How People Actually Get In

Read the headlines and cybersecurity sounds like the easiest field in the world to enter. The Bureau of Labor Statistics, working from 2024 data, projects 29 percent growth for information security analysts by 2034, against 3 percent for the economy as a whole, and CyberSeek counts hundreds of thousands of open postings. Treat both with care. One is a model's ten-year guess, built on numbers already going stale in a market that has moved fast; the other is a tally of job ads rather than open seats, produced by a tool whose backers include a certification seller as well as NIST's NICE program. Many of the loudest shortage figures come from organizations with an interest in a visible shortage. The demand is real enough. Some of the numbers describing it are projections, others are marketing-adjacent counts, and none of them tells an outsider whether a door will open. Then you read the postings, and the entry-level role wants three to five years of experience, a degree, and a stack of certifications. The shortage everyone talks about does not seem to translate into a door that opens.

Part of the reason is that the shortage has changed shape, and the big headcount numbers the field quoted for years were always a poor guide for newcomers. The applicants are there. What is scarce, and what hiring systems are poor at spotting, is evidence that someone can do a particular job. That is the real puzzle for anyone trying to get in, and it has answers.

The first thing to know is that most people do not start in security. They arrive sideways. The official description of the job points that way: the Bureau of Labor Statistics notes that information security analysts typically hold a bachelor's degree and come with experience in a related role, often as a network or systems administrator. CyberSeek, the labor-market tool built by Lightcast with CompTIA and NIST, sorts the common ways in into a handful of feeder roles: networking, software development, systems engineering, and financial or risk analysis. For many of the people in it, security is a second job within technology rather than a first one. If you already work in IT, the door is closer than the postings suggest, and it is often inside the building you are already in. For someone already in tech, the cleanest route is frequently to take on the security-shaped parts of the current job, the access reviews, the logging, the incident nobody else wanted, until the title catches up with the work.

The second thing to know is that there is more than one door, because cybersecurity is less one job than a label stretched over dozens of them. The door you should aim at depends on what you already are. Someone coming from help desk or IT support has the shortest walk to a security operations or analyst role. Someone from software development moves naturally toward application or product security; someone running systems or cloud infrastructure toward cloud security and detection engineering. The governance side has its own entrance, and it does not always start with a technical job: people come into compliance, risk, and audit work from accounting, law, project management, and the business itself. They still have to learn enough technology to know what a control claim means in a real system. Researchers and writers can move into threat intelligence, if they can turn evidence into a sourced assessment that helps someone decide what to do. The experience problem is real; applicant filters and risk-averse teams turn beginners away for it every day. A second mistake makes it worse, which is aiming at the field in general instead of a role in particular. The people who struggle most are often the capable ones who never decided which door they were walking toward.

The real entry jobs are less glamorous than the ones people picture. Almost nobody starts as a penetration tester. The common first roles are the security operations analyst watching alerts on a Tier 1 queue, the IT support job that has picked up security duties, the junior seat on a governance or audit team, and the analyst role at a managed security provider, which often hires in volume and teaches the queue as it goes. These are the doors that open to people without a track record, because the work is structured enough to absorb someone still learning. They are also the roles most prone to curdling into routine, the queue you never clear, the evidence nobody reads. The trick is to take the entry job for the apprenticeship it offers, and to keep asking from the first week which parts of it are teaching you to do something real.

This is where credentials and proof part company. Certifications still help past the first filter. CompTIA's Security+ is a common baseline for many employers and for DoD-aligned and government-contractor roles, and the more advanced ones, like the CISSP, are gates that open only after years of experience. A cert can keep your resume from being thrown out unread. It will not, on its own, convince anyone you can do the job, and that distinction is everything. The people who break in without the standard pedigree tend to do it by showing their work, and the proof should match the door. A security-operations candidate can write a short incident note from sample logs, a detection rule, or the reasoning behind an alert-triage call. A cloud candidate can publish a small hardening repository with the tradeoffs explained. Governance work rewards a control-evidence packet or a one-page risk memo, and threat intelligence rewards a sourced brief with confidence levels and a recommended action. For the more technical doors, a home lab you broke on purpose, and a few exercises on platforms like TryHackMe or Hack The Box, still signal real interest. Evidence of a thing you have done beats a claim about a thing you could do, and it is the one asset a newcomer can build without anyone's permission.

The last door is the one newcomers use least and insiders use most. The online application is usually where a hire gets recorded rather than where it began. Many of the useful openings reach people first, and usually through people they do not know well. The sociologist Mark Granovetter showed half a century ago, in his work on the strength of weak ties, that it is the loose acquaintance, more than the close friend, who tends to hear about an opening before it is posted. For a technical profession, cybersecurity can be unusually porous on this front. It runs on conferences and local BSides events, on chapters of ISC2, ISACA, and OWASP, on Discord and Slack communities where people trade advice and job leads, and on a long habit of mentorship. The candidate who only applies through a portal is using the narrowest door in the building. The way through is concrete, and slower than firing off applications: ask a practitioner what they wish juniors already understood, offer to take notes at a local chapter meeting, write a short summary of a talk and send it to the speaker, ask one specific question about a tool or an incident pattern, and follow up without asking for a job in the first message.

Put together, the route in is not mysterious, even if it is rarely laid out. Start from where you already stand and name the security in it: the systems administrator already manages access and patches, the auditor already reasons about controls and risk, and saying so in those terms is a large part of the task. Pick the door that fits that background rather than the one that sounds most exciting. Earn the one credential that removes the first obvious objection for your chosen door, then stop long enough to build proof. Make a small, visible body of work that shows you can do the thing rather than describe it. And spend real time in the community, because that is where the doors quietly open. You can start all of this today. The job may not come quickly, and for someone without IT experience, time, or money it may not come easily. But the work of becoming legible to the people who hire does not require anyone's permission.

There was never one map, only a noisy pile of them. The people who get into this field stop waiting for permission, or for the requirements to soften. They pick a door and learn enough to be useful behind it, then make evidence of the work and put it in front of someone who understands it. The credential helps you get read. The proof, and the people, get you in.

Sources (read with the provenance caveats in the article):

U.S. Bureau of Labor Statistics, "Information Security Analysts," Occupational Outlook Handbook: a projection of 29 percent growth, 2024 to 2034, against 3 percent for all occupations, with a 2024 median wage of $124,910 and a typical entry of a bachelor's degree plus less than five years of related work experience, often in IT or systems administration. Note that the underlying data is from 2024 and the growth figure is a model projection.

CyberSeek (cyberseek.org), the Cybersecurity Career Pathway and supply-and-demand tool, built by Lightcast with CompTIA and the NIST NICE program: the feeder-role map, and a national count of online job postings that runs into the hundreds of thousands and shifts by reporting period. The count is of postings, not distinct open seats, and is published by parties with an interest in a visible shortage.

Mark Granovetter, "The Strength of Weak Ties" (American Journal of Sociology, 1973), for loose acquaintances as channels of job information. The finding is robust and oft-replicated; it concerns how openings are heard about, not a claim that most hires bypass the application system.

CompTIA Security+ and (ISC)2 CISSP, referenced as the baseline and advanced certifications.