do not enter from zero. The Bureau of Labor Statistics says many information security analysts have worked in an IT department, often as network and computer systems administrators, and it lists "less than 5 years" of related work experience for the job. The certification ladder is steeper than most advice admits. ISC2's entry credential asks for no work experience, while CompTIA recommends Network+ and two years in a security or systems administrator role before Security+. A clearance is a gate no course opens, because, in the words of the Congressional Research Service, "an individual may not obtain or initiate a security clearance on his or her own."
Where people actually enter from
ISC2 asked 929 hiring managers in six countries in December 2024 who they would consider for entry and junior roles. 90% would consider someone with only IT work experience. 89% would consider someone with only an entry-level cybersecurity certification. 81% would consider someone with only an IT, cybersecurity or computer science education. ISC2 sells certifications, and "would consider" is not "hired", so read the order more than the size. A degree alone does not lead that list, and BLS adds that some workers enter with a high school diploma plus training and certifications, even though a bachelor's degree is typical.
So the useful question is which job you can move sideways from. This table is our reading of the common routes, not survey data.
| You work as | Closest security work | Add first |
|---|---|---|
| Help desk or desktop support | SOC analyst, first tier | Networking basics, one detection write-up |
| Systems or network administrator | Vulnerability management, identity and access, security engineering | Security+, plus a patching or hardening number from your real job |
| Software developer | Application security | Threat models and secure code reviews you can show |
| Auditor, compliance or risk analyst | Governance, risk and compliance (GRC) | One control framework you can discuss in detail |
| Military or federal, already cleared | Cleared SOC or contractor roles | The right wording for your clearance status |
| Outside technology | Help desk, or GRC if you know a regulated industry | ISC2 CC or CompTIA A+ |
If you are coming from outside technology altogether, our career change guide covers how to present the move. The GRC route has more in common with getting into compliance than with hacking, and it is the one most beginner guides leave out.
Certifications by stage
Here is what each issuer says about its own credential, as read on 9 November 2026.
| Your stage | Credential | What the issuer asks | Upkeep |
|---|---|---|---|
| No IT job yet | ISC2 Certified in Cybersecurity | "No Work Experience Required" | 45 CPE credits over three years, $50 a year if it is your only ISC2 credential |
| Aiming at support work | CompTIA A+ | Two exams, Core 1 and Core 2. Lists help desk support specialist as the role | Not stated on that page |
| Some support time | CompTIA Network+ | Recommends A+ and 9 to 12 months of hands-on experience | Not stated on that page |
| About two years in admin or security | CompTIA Security+ | Recommends Network+ and two years in a security or systems administrator role | Good for three years, 50 CEUs to renew |
| Five years in | CISSP | Five years cumulative, full-time, in two or more of eight domains. A degree or an approved credential can cover up to one year | 120 CPE credits over three years, $135 a year |
Three things in that table run against common advice.
Security+ is not aimed at beginners. Nearly every guide calls it the starter cert. CompTIA's own page for the next version describes the candidate as a "security administrator with two years of hands-on experience." You may sit it sooner, because that is a recommendation. But it tells you what the credential claims, and 84% of organizations in ISC2's survey use skills assessments or tests for entry and junior applicants. Passing the exam will not carry you through those by itself.
The exam is changing now. CompTIA expects to launch V8 (SY0-801) on or around 17 November 2026. The English V7 exam (SY0-701) retires on 11 June 2027. If you are partway through V7 material, you have time to finish it. If you have not started, check which version your study material covers before you pay for it.
CISSP cannot be a first step. You can pass the exam early and become an Associate of ISC2, with "six years to earn five years required experience." An Associate is not yet a CISSP, and your resume has to say so.
If you want defense contractor work, note why Security+ keeps appearing in those postings. CompTIA maps it to DoD 8140 work roles including cyber defense analyst and incident responder. Outside that world, one credential that fits your stage is enough to start applying. A third cert seldom fixes what a lab or a job would.
Security clearances, plainly
A clearance is not a credential you earn. It is a government finding that you are eligible for access to classified information. Executive Order 13526 defines the three levels by the harm disclosure could cause: "damage to the national security" for Confidential, "serious damage" for Secret, and "exceptionally grave damage" for Top Secret. SCI and special access programs are categories commonly associated with the Top Secret level.
Five facts cover most of what a job seeker needs.
- Someone else starts it. The Defense Counterintelligence and Security Agency (DCSA) says a customer agency submits the questionnaire that begins vetting. It runs over two million background investigations a year. For a company's staff, the employer sponsors, and it may sponsor only its own employees or consultants.
- Citizens, with rare exceptions. "Generally, only U.S. citizens are eligible," says CRS. The contractor rule allows a Limited Access Authorization when someone has "unique or unusual skills or expertise that is urgently needed" and no cleared or clearable citizen is readily available. It does not cover Top Secret.
- It takes a while. Boeing's careers site says "a few months to over a year" depending on level. The timing figures we found in the CRS report are from fiscal 2019: an average of 125 days for Secret and 172 for Top Secret, for the fastest 90%. Those are old. You may be able to start under temporary eligibility, which the rule caps at one year unless approved.
- Eligible is not the same as in access. Access to specific material also takes a need to know and a signed nondisclosure agreement.
- It does not end at approval. About 4 million people are enrolled in continuous vetting, which DCSA describes as regularly reviewing a person's background.
One sentence in the contractor rule explains the catch newcomers run into. Requests "will not be used to establish a cache of cleared employees." A company cannot clear you on speculation, so when a contract needs someone today, it looks for a person who is already cleared. That leaves two realistic ways in: military or federal service, or a contractor job that will sponsor you.
How to read the line in a posting
This is the part worth saving, because each phrase calls for a different decision.
| The posting says | What it means | Should you apply |
|---|---|---|
| "Active Secret required" or "active TS required" | Boeing's answer to working without one: "then no" | Only if you hold it now |
| "Ability to obtain a clearance" | The employer may sponsor you at hire if you appear to meet the criteria | Yes, if you are a citizen and fit the rest |
| "TS/SCI", with or without polygraph | Access on top of Top Secret | Only if you hold it |
| "Public trust" | A risk rating under 5 CFR part 731 about harm to government service, not national security. Some jobs carry both | Read the posting, since this is different vetting |
| "U.S. person" | An export-control term. The definition includes lawful permanent residents and protected individuals. It is not a clearance | Yes, if you fit the definition |
| "Clearance a plus" | Not a requirement as written | Yes, if you fit the rest |
This is general information, not legal advice. The employer's facility security officer can speak to your own case.
Why entry level is often not
The label is cheap to apply, and the work behind it is not. In ISC2's survey, 56% of hiring managers said it takes four to nine months to train an entry-level hire to handle tasks independently, and 45% spent $1,000 to $4,999 on that training. A team under pressure has every reason to label a role entry level and then pick the applicant who needs the least of that.
AI adds some uncertainty. In an ISC2 survey from May 2026 of 856 professionals who use AI at work, 56% said it has reduced the need for entry-level roles, and 53% said it is creating new entry-level opportunities. That is opinion, not hiring data, and both can be true at once.
The growth outlook is real. BLS projects information security analyst jobs growing 21% from 2025 to 2035, against 3% for all occupations, with about 14,100 openings a year. That figure counts one occupation, and it does not by itself lower the bar for a first seat.
So ignore the label and read the verbs. "Triage alerts under a senior analyst" describes an entry role. "Own incident response and join the on-call rotation" does not, whatever the title says. Before you apply, ask three things: who would train you, who you would report to, and whether you would ever be alone on shift.
A home lab worth showing
A lab counts when it produces something a stranger can read. "Installed Kali" produces nothing. Build toward one artifact, using only systems you own or have written permission to test.
- Set up two or three virtual machines: a Windows endpoint with Sysmon, a Linux server, and a log collector such as Wazuh or Security Onion.
- Pick one technique from MITRE ATT&CK, which MITRE calls "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations." Simulate it with a safe test such as Atomic Red Team.
- Write a detection for it. Record what it catches, what it misses, and how many false alarms it raised on a week of normal lab activity.
- Write a one-page incident report. Borrow the vocabulary from NIST SP 800-61 Rev. 3, published in April 2025, which replaced the 2012 version.
- Publish it in a public repository and link it from your resume, marked clearly as a lab.
For the GRC route, skip the virtual machines. Invent a small business, map a dozen controls from a framework such as NIST SP 800-53 to it, and write a risk register with owners and dates. A sample resume line:
Sample: Lab project, self-hosted. Wrote and tuned a detection for one ATT&CK credential access technique, with 3 false alarms over 7 days of normal activity. Public write-up linked.
What the numbers say about security roles
ApplyEze polls more than 100,000 employer boards directly, and the chart shows what that pool held in a 1% sample on 9 November 2026. The security family came to 274 sampled rows, which is roughly 27,500 open roles. About 13% were fully remote. That is above the 8% across all jobs and well below software engineering at about 24%, so this field is less remote than its reputation. The median advertised pay was about $141,000.
Those figures are rough. A second sample differed by up to about 15% per family, and the family is labelled security, so it may be wider than cybersecurity. Only about 15% of all postings state pay, so the median is what employers advertise and not what a first job pays. For comparison, BLS reports a median of $129,180 in May 2025 for information security analysts, a narrower group.
Roughly 53% of those roles sit on an application system ApplyEze can apply to. The rest you would apply to by hand.
How to apply when a clearance is required
Sort your list using the table above, and put your hours into roles you can actually take. If you hold a clearance, state its status exactly, using the wording in our cybersecurity resume guide. If you do not, never round up on a form. Under the contractor rule, the government determines whether you were previously cleared, so a wrong "yes" falls apart once anyone checks it.
ApplyEze handles this the same way. It does not claim a security clearance you did not save, and a posting requiring one you lack is skipped, at no credit. That is the right behavior for a plain reason: the fact gets checked, so a false claim cannot help you, and it spends a recruiter's time and yours.
On the rest of the form, hard facts come from your profile. When a required question is not covered by your saved answers, ApplyEze still fills it rather than stopping the run, so that answer may not come from you. Fill in your saved answers, use dry run first, and read your receipts. ApplyEze does not skip a job because the posting says it will not sponsor, and sponsorship questions use the answers you saved. Some employers ask applicants not to use AI or automation. Whether to apply there is your call.
You pick the matches and queue them in the desktop app, which fills and submits each form on your computer while it stays on and awake. Workday and Oracle jobs stay hidden until you connect an application inbox, because those sites email a code. Start with the postings the table above says are open to you. If you would rather spend your evenings in a home lab than on forms, your first 50 applications are free, once per email address with no card, and a credit is used only when an application is confirmed as Submitted.