How to Get into Cyber Security with No Experience (UK, 2026)

That last part matters more in 2026 than it used to. Entry-level vacancies are a small share of the market, so the people who get hired are the ones who can show their work. Below is a step-by-step plan for UK career changers.

What the UK market looks like for beginners

The UK government’s Cyber security skills in the UK labour market 2026 report (published 29 September 2026) gives a detailed public picture of demand. A few findings are worth knowing before you start:

• Demand may be recovering, modestly. There were 34,932 job postings for core cyber roles in 2025, up 7% on 2024.
• Entry-level roles are scarce. Only 16% of core cyber postings in 2025 asked for under one year of experience, down from 25% in 2022. The most common request (64% of postings) was for 2 to 6 years.
• Employers are wary of overclaiming. Some employers interviewed for the report described a high volume of AI-generated CVs and applications from candidates overclaiming skills.

None of this means the door is shut. It means a generic CV with a list of course certificates will struggle, and a focused application with visible proof of skill stands out.

Step 1: Choose a direction

“Cyber security” covers many different jobs. The UK Cyber Security Council’s Cyber Career Framework describes 15 specialisms and the pathways between them, which is a useful map once you know roughly where you want to go. For most career changers, three starting points are realistic:

Pick one for the next six months. You can change later, but splitting your effort three ways is a common reason beginners feel busy and get nowhere.

If you are weighing formal routes such as a degree, an apprenticeship or a bootcamp, that is a separate decision with its own trade-offs; the plan below works alongside any of them.

Step 2: Learn the foundations

Whatever direction you choose, the same foundations come up in every interview:

• Networking: IP addressing, DNS, common ports and protocols, what a firewall actually does.
• Operating systems: comfortable use of the Linux command line and an understanding of Windows users, permissions and event logs.
• Core security concepts: the CIA triad, authentication versus authorisation, vulnerabilities, threats and risk. Our key cybersecurity concepts and terms for beginners is a good checklist.
• Cloud basics: what changes when servers and identities live with a cloud provider.
• How organisations manage risk: even technical roles are expected to understand why controls exist.

Aim to understand each topic well enough to explain it to a non-technical friend. That is roughly the level a first-line interview tests.

Step 3: Build a home lab and a portfolio

A home lab is a few virtual machines on your own computer where you can break and fix things safely. It does not need expensive hardware. What it gives you is material for your portfolio and real answers to “tell me about a time you…” questions.

For security operations

• Run a Linux and a Windows virtual machine and forward their logs to a free monitoring tool. Wazuh describes itself as an open-source platform for threat detection and incident response, and Security Onion as a free and open platform for threat hunting, network security monitoring and log management.
• Generate activity (failed logins, a new user account, a blocked connection) and write up what you saw in the logs and how you would triage it.

For GRC

• Take a hypothetical organisation (for example, imagine a 40-person accountancy firm with laptops, Microsoft 365 and a cloud file store) and assess it against the five Cyber Essentials technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
• Produce a short risk register, one policy and a one-page summary for a managing partner. Those three documents are a credible GRC portfolio.

For IT into security

• Harden a server against a published baseline, document what you changed and why, and show before-and-after evidence.

Publish your write-ups somewhere an employer can read them, such as a simple blog or a code repository. Never test systems you do not own or have explicit permission to test.

Step 4: Practise with free resources

You do not need to spend money to start practising:

• OverTheWire wargames: start with Bandit, which the site lists as covering Unix/Linux basics. It builds the command-line confidence that every technical role assumes.
• Capture the flag (CTF) competitions: these turn practice into puzzles and give you something concrete to talk about. Rather than repeat it here, see our guide to the world’s most famous CTF competitions, which includes options for beginners.
• Free GRC training: our free Learning GRC in 12 Weeks course covers risk assessment, policy writing, risk registers, audit support and management reporting, with a video and written summary for each session.

Keep a simple log of what you complete and what you learned. It becomes the raw material for your CV.

Step 5: Consider one entry-level certification

A certification will not replace a portfolio, but it helps your CV pass keyword filters. For beginners, two common choices are:

• ISC2 Certified in Cybersecurity (CC): ISC2 states that no work experience is required. Note that ISC2’s free “One Million Certified in Cybersecurity” programme stopped accepting new participants on 20 May 2026; the exam and course are now available for purchase like other ISC2 exams.
• CompTIA Security+: CompTIA describes it as a globally recognised certification for core security functions. CompTIA releases new versions of the exam from time to time, so check that your study materials match the version you book.

Choose one, pass it, and put your remaining effort into practical work.

Step 6: Use your transferable skills

Career changers often undersell what they already have. The government report’s list of the most requested skills in core cyber job postings in 2025 is revealing: alongside cyber security itself (66%), employers asked for auditing (22%), governance (20%), ISO/IEC 27001 (20%), risk management (19%) and incident response (18%).

Several of those are not purely technical. If you have worked in audit, compliance, quality management, legal, finance, project management or customer-facing operations, you may already do parts of this work. Translate it into security language on your CV: “ran supplier due diligence” becomes evidence of third-party risk work; “handled escalated customer incidents” shows calm triage under pressure.

Step 7: Join the community

Meeting people in the field can open doors that job boards do not. Free and low-cost ways in include:

• BSides events: community-led security conferences that run in UK cities including London and Exeter. BSides London describes itself as free to attend and runs a Rookie speakers track for first-time public speakers.
• Professional body chapters: ISACA’s London chapter, formed in 1981, has over 5,000 members and is a natural fit if you are heading towards GRC or audit.

Go to listen, ask questions and follow up afterwards. A short message referencing a talk you enjoyed is remembered far longer than a cold application.

Step 8: Write your CV and apply

Employers in the government research were blunt about candidates who overclaim. One large private-sector business outside the cyber security sector put it this way: “Lots of people turn up for interview and claim they can do the stuff and then they fail the technicals.” Build your application so that never happens to you:

1. Lead with evidence. Link your portfolio near the top of your CV and describe two or three projects in one line each.
2. Claim only what you can demonstrate. If a skill is on your CV, expect to be asked to explain or perform it.
3. Tailor every application. Match your wording to the job advert’s skills, honestly.
4. Write it yourself. Generic, machine-sounding applications are exactly what hiring managers are learning to filter out.
5. Widen the net. Look at IT service desk, compliance and risk roles inside organisations you would like to work for; an internal move into security can be easier than a cold application.

A word on courses advertised with a “job guarantee”: no training provider controls an employer’s hiring decision. Read the small print, ask what is actually guaranteed and judge any course on the skills, practice and support it provides.

Where LSCS can help

If you want structure rather than going it alone, our CyberForce bootcamp is a four-week, instructor-led course for beginners and career switchers, BCS Tech 10 accredited, with hands-on labs and career development sessions including building a cybersecurity CV. It costs £1,900; contact us for dates. If GRC is your direction, start with the free 12-session GRC course.

Frequently asked questions

Can I get into cyber security with no experience in the UK?

Yes, but entry-level roles are a small share of the market: 16% of UK core cyber job postings in 2025 asked for under one year of experience. A focused direction, a home lab and a portfolio of written-up work make you far more competitive.

What is the best cyber security course for beginners in the UK?

There is no single best course. Look for one that matches your chosen direction, includes hands-on labs rather than slides alone, and gives you work you can show employers. Free options such as OverTheWire and free GRC courses are a sensible place to start before paying for anything.

Do cyber security courses with a job guarantee work?

No training provider can control an employer’s hiring decision, so read exactly what any guarantee covers. Judge a course on the skills, practical work and career support it provides.

Which certification should a beginner take first?

ISC2 Certified in Cybersecurity (CC) requires no work experience, and CompTIA Security+ is widely recognised. Pick one and spend the rest of your effort on practical projects.

Is GRC a good route for career changers?

It often suits people from audit, legal, finance or compliance backgrounds. Governance, auditing, risk management and ISO/IEC 27001 were all among the most requested skills in UK core cyber job postings in 2025.

References

• Department for Science, Innovation and Technology (2026). Cyber security skills in the UK labour market 2026. https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2026/cyber-security-skills-in-the-uk-labour-market-2026
• UK Cyber Security Council (accessed 2026). Cyber Career Framework. https://www.ukcybersecuritycouncil.org.uk/careers-in-cyber/cyber-career-framework
• National Cyber Security Centre (accessed 2026). Cyber Essentials overview. https://www.ncsc.gov.uk/cyberessentials/overview
• ISC2 (accessed 2026). Certified in Cybersecurity (CC). https://www.isc2.org/certifications/cc
• ISC2 (2026). One Million Certified in Cybersecurity conclusion. https://www.isc2.org/insights/2026/04/one-million-certified-cyber-conclusion
• CompTIA (accessed 2026). CompTIA Security+. https://www.comptia.org/en-us/certifications/security/
• OverTheWire (accessed 2026). Wargames. https://overthewire.org/wargames/
• Wazuh (accessed 2026). Wazuh: open source security platform. https://wazuh.com/
• Security Onion Solutions (accessed 2026). Security Onion. https://securityonionsolutions.com/
• BSides London (2026). BSides London 2026: call for papers. https://pretalx.com/bsides-london-2026/cfp
• BSides Exeter (2026). BSides Exeter 2026. https://ti.to/bsides-exeter/bsides-exeter-2026
• ISACA London Chapter (accessed 2026). ISACA London Chapter. https://engage.isaca.org/londonchapter