To start a career in cybersecurity, build IT foundations first (networking, operating systems, how the internet works), earn an entry-level security certification such as CompTIA Security+, practise in hands-on labs, and target entry roles such as SOC analyst, IT security support or vulnerability analyst. Most career changers need 9–18 months. IT support experience is a common and effective stepping stone.

Key takeaways

• Security sits on top of IT. Networking and operating system basics come first.
• Security+ is the most common first security certification.
• Hands-on lab practice is what interviewers probe.
• SOC analyst is the classic entry point; specialise later.

The cybersecurity roadmap

Stage	Learn	Typical proof	Time
1. IT foundations	Networking (TCP/IP, DNS, ports), Windows and Linux, hardware basics	CompTIA A+ / Network+ (optional) or equivalent experience	2–4 months
2. Security fundamentals	Threats, controls, cryptography basics, identity, risk	CompTIA Security+	2–4 months
3. Hands-on skills	SIEM, log analysis, packet capture, vulnerability scanning	Home lab write-ups, platform badges	3–6 months (ongoing)
4. First role	SOC analyst, IT security support, junior vulnerability analyst	Applications, interviews	1–4 months
5. Specialise	Cloud security, pentesting, GRC, incident response	Specialist certifications	Ongoing

Stage 1: IT foundations

You can’t protect what you don’t understand. Learn how networks route traffic, what DNS and common ports do, how users and permissions work on Windows and Linux, and how to use the command line. If you’re new to IT, IT certifications for beginners shows where to start.

Stage 2: security fundamentals and Security+

Security+ covers threats, attacks, security architecture, operations and governance at an entry level. It is recognised by many employers and listed in many entry-level job descriptions. Full details are in our CompTIA Security+ guide.

Stage 3: hands-on practice

• Build a home lab: virtual machines, a free SIEM, and logs from your own devices.
• Use legal practice platforms with guided security exercises (blue-team and red-team rooms).
• Write up what you do. A short blog post on investigating a simulated phishing incident is strong portfolio evidence.
• Only practise on systems you own or have explicit permission to test.

Entry-level cybersecurity roles

Role	What you’d do
SOC analyst (Tier 1)	Monitor alerts, triage incidents, escalate threats
IT security support	Manage access, patching, endpoint protection
Vulnerability analyst	Run scans, prioritise and track fixes
GRC analyst	Policies, risk assessments, compliance evidence
Cloud security associate	Configure and monitor cloud security settings

GRC (governance, risk and compliance) suits people from audit, legal or compliance backgrounds, and needs less hands-on technical work.

Where cloud fits

So much infrastructure now runs in the cloud that cloud knowledge is valuable for security roles. A foundational cloud certification, such as AWS Cloud Practitioner, complements Security+.

Learn cybersecurity live

Tutopiya is planning a 10-week live Cybersecurity Essentials cohort for beginners: foundations, hands-on labs and Security+-style practice, with a practising security professional as mentor. It isn’t running yet. Register interest in the cybersecurity course. Nothing is charged. For other tech paths, see tech careers without a CS degree.

Sources

• CompTIA Security+
• ISC2: Certified in Cybersecurity (CC)
• NIST: NICE Workforce Framework for Cybersecurity

Frequently asked questions

Can I get into cybersecurity with no experience? +

Yes, but most people enter through a foundation of IT skills first. A common route is IT support or help desk work, then a security certification such as CompTIA Security+, then a junior security role such as SOC analyst.

What is the best first cybersecurity certification? +

CompTIA Security+ is one of the most widely recognised entry-level security certifications. Some beginners take CompTIA A+ or Network+ first if they lack IT foundations. ISC2's Certified in Cybersecurity (CC) is another entry option.

Do I need to know coding for cybersecurity? +

Not for many entry roles. Scripting basics (Python, Bash or PowerShell) become increasingly useful for automation and analysis, and are expected in more technical roles such as penetration testing and security engineering.

What do entry-level cybersecurity jobs involve? +

Monitoring alerts in a security operations centre (SOC), investigating suspicious activity, managing vulnerabilities, supporting access control, and documenting incidents.

Founding cohorts · nothing charged

Want to learn this live, with a mentor?

Tutopiya is planning small, mentor-led online cohorts in English test prep, data & AI, business & finance and digital careers. Tell us which one you want. The programmes with the most interest open first, and the people on the waitlist hear about them first.

See the planned programmes