Guide
Cyber security career roadmap
What the UK labour market data actually shows about getting in, why certification-first advice fails most people who take it, and the route the evidence supports.
Most cyber security roadmaps tell you to buy a course, pass a certification and apply. The UK government measures this market every year, and its own figures say that route has been getting worse for three years running: entry-level demand fell from 25% of postings in 2022 to 17% in 2024, 63% of core roles now ask for two to six years of experience, and more than half of all hiring comes from people already working in cyber security. This guide sets out what the data shows, why the usual advice fails, and the route most people who actually got in took instead.
Last reviewed:
The usual advice has the order wrong
The standard roadmap is: study, certify, apply. It is the order every course provider recommends, which is worth noticing, because it is also the order that puts their product first.
The UK Department for Science, Innovation and Technology publishes an annual labour market study of this exact question. Its 2025 edition describes a market moving steadily away from that route.
17%
of postings are entry level
Down from 25% in 2022 and 22% in 2023
63%
of core roles want 2 to 6 years
Experience, not certification
52%
of hiring is from inside cyber
Career starters are 15%
6.5%
finished the free certification
65,000 certified of 1m enrolled, ISC2
None of that says a career in cyber security is unavailable. It says the door marked "entry level" is narrowing, and that most people came in through a different one.
What the market actually did, three years running
Entry-level demand is the number to watch, because it is the one every roadmap implicitly assumes is growing.
Share of UK cyber security job postings that are entry level
Two other figures from the same report finish the picture. The UK cyber workforce reached roughly 143,000 people by the end of 2024. The annual workforce shortfall, the number employers wanted and could not fill, fell to 3,800, having been 11,100 the year before.
A shortfall that drops by two thirds in a year is not a market crying out for anybody who can spell the word. It is a market that has largely filled its gaps and is now selective about the remainder.
Where the people who got in actually came from
About 11,700 people joined the UK cyber workforce in 2024. Where they came from is the most useful table in the report, and almost none of the roadmaps quote it.
Routes into the UK cyber workforce, 2024
| Route | People | Share of intake |
|---|---|---|
| Graduates | ~6,000 | 51% |
| Retraining or upskilling from another sector | ~2,500 | 21% |
| Moving across from an aligned profession | ~2,600 | 22% |
| Apprenticeship starts | ~600 | 5% |
Graduates are the largest single group and still a minority. Put the two conversion routes together and about 5,100 people, roughly 44% of the intake, arrived from somewhere that was not a cyber security job and was not a degree.
The recruitment side of the same study says it more directly. Of all cyber security recruitment, 52% came from the existing cyber pool, 28% from people converting out of non-cyber roles, and 15% were career starters. The conversion route is nearly twice the size of the career-starter route.
That is the finding this whole guide turns on. The most common way in is sideways.
Why certification-first fails, with a number attached
Certifications are recommended so uniformly that it is worth looking at what happens to the people who follow that advice.
Between August 2022 and May 2026, ISC2 ran its One Million Certified in Cybersecurity programme: a free course and a free exam, offered to a million people across 178 countries, explicitly to lower the barrier to entry. It is the largest natural experiment anybody has run on certification-first entry, and ISC2 published the outcome when it closed the programme.
The largest free-certification programme ever run, and what came of it
| Stage | People | Of those given access |
|---|---|---|
| Given free access | 1,000,000+ | 100% |
| Took the course | 570,000+ | 57% |
| Earned the certification | 65,000+ | 6.5% |
| Went on to a second ISC2 certification | ~9,000 | 0.9% |
Remove every financial barrier, and 6.5% of people finished. Cost was not the obstacle. Something else was, and the most likely candidate is that a certification studied without a job to apply it to is abstract, unrewarded and easy to abandon.
The jobs, and which of them hire from outside
"Cyber security" is not one job, and treating it as one is why a lot of applications go nowhere. Roughly, the field splits along two axes: how technical the daily work is, and whether the team habitually hires people from outside security or promotes from within.
Where the roles sit, and where an outsider can land
Security operations analyst
Triage alerts, investigate, escalate. Shift patterns are common and are exactly why these teams will take someone from a service desk.
Penetration tester, incident responder
Deep technical specialisms. Almost always recruited from people already doing security work, often from operations.
GRC, compliance, audit support
Policy, evidence, control testing, supplier assessment. Reachable from any role that involved documentation and rigour.
Security architect, CISO
Sets direction and carries accountability. Years of prior delivery assumed, and correctly so.
The two boxes on the left are the realistic targets from outside, and they are very different jobs. Security operations rewards curiosity, pattern recognition and a tolerance for shifts. Governance rewards precision, patience and the ability to write a sentence somebody else can act on. People who fail in one are frequently well suited to the other, and the sorting usually happens by accident.
Worth knowing before choosing: governance roles are considerably easier to reach from a non-technical background, and they are where AI regulation is creating new work fastest. Operations roles are more numerous and give the faster technical education.
What to learn, in the order it becomes useful
The syllabus problem with self-study is that everything looks equally important from outside, so people learn topics in the order courses present them rather than the order the job needs them.
Networking first, and properly. How a packet gets from one machine to another, what DNS does, what TLS actually establishes, and what a firewall rule means. Almost every security incident is eventually explained in these terms, and no amount of tooling substitutes for it. This is the single highest-return subject and most people skip it because it is dry.
Then operating systems. Processes, permissions, the file system, logs, and how an account becomes an administrator. Learn one of Windows or Linux properly rather than both badly; whichever your employer runs is the correct answer.
Then identity. Authentication against authorisation, what a token is, what single sign-on federates, and why a joiners and leavers process is a security control rather than an HR chore. Identity is where most real attacks now land, and it is underrepresented in beginner material.
Then enough scripting to automate a boring task. Not software engineering. The ability to pull a list, compare it against another list, and produce something a human can act on. PowerShell or Python, whichever matches the environment.
Then the subject you actually want to work in. Cloud, detection, testing, governance. By this point you will know which, and the choice will be informed rather than aspirational.
Notice that none of this requires paying anybody. The material is free and the constraint is time and structure, which is the other reason an IT job helps: it supplies both, and pays.
Getting the first IT role, which is the part that gets skipped
Every roadmap that says "get an IT job first" then moves swiftly on, as though that part were easy. It is easier than a security role and it is not nothing.
Service desk and first-line support roles hire for attitude, clear communication and evidence that you fix things rather than for qualifications. The application is a different exercise from a security one: they are looking for somebody who will be pleasant to a frustrated user at half past four on a Friday, and who will then find out why the problem happened.
Three things that measurably help. Get the fundamentals of one help desk platform, because naming a ticketing system moves a CV from unknown to plausible. Be able to describe a technical problem you diagnosed end to end, even a domestic one, in the order you actually worked it out. And apply to managed service providers as well as end user organisations: the work is harder and faster, the exposure across many client environments is far broader, and they hire more often.
Contract and temporary roles count. So does internal movement, and if you are already employed somewhere with an IT function, that is the shortest path in this entire guide.
Making the sideways move land
The move from IT to security is a repositioning of work you have already done, and it fails most often because the work is described as IT rather than as security.
Patching is vulnerability management. Joiners and leavers is identity lifecycle and access control. Backup verification is resilience and recovery testing. Reviewing who has administrator rights is privileged access management. None of that is spin: it is the language the receiving team and the auditors use, and using it demonstrates that you know which control you were operating.
Then attach an outcome to each. Not "responsible for patching" but "took outstanding critical patches from a backlog of three months to a fortnight, and produced the monthly report that showed it". Hiring managers in this field read a great deal of unevidenced confidence, and a specific number about something unglamorous stands out.
The last piece is timing. Ask the security team for a conversation before there is a vacancy, and ask what they wish somebody would take off them. Do that thing. The vacancy, when it appears, is then a formality.
One more thing, because it is the question people are most reluctant to ask. Changing into this field later is normal here rather than exceptional: about 2,500 of the 2024 intake retrained from an unrelated sector and another 2,600 moved across from an adjacent profession. That is the larger part of the door, and the reason is that the transferable material is real. Anyone who has run a regulated process, handled an audit, managed a supplier or worked somewhere with genuine consequences already understands most of what governance work asks for. What is missing is vocabulary and context, and both are acquirable. The disadvantage of arriving later is smaller than it feels, and it is usually offset by knowing how organisations actually behave.
The route the evidence supports
Two routes to the same job
The right-hand route works because it inverts the two things the market is actually selecting for. Employers want operational experience and evidence of capability. An adjacent IT role gives you both while paying you, and it puts you inside the organisation that will eventually have a security vacancy.
The staged path, with a check at each stage
- 1
Get any IT role that touches systems
0 to 6 months
Service desk, desktop support, junior sysadmin, network operations. The bar is far lower than for security roles and the work is genuinely adjacent.
- 2
Do the security work nobody is doing
6 to 18 months
Patching, joiners and leavers, MFA rollout, backup verification, log review. Volunteer for it. Every one of these is a control an auditor asks about.
- 3
Make the work visible
ongoing
Write the runbook. Produce the asset inventory. Present the phishing numbers. Being the person who documented the control is how a hiring manager finds you.
- 4
Certify to match what you already do
12 to 24 months
Now the exam is revision rather than theory, and the certificate confirms something true about you rather than substituting for it.
- 5
Move sideways, internally first
18 to 36 months
The security team that has watched you fix its problems for a year is a far easier hire than a stranger with the same certificate.
A realistic first two years
The honest version of the timeline is slower than a bootcamp advertises and considerably faster than it feels from the outside.
What the path looks like from a standing start
Month 0
Apply widely to IT, not to security
Service desk and support roles hire on attitude and aptitude. This is the stage that feels like a detour and is not.
Month 3
You are inside
You now have access, context, and colleagues who know what breaks. None of that is available from outside.
Month 6
Take the security jobs nobody wants
Access reviews, patch reporting, leaver checks. Unglamorous, and precisely the evidence a security role asks for.
Month 12
First certification, chosen to match the work
Security+ or equivalent, sat while doing the job it describes.
Month 18
You are the security person in an IT team
In practice if not in title. This is the point at which the market changes shape for you.
Month 24 to 36
A security role, usually internal
52% of hiring is from inside cyber and much of the rest is internal movement. You are now in both pools.
Certifications, and when each is actually worth sitting
They are filters, not evidence. A filter is worth passing at the moment it stands between you and a specific role, and rarely before.
What each is for, and when to sit it
| Certification | What it is really for | Sit it when |
|---|---|---|
| ISC2 Certified in Cybersecurity | Vocabulary and foundations. No experience requirement. | You want the language before your first IT role. Now paid. |
| CompTIA Security+ | The HR screening filter for UK and US junior roles. Widely named in postings. | You are already doing security work and want to clear automated screening. |
| A cloud provider security certification | Proof you can secure the platform your employer actually runs. | You know which cloud your organisation uses. |
| ISO 27001 Lead Implementer or Auditor | Governance and assurance work rather than technical defence. | You are moving toward compliance, audit or consultancy. |
| CISM | Management track. Assumes and requires real experience. | You already lead security work and need the credential to formalise it. |
| OSCP | Offensive testing, and genuinely hard. | You want penetration testing specifically and have a lab habit already. |
About the money, and why the headline figure misleads
The number quoted everywhere is a median advertised salary of around £55,000, with London postings averaging about £69,800 against roughly £58,800 across the regions. Entry-level postings start near £33,500 and the senior tail runs to well over £200,000.
Two things about that median matter more than its size.
It is advertised, not paid. Advertised salaries are a negotiating position published by employers, and the figure that appears in a posting is frequently the top of a band that few people enter on. Actual starting offers sit below it more often than above.
It is a median of postings, not of people, and the postings skew senior. If 63% of core roles ask for two to six years of experience, then the median posting is a mid-career posting, and its salary describes somebody three or four years in rather than somebody arriving. Reading £55,000 as a starting salary is reading a mid-level number as an entry-level one, which is exactly the error the composition of the market invites.
The honest expectation from a standing start is the entry band, and the sideways route means your first year or two is paid at IT support rates rather than security rates. That is the real cost of this path and it is worth stating plainly: it is slower to the money than a bootcamp implies, and it is far more likely to arrive.
The compensating fact is the shape of the curve afterwards. The distance between the entry band and the senior tail in this field is unusually wide, and it is traversed by capability and evidence rather than by tenure. Someone three years in who has run real incidents and can write about them is not on a fixed increment.
What does not work
Certifications stacked without a job. The ISC2 figures are the clearest evidence available that studying in isolation does not convert. Three certificates and no operational experience reads, to a hiring manager, as somebody who has studied the subject rather than done it.
Applying only to roles with "cyber" or "security" in the title. That is 17% of postings and the most contested 17%. The adjacent roles are less competitive and lead to the same place.
Home labs as the whole strategy. Useful, and not a substitute for having been responsible for something. A lab has no users, no change control, no 2am, and no consequences, and those are the parts employers are buying.
Waiting to feel ready. The 49% basic skills gap is inside organisations that are already employing people. Nobody in this field feels finished.
Where the opening actually is
One number in the DSIT report points forward rather than back: around two-thirds of cyber security businesses expected their need for AI skills to grow within twelve months, and the report names AI security as an emerging deficit.
That is the newest gap, which makes it the least crowded. Someone who can speak precisely about how a model fails, what an agent can reach, and what the AI Act requires is competing against far fewer people than someone entering through the general route, and against nobody at all with more than a couple of years of it.
Where to go next
If the AI security opening is the part that interests you, the guides on this site covering AI systems, agents and the EU AI Act are the vocabulary you would need, and the explainers show the mechanisms running rather than describing them.
If you are heading toward governance and assurance, the Annex A browser sets out what an ISO 27001 audit actually asks for, control by control, which is a faster orientation than any course summary.
If you are already inside an organisation and want to start doing the work described in stage two, the asset inventory tutorial is the least glamorous and most reliable place to begin.
Common questions
›How do I get into cyber security with no experience?
Usually not by applying directly to cyber roles. DSIT's 2025 labour market report found 28% of cyber recruitment came from people converting out of non-cyber roles against 15% who were career starters, so the larger door is an adjacent IT job: service desk, systems administration, networking. Do the security work inside that role, then move sideways.
›Is there really a cyber security skills shortage?
Less than the marketing suggests, and not at entry level. The UK workforce gap fell from 11,100 in 2023 to 3,800 in 2024 while the workforce itself grew to around 143,000. What persists is a skills gap inside existing teams: 49% of businesses lack basic cyber skills and 30% lack advanced ones. Employers want capability they can use immediately, which is a different thing from wanting more applicants.
›Which cyber security certification should I get first?
One that matches a job you can already do most of. Certifications are filters that get a CV past screening, not evidence of capability, and taken before any operational experience they tend to produce a certified person nobody will hire. The order that works is role first, certification second, because then the certificate confirms something true.
›Is the free ISC2 certification still available?
No. ISC2 closed its One Million Certified in Cybersecurity programme to new participants on 20 May 2026, having announced it on 22 April. Anyone holding an unexpired exam code can still sit the exam until 31 December 2026. Certified in Cybersecurity continues as a paid certification. A great deal of roadmap advice still recommends the free route and is out of date.
›Do I need a degree for cyber security?
No, and the numbers show why it is not the main road either. Of roughly 11,700 people who entered the UK cyber workforce in 2024, about 6,000 were graduates, 600 came through apprenticeships, 2,500 retrained from other sectors and 2,600 moved across from aligned professions. Graduates are the largest single group and are still a minority of entrants.
›How long does it take to get into cyber security?
Plan for eighteen months to three years from a standing start, most of it spent in an adjacent IT role rather than studying. That is slower than a bootcamp advertises and faster than it feels from outside, and the variable that moves it is operational exposure rather than the number of certifications held.
›What cyber security skills are most in demand?
The advanced end, and increasingly AI. DSIT found 30% of businesses lacking advanced skills such as forensic analysis and penetration testing, against 49% lacking basic ones, and around two-thirds of cyber firms expected their need for AI skills to rise within twelve months. AI security is the newest gap and therefore the least crowded.
Where to go next