You don't need a computer science degree to work in cybersecurity. You need to be able to do the job, and then prove it to someone who is hiring. People move into security from help desks, call centers, retail, teaching, and the military every year. What they had in common wasn't a diploma — it was demonstrable skills, a certification or two that satisfied HR, and someone willing to vouch for them. Here's how to build all three.
Get the Fundamentals Right First
Security sits on top of IT. If you can't explain how a packet travels from your laptop to a web server, or why a DNS record matters, everything else becomes guesswork. Spend your first few weeks here:
- Networking: TCP/IP, DNS, HTTP and HTTPS, common ports, subnetting basics, NAT, firewalls.
- Operating systems: the Linux command line (grep, permissions, systemd, logs) and Windows fundamentals, including Active Directory, Group Policy, and Event Viewer.
- Scripting: enough Python to automate a boring task, plus basic Bash or PowerShell.
- Logs: what a Windows security event or an Apache access line actually tells you.
Free material is everywhere — Professor Messer's video courses, Microsoft Learn, TryHackMe, OverTheWire, and the machine you're reading this on. A useful test: explain out loud what happens when you type a URL into a browser. If you get stuck at "then it loads," go back a step.
Certifications: Which Ones Actually Help
Certifications rarely get you hired on their own. They get you past automated filters and give an interviewer a reason to believe you finish what you start. The ones worth considering early:
- CompTIA Security+ — the common entry-level checkpoint for HR filters.
- CompTIA Network+ or Cisco CCNA — pick one if your networking is weak. You'll learn more than you expect.
- CompTIA A+ — sensible if you're aiming at help desk or IT support as a stepping stone.
- Blue Team Level 1 or Microsoft SC-200 — for SOC and defender roles.
- eJPT or PNPT — hands-on exams that resemble offensive interviews far more than multiple-choice tests do.
The rule: one foundation certification plus one role-specific certification. Then stop and build things. Exam vouchers cost real money, and some employers reimburse them once you're on staff, so factor that into your budget instead of buying five at once.
Build a Home Lab You Can Explain
Pick a project, not a pile of tools
Installing twelve tools proves nothing. Finishing one small thing end to end proves plenty. Good first projects:
- Stand up a Windows domain controller and a workstation in virtual machines, then generate and detect failed-login activity using Windows event logs.
- Build a segmented network with pfSense or OPNsense and document why you split it that way.
- Run a deliberately vulnerable VM such as DVWA or Metasploitable on an isolated network, exploit it, then write the detection rule that would have caught you.
- Set up a SIEM like Wazuh or the free tier of a commercial platform, ship logs from two machines, and build three working alerts.
A spare laptop with 16 GB of RAM and VirtualBox is enough to start. Keep anything vulnerable off your home network, and check the terms before you leave a cloud instance running for weeks.
Write it down as you go
Keep one document per project: what you built, what you tried, what broke, what you'd change. That document turns directly into resume bullets and interview answers. It also keeps you honest about what you actually did.
Publish Your Work
Nobody expects a blog with a hundred posts. They expect evidence they can skim in five minutes.
- Write up lab machines and CTFs after you solve them, and respect each platform's rules — many forbid public writeups of active targets.
- Push your scripts to GitHub with a README that explains what the tool does and how to run it.
- Post short notes on what you learned each week. Two paragraphs is enough.
This forces clear thinking, and it gives a hiring manager something concrete to look at before your interview.
Network Like a Human Being
Most junior roles get filled through people who already know your name. You don't need to become a conference circuit regular; you need to be present and specific.
- Go to local BSides events, OWASP chapter meetings, and university security clubs. Listen, then ask one real question.
- Join Discord and Slack communities built around blue team work, detection engineering, or your region.
- Send short LinkedIn messages: "I saw your talk on detection engineering. I built a Wazuh lab and wrote it up here. Would you have fifteen minutes to tell me what you look for in junior hires?"
- Consider adjacent roles — help desk, NOC technician, sysadmin, IT support. They pay the bills, put real systems under your hands, and many companies promote internally into security.
Resume and Applications That Get Past the Filter
- One page. Reverse chronological, no photo, no objective statement.
- Put a Projects section near the top if your paid work history isn't technical. Name the tools, the scope, and the outcome.
- Mirror the job posting's language. If it says "SIEM, incident response, threat hunting," those words should appear naturally in your resume.
- Quantify where you can. "Built a four-VM lab and wrote three detection rules" beats "familiar with security tools."
- Cut anything you can't defend for ten minutes in an interview. Listing Metasploit when you've never opened it is a trap you set for yourself.
- Apply to unfamiliar titles: SOC Analyst I, Security Operations Technician, IT Security Associate, Junior GRC. Smaller companies and managed service providers often train more willingly than large enterprises.
Track every application in a spreadsheet, apply in small batches, and follow up once about a week later. Volume without tailoring rarely works, and tailoring without volume rarely reaches anyone.
Your First 90 Days
- Weeks 1–4: fundamentals. Networking, Linux command line, one scripting language, one beginner platform path.
- Weeks 5–8: study for one certification while building one lab project alongside it.
- Weeks 9–10: write up the project, clean the repository, rewrite the resume around what you built.
- Weeks 11–12: apply to twenty or thirty roles, message five people a week, attend one event.
Rejections are normal at this stage, especially the first dozen. Treat each interview as information: note every question you couldn't answer, learn that topic, and come back sharper. The degree question comes up far less often once you can show someone what you've built and explain how you built it.
Photo: erwinbosman / Pixabay
