Breaking Into Cybersecurity Without a Computer Science Degree

Cybersecurity is the corner of technology most willing to hire on demonstrated capability rather than credentials — and simultaneously the one with the most confusing entry advice. This is the route we actually recommend to mentees, including the parts that are unglamorous.

The field is six fields wearing one coat

"Cybersecurity" describes at least six distinct jobs whose day-to-day work has almost nothing in common. Applying to all of them with one CV is the most common mistake we see, and it reads to a hiring manager as someone who has not yet looked closely at the work.

If you have a development background, application security is usually the shortest path and the best paid. If you do not, security operations is the standard entry point, and it is a genuine one — a large share of our security mentees who are now detection engineers started on a tier-one alert queue.

What actually replaces the degree

Employers are not looking for the absence of a degree to be filled by nothing. They are looking for evidence that you can do the thing. In security that evidence takes four specific forms, and they are ranked in roughly this order of persuasiveness:

1. Written investigations. A public write-up of something you investigated, with your reasoning shown, including the dead ends. This is the single highest-signal artefact in the field and almost nobody produces it.
2. A home lab you can talk about in detail. Not "I have a home lab" but "I built a domain, generated attacker traffic with Atomic Red Team, forwarded logs into an open-source SIEM, and here are the three detections I wrote and the two that were too noisy to keep."
3. Capture-the-flag and range performance. Useful, with an important caveat: CTF skills transfer well to offensive roles and only partially to defensive ones. A blue-team candidate with CTF wins and no detection writing is still a gamble.
4. Certifications. They open the automated screen and rarely impress the panel. Treat them as a filter key, not a qualification.

A twenty-four week plan you can run alongside a job

This is the plan we give mentees in the security track, compressed. It assumes eight hours a week and no prior security experience, though it does assume basic comfort with a command line.

1. Weeks 1–4: fundamentals you cannot skip. TCP/IP properly, DNS, HTTP, TLS handshakes, how authentication actually works. Capture your own traffic and read it. Almost every later confusion traces back to a gap here.
2. Weeks 5–8: operating systems and logs. Windows event logs and Sysmon, Linux auditd and journald. Learn what normal looks like, at length, before you study abnormal.
3. Weeks 9–12: build the lab. A small domain, a log pipeline, an open-source SIEM. Break it, fix it, document the build. This is your primary artefact.
4. Weeks 13–16: attack it yourself. Use a published technique catalogue, run techniques deliberately, and observe what each one leaves behind in your telemetry.
5. Weeks 17–20: write detections. Turn observations into rules. Measure false positive rate against a week of your own normal traffic. Tune. Document the ones you abandoned and why — that judgement is the job.
6. Weeks 21–24: publish and apply. Four write-ups, a tidied lab repository, and a CV that describes detections written rather than tools installed.

Twenty-four weeks at eight hours is under two hundred hours. That is less than a single semester and it produces something a degree usually does not: artefacts a hiring manager can read.

The interview, and what it is really testing

Security interviews look like knowledge tests and are almost always judgement tests. The question "what is the difference between symmetric and asymmetric encryption" is a warm-up; the question that decides the outcome is usually some version of "here is an alert, what do you do?"

What panels are listening for:

• Do you gather context before acting? Asking what the asset is, who owns it and what normal looks like scores higher than immediately proposing containment.
• Do you reason about false positives? Candidates who treat every alert as real are exhausting to work with and expensive to the business.
• Can you say 'I do not know' and then describe how you would find out? This is close to a pass on its own.
• Do you consider the humans? Containment that takes a hospital ward offline is a technically correct answer and a professionally wrong one.
• Can you write? You will spend more time writing incident reports than typing commands. Many panels ask for a written exercise for exactly this reason.

We can teach a tool in a week. We cannot teach someone to ask what normal looks like before they start containing things.

Simone Clarke, Cybersecurity Lead, BTMP

Certifications, assessed honestly

Mentees ask about certifications more than any other topic, usually because certification marketing is loud and career advice is quiet. Our position, which not everyone shares:

The rule we give mentees: never pay for a certification before you have built the lab. If your budget allows only one, the lab wins every time, because the lab produces the write-ups and the write-ups produce the interviews.

Surviving the first year

Getting in is the part everyone writes about. The first year is the part that decides whether you stay, and security has a retention problem that nobody advertises to candidates.

• Alert fatigue is real and it is a systems problem, not a character flaw. If your queue is unmanageable, the tuning is broken, not you. Say so, with data.
• On-call needs boundaries from day one. The people who burn out are usually the ones who were excellent in month three.
• Write everything down. Your investigation notes become your promotion case, and in a bad incident they become the record that protects you.
• Find the person who explains rather than gatekeeps. Security has more than its share of people who enjoy knowing things others do not. Do not learn from them.
• Specialise by month eighteen. Generalist tier-one work has a ceiling; detection engineering, cloud security and application security all have clear ladders.

Frequently asked questions