The most reliable way into cybersecurity is through a general IT job first: help desk or IT support, systems administration, or networking, followed by a move into a security role once you understand how real systems are built and break. Direct entry into a security analyst job without that background happens, but it is the exception, and the people who manage it usually have a degree, an internship or a security-adjacent job already.
That answer disappoints people who want to skip straight to the security work. It is still the honest one, and it is also the faster route in practice, because security work is mostly about defending systems you need to understand first.
What the BLS data says about security jobs
The US occupation most security roles map to is information security analyst. According to the Bureau of Labor Statistics, information security analysts held about 192,900 jobs in 2025 and earned a median annual wage of $129,180 in May 2025. The lowest 10 percent earned less than $75,090, and the highest 10 percent more than $199,850.
The outlook is strong. The BLS projects employment to grow 21 percent from 2025 to 2035, against 6 percent for computer occupations overall and 3 percent for all occupations, with about 14,100 openings a year on average. It ties the growth to more frequent cyberattacks, more businesses investing in security, and the spread of AI and e-commerce.
Two details from the same BLS profile matter for anyone planning a route in:
- The typical entry requirement is a bachelor's degree in a computer-related field, but the BLS notes that some workers enter with a high school diploma plus industry training and certifications.
- The BLS lists work experience in a related occupation as typical (less than five years), and says many analysts come from IT departments, often as network and computer systems administrators.
That second point is the whole strategy in one sentence.
Why IT experience comes first
Security analysts spend their days on questions such as: is this login normal, why is this server talking to that address, is this vulnerability exploitable in our environment, and what breaks if we patch it tonight. You cannot answer any of those without knowing how operating systems, networks, identity systems and applications behave when they are working normally.
General IT jobs teach exactly that, and they pay you while you learn. They also give you the thing security hiring managers check most: evidence that you have operated real systems for real users without breaking them.
Here is how the common starting jobs compare, using BLS figures:
| Starting role | Median pay, May 2025 | Projected change, 2025 to 2035 | What it teaches you for security |
|---|---|---|---|
| Computer support specialists | $62,890 | -3% | Accounts, endpoints, phishing reports, how users actually behave |
| Network and computer systems administrators | $99,130 | -4% | Servers, permissions, patching, logging, backups, hardening |
| Information security analysts | $129,180 | +21% | The destination |
Note the projected declines for the two feeder occupations. The BLS still expects about 48,700 openings a year for computer support specialists and about 13,400 a year for systems administrators, all of them from people leaving the occupation or retiring. The doors are open, but the BLS expects automation (chatbots for user support, more scripting for admins) to keep pressure on headcount. Treat these jobs as a stepping stone with a planned exit, not a place to wait.
The skills that come first
Before any security specialism, learn the foundations that every security role assumes. In rough order:
- Networking. TCP/IP, DNS, DHCP, routing basics, common ports and protocols, what a firewall rule actually does. Packet captures should stop looking like noise.
- Operating systems. Both Windows (Active Directory, Group Policy, event logs) and Linux (permissions, processes, services, logs). Many companies run user identity through Active Directory and their servers on Linux, so you need to be comfortable in both.
- Identity and access. How authentication and authorization work, single sign-on, multi-factor authentication, least privilege. A lot of security work comes down to who can access what, and whether they should.
- Scripting. Enough Python, PowerShell or Bash to parse logs, call an API and automate a repetitive check. You do not need to be a software developer, but you need to stop doing things by hand.
- Cloud basics. How permissions, network rules and logging work in at least one major cloud platform.
Then pick a direction. The common entry-level security jobs are security operations center (SOC) analyst, vulnerability management analyst, identity and access management (IAM) administrator, and governance, risk and compliance (GRC) analyst. Penetration testing is the most visible specialism and rarely a realistic first security job; it rewards people who already understand the systems they are attacking.
Certifications in context
Certifications matter more in security than in most of tech. The BLS says many employers prefer candidates with information security certification. But a certification is a filter-clearer, not a substitute for experience. Our certifications hub covers the major options; here is how the two most cited ones fit a career.
CompTIA Security+ is the usual first security certification. CompTIA's Security+ page recommends Network+ and two years of experience in a security or systems administrator role before taking it. That recommendation says a lot: even the entry-level security credential assumes IT experience. Security+ also maps to many US Department of Defense cyber workforce roles, which is why it shows up so often in government and contractor postings.
CISSP from ISC2 is a senior credential, not an entry ticket. ISC2's experience requirements call for at least five years of cumulative, full-time work in two or more of its eight domains. A relevant degree can count for one of those years. If you pass the exam without the experience, you become an Associate of ISC2 and have six years to earn it. Do not plan your first two years around CISSP.
A sensible order for most people: a networking or general IT certification if you have no IT job yet, Security+ once you have some hands-on work, then a specialist certification chosen for the role you actually want (cloud security, incident response, penetration testing, audit). Collecting certifications without the matching experience mostly produces a résumé that looks like it is compensating for something.
The government and clearance angle
Federal agencies and defense contractors hire security staff too, and that work comes with its own rules. Two things are worth knowing.
First, you generally cannot get a security clearance on your own to make yourself more employable. The State Department's security clearance FAQ says plainly that applicants cannot initiate a clearance application themselves; the process starts after a conditional job offer, and the clearance is tied to the position's duties, not the person. That is why postings that say "clearance required" are hard to break into, and why jobs that offer to sponsor a clearance are valuable entry points.
Second, the Department of Defense qualifies its cyber workforce under its own framework, known as DoD 8140, which defines work roles and the qualifications accepted for each. That is the context behind the Security+ mapping mentioned above. If you are targeting defense work, read each posting's qualification requirements carefully, since they depend on the work role.
If you have a clean background and are open to federal or contractor work, a role that sponsors a clearance can be worth taking at slightly lower pay. A cleared employee with a few years of experience is in a much stronger position than one without.
Building evidence without a security job
You can practice security skills before anyone pays you to. The useful kinds of practice produce something you can show:
- A home lab with a domain controller, a couple of Linux servers and centralized logging. Then attack it and write up what the logs showed.
- Write-ups of capture-the-flag challenges or training labs, focused on what you learned and how you would detect the technique, not just how you solved it.
- Security work inside your current job. Volunteer for the patching project, the MFA rollout, the access review, the phishing training. This is the experience that counts most, because it happened in production.
Skip the urge to call yourself a penetration tester because you completed online labs. It is a common move and it rarely convinces anyone. A clear write-up of how you would detect and respond to an attack is more convincing for a first defensive role.
Where the career goes
The BLS says information security analysts can advance to lead teams, specialize deeply, or move into management as chief security officers or other computer and information systems managers. Many people also move laterally into security engineering, cloud security or network architecture, where infrastructure experience pays off again.
The next step
If you have no IT job yet, aim for an IT support or junior systems administrator role this year, learn networking and both major operating systems on the job, and tell your manager you want security work. If you already work in IT, volunteer for one security project in the next quarter and study for Security+ alongside it. In both cases, keep a running document of every security-related task you do; it becomes the experience section of your next résumé.