22 September 2026 | Michael Tchuindjang, Cyber Security Thought Leader and Associate Lecturer in Cyber Security, University of the West of England, and UK Cyber Security Council Volunteer.

There is a strange contradiction in cybersecurity. Organisations continue to report skills shortages, yet many people trying to enter the profession struggle to find opportunities to develop those very skills. The UK Government’s 2025 Cyber Security Skills in the Labour Market report estimated that approximately 143,000 people were employed in cyber security roles across the UK economy at the end of 2024. It also estimated a net annual cyber security workforce gap of approximately 3,800 professionals for 2025. So, there is clearly demand for cyber security capability. But that doesn't mean that every organisation is looking for someone without experience. The market increasingly expects candidates to arrive with evidence that they can perform useful tasks.

This creates the experience paradox: You need experience to get the job, but you often need the job to get experience. And there's another complication: artificial intelligence is changing the entry-level job market too. So, the question for someone starting a cyber security career today isn't just “how do I get a cybersecurity job?” It's “how do I demonstrate that I can contribute to cyber security when I haven't yet had a job in cyber security.”

Experience is more than a job title

When beginners hear "experience", they often think only about employment: three years as a SOC analyst, two years in penetration testing, five years in security engineering etc.

Those are certainly forms of experience, but it's important to understand that employment is not your only route to experience. When possible, look for internships, placements, apprenticeships and volunteering opportunities that allow you to apply your skills in a real-world environment. One effective way to discover these sorts of opportunities is by joining cyber security communities such as the the UK Cyber Security Council's Cyber Access Network, the SANS Institute and WiCyS, which provide access to professional networks, mentoring, events, training and, in the case of WiCyS, career opportunities specifically supporting women in cybersecurity.

But they aren't the only ways to demonstrate capability. Beginners who cannot secure an internship or volunteer position should instead focus on something they can control: building credible evidence of capability. Therefore, you shouldn’t think about your journey as:

Explore → Learn → Get a job → Gain experience.

Instead, think of it as:

Explore → Learn → Practise → Build → Investigate → Document → Share → Work

This means building an experience ladder, which we’ll explore in more detail in the next section.

Build an Experience Ladder

If you are reading this and thinking, “this all sounds good, but where do I start?”, a top tip is to keep it simple.

A) Explore

There are many paths to explore, just to name a few:

Security Operations Centre (SOC)
Penetration Testing
Cloud Security
Governance, Risk and Compliance (GRC)
Digital Forensics
Threat Intelligence
Application Security
Security Engineering

Pick one area at a time, preferably the one that resonates most with you or aligns best with your background and explore it. Find 10 real job descriptions for roles in that area. Don’t obsess over the years-of-experience requirements but make sure you look for the recurring skills and technologies that employers are asking for, and focus on building those skills through projects, labs, and hands-on practice.

B) Learn

Now that you have identified an area of interest and understand what employers are looking for, you can build your foundations.

Focus on areas such as networking, operating systems, authentication, vulnerabilities, cloud computing, scripting and core security principles. You don't need to know everything, cyber security is far too broad for that. Your goal is to develop enough foundational knowledge to understand the problems you want to solve and the skills you need to develop.

Exploration tells you where to look. Learning gives you the foundation to move forward.

C) Practice

Use safe environments such as cyber security labs, freely accessible Capture The Flag (CTF) platforms like TryHackMe, Hack The Box and PicoCTF, virtual machines, deliberately vulnerable applications, and simulated incidents. In doing so, you can begin to move from: “I understand this.” to: “I can apply this.”

D) Build

Create something. It could be:

a log-analysis script
a phishing-analysis workflow
a home SOC
a vulnerability-management dashboard
a threat-intelligence project
a cloud-security lab
a security automation tool.

It doesn't have to be revolutionary. What matters is being able to explain why you built it, what problem it addressed, what you discovered and what you would improve.

E) Investigate

Take a realistic scenario: A user clicked a suspicious link. What happened?

What evidence would you collect?
Which logs would you examine?
What indicators would you investigate?
What would you recommend?

You have now created something you can discuss during an interview or include in your CV. It isn't professional experience, but it is relevant practical experience.

F) Document

As well as finding problems, cyber security professionals also have to explain them.

Document your work using:

Scenario → Methodology → Evidence → Findings → Risk → Recommendation → Lessons learned

This demonstrates technical understanding and communication.

G) Share

Leverage social media and professional platforms to make your learning and projects visible. Share what you have learned, the challenges you have encountered, the solutions you have developed, and the projects you have built. Platforms such as LinkedIn can help you demonstrate your knowledge, build your professional reputation, connect with others in cybersecurity, and make your capabilities easier for potential employers and collaborators to discover.

Build an experience ladder matters because cybersecurity is increasingly collaborative. The 2025 ISC2 Cybersecurity Workforce Study found that problem-solving, collaboration, communication and willingness to learn were among the top nontechnical skills sought by cyber security hiring managers. Degrees or certifications can be valuable; they provide structure, demonstrate knowledge and can help candidates pass certain recruitment filters. But, there is a danger in turning degree or certification collection into a substitute for practical development. So instead of collecting badges, it's better to build capability.

Don't just build projects, make them visible.

A beginner can spend weeks building an excellent project, upload it to GitHub, stop there and wonder why nobody notices it. Building is only half the job. A project is evidence and it is communication makes that evidence discoverable. This is where LinkedIn, X and YouTube can become powerful career tools. You don't need to become an influencer, but you need to learn how to communicate your work professionally.

A) LinkedIn: turn projects into professional evidence

For someone entering cyber security, LinkedIn can be particularly valuable because it combines professional networking, recruitment and knowledge sharing.

When you're posting about what you've achieved on LinkedIn, it's important to tell the story. Don't just share:

“I completed a SOC project. Check out my GitHub!”

Be more specific, for example:

“I wanted to understand what suspicious authentication activity actually looks like from a SOC analyst's perspective.

So I built a small lab and generated several authentication scenarios. The biggest lesson wasn't creating the alert. It was learning that an alert without context can be almost meaningless.

I compared normal and suspicious authentication patterns and built detection logic around the differences.

Three things I learned:

1. A single failed login rarely tells the whole story.

2. Context can be more valuable than the alert itself.

3. Detection is only useful if someone can interpret it.

I've documented the investigation here: [GitHub project link].

For those working in SOC environments, what signal do you find most useful when investigating suspicious authentication activity?”

There's a real difference between those two examples. In the latter, you're not just saying 'look at me'. you're explaining that you investigated something, learned something and would like to learn from others.

B) Show, don't just tell

Cybersecurity is visual.

If you built a dashboard, show it.

If you analysed logs, show a sanitised example.

If you created a detection rule, explain it visually.

If you built a home lab, show the architecture.

If you investigated a phishing email, create a diagram of your investigation.

And don't underestimate the impact of video. A 60–120 second screen recording, for example, can often demonstrate a project far more effectively than a paragraph of text. For longer demonstrations, YouTube can host a detailed walkthrough, while LinkedIn or X can share the key lessons and direct people to the full project.

Think of the platforms as different layers:

LinkedIn: Professional story + lesson + discussion
X: Technical observation + conversation
YouTube: Demonstration + deeper explanation
GitHub: Code + evidence + documentation

One project can therefore become an entire professional evidence ecosystem.

C) Turn one project into a series

You don't need a new project for every post/ One project can become:

Post 1: Why I started it.
Post 2: How I designed the environment.
Post 3: The first problem I encountered.
Post 4: What the investigation revealed.
Post 5: What I got wrong.
Post 6: What I would improve.
Post 7: Final lessons.

The key thing here is that you do more than demonstrating what you built, you also want to demonstrate how you learned.

Then AI Entered the Conversation

A) Don't compete with AI at being AI

There's no doubt anymore that AI is changing cyber security work. Some tasks traditionally performed by junior professionals, for example, involve large volumes of repetitive activity that AI is increasingly able to assist with. For example:

alert triage
log analysis
indicator enrichment
basic scripting
vulnerability analysis
threat-intelligence research
report summarisation.

An 2025 ISC2 survey found that 52% of respondents believed AI security tools would significantly or somewhat reduce the need for entry-level cybersecurity staff. More recent ISC2 research, published in 2026, found that 56% of cybersecurity professionals who use AI believed it had reduced the need for entry-level positions over the previous year.

But, there is another side. The same 2026 research found that 53% believed AI was creating new types of entry-level cybersecurity roles.

So the takeaway here isn't that AI taking all cyber security jobs, and not is it that AI won't change anything. Instead, the more realistic conclusion is AI is changing what organisations need from cyber security professionals.

If AI can produce a basic vulnerability explanation in seconds, your competitive advantage isn't necessarily producing another one. Your value increasingly comes from what happens around the output. For example:

Can you determine whether it is correct?
Can you recognise when it is wrong?
Can you investigate the evidence?
Can you understand the business context?
Can you challenge an automated recommendation?
Can you communicate risk?

The future cyber security professional will increasingly need to be AI-literate without becoming AI-dependent. It's not enough just to write “AI skills” on your CV because you've used ChatGPT, you need to be specific and communicate an actual capability. For example, explaining how you “used generative AI to assist with log analysis and independently validated its findings against source data.”

B) Don't manufacture expertise

An important note here: visibility should never become a performance. You don't need to turn 'I completed a lab' into 'I discovered a critical vulnerability.' A few other examples:

Don't present simulated data as a real-world breach.
Don't claim professional experience you don't have.
Don't copy someone else's project and present it as your own.

That's not an exhaustive list, but the general principal is that if AI helped you, be transparent. Professional credibility is built on accuracy, not exaggeration.

Your first cyber security job might not have cyber security in the title.

A ) Use IT roles as a pathway into cyber security

Cyber security is connected to almost every area of Information Technology (IT) and there are many different career paths that lead into the sector. For example, your route might be one of the following:

IT support → Systems administration → Cyber security.
Networking → Network security.
Software development → Application security.
Cloud engineering → Cloud security.
Risk/compliance → GRC.

IT remains the most common pathway into cybersecurity. The 2025 ISC2 Cybersecurity Workforce Study [7] found that 56% of respondents entered cybersecurity through an IT pathway. So, if you can't immediately get the cyber security role you want, ask: “what adjacent role could help me build skills that move me closer to it?” Your first technology job doesn't have to be your final destination.

B) Don't wait until you feel ready

One common trap is endless preparation: another certification, another tutorial, lab or CV revision. Eventually, preparation can become a comfortable form of procrastination. The likelihood is that, no matter how much preparation you've done, you'll probably never feel completely ready. So, take the leap and apply. You might be rejected, but that's normal. You might discover that you're missing some skills, but that's a good thing, because now you know what else you need to learn. Similarly, you might get to the interview stage and realise you can't explain something you thought you understood. Again, that's something that can let you know what you need to practice.

The objective isn't to become perfect before entering the profession. Instead, its to make sure you're continuously reducing the gap between where you are and where you need to be.

In conclusion, the cyber security job market is competitive, AI is reshaping entry-level roles, certifications alone may no longer be enough to differentiate candidates, and many employers will continue to ask for prior experience. While you can't control these realities, you can control what you build, how you practise, how you document your work, and whether you make your capabilities visible.

The traditional pathway of degree, certification, junior job and experience is becoming less reliable on its own. A more resilient approach is to explore, learn, practise, build, investigate, document, share, contribute and work, with AI woven throughout the journey. Use AI, understand it, question it, learn how it can fail, explore how attackers can abuse it and discover how defenders can use it, but never let it replace your judgement.

You can't manufacture three years of professional experience overnight, and nor should you try to. Instead, focus on building something equally valuable: credible evidence of capability. So, rather than asking “how can I get someone to give me experience?”, start asking, “what evidence can I create today that demonstrates what I am capable of doing?” Your first cybersecurity opportunity does not have to be the moment you start learning, it can be the moment you start demonstrating what you have already learned.