Can you really get a job in cyber security without a university degree?
Yes. Some employers accept practical experience, industry certifications, and other evidence of technical ability instead of a formal degree.
The challenge is demonstrating that you have the skills to do the work.
An employer hiring a SOC analyst wants someone who can investigate alerts and explain their findings. A penetration testing team needs people who can identify vulnerabilities, test them safely, and communicate the results.
If you're entering cyber security without a degree, your application needs to show what you can do and how you've developed those abilities.
This guide explains what employers look for, which skills and certifications can strengthen your application, and how to build practical experience through TryHackMe.
Can You Get a Cyber Security Job Without a Degree?
A degree is not a universal requirement for cyber security jobs.
Some employers accept equivalent experience or alternative qualifications, particularly when candidates can demonstrate relevant technical skills.
For example, an October 2026 Network Security Engineer vacancy from North Northamptonshire Council accepted a technology-related qualification at degree level or equivalent experience.
The role also required at least two years of relevant experience, showing why it's important to read the full job description rather than focusing on the education requirement alone.
That distinction matters when searching for opportunities.
For roles that interest you, review the essential requirements and determine how your experience matches them.
You can also ask a recruiter whether equivalent qualifications or practical experience are accepted when the wording is unclear.
What Are Employers Looking for Instead?
Employers need people who can perform the responsibilities associated with the role.
According to the UK government's Cyber Security Skills in the UK Labour Market 2026 report, 38% of surveyed cyber security businesses reported that job applicants lacking technical skills had affected their ability to meet business goals.
That finding reflects a concern among those businesses rather than a universal hiring requirement.
For anyone starting without a degree, it reinforces the value of developing relevant skills and providing evidence that an employer can assess.
What Counts as Proof of Cyber Security Skills?
Proof of skill is evidence that you can apply your knowledge to a technical problem.
It might come from a hands-on training exercise, a personal project, a professional certification, or responsibilities you've handled in another job.
The strongest evidence helps someone understand what you did, how you approached the problem, and what the outcome demonstrates.
Each form of evidence serves a different purpose. A completed learning path shows structured training. A portfolio project demonstrates how you approached a task. A professional certification provides an assessment of specific skills.
Together, they can help an employer understand your readiness for the role.
Be clear about the work you've completed independently and where you followed instructions or received assistance.
Label simulated investigations as lab experience rather than presenting them as incidents handled for an employer.
Which Cyber Security Skills Should You Learn First?
Before investing in several certifications or building a large portfolio, think about which role you want to pursue.
Different cyber security jobs require different technical skills.
For example, a SOC analyst investigates suspicious activity, while a penetration tester performs authorised security assessments to identify vulnerabilities.
Both need foundational cyber security knowledge, but their daily responsibilities are different.
Build Your Technical Foundations
If you're new to IT and cyber security, start with the skills that support most technical roles.
These include:
- Networking: Understanding how devices communicate, including IP addresses, ports, and common network protocols.
- Operating systems: Becoming comfortable with Windows and Linux, including files, processes, user accounts, and permissions.
- Security fundamentals: Learning how threats, vulnerabilities, authentication, and access controls work.
- Troubleshooting: Identifying the cause of a technical problem and testing possible explanations.
TryHackMe's Cyber Security 101 learning path provides a structured introduction to these areas through hands-on exercises.
As you learn, practice explaining what happens during each task and why a particular result matters. That understanding becomes useful when you move into more specialised training or a technical interview.
Choose a Role That Matches Your Interests
Once you've developed the foundations, explore the work involved in different cyber security careers.
You don't need to commit to a specialisation immediately. Try a few introductory exercises, review job descriptions, and see which activities you enjoy most.
TryHackMe's guide to choosing a cyber security career path can help you explore the differences.
How to Build a Cyber Security Portfolio Without Work Experience
A cyber security portfolio is a collection of projects that demonstrate your technical skills.
It's particularly useful when you're applying for jobs without extensive professional experience because it gives employers something concrete to review.
You can create one using authorised training environments such as TryHackMe. Start with two or three projects relevant to your target role. Aim for work you understand well enough to explain during an interview.
Project 1: Investigate a Security Alert
If you're interested in SOC analyst roles, start with SOC L1 Alert Triage and SOC L1 Alert Reporting.
These rooms develop skills used when reviewing security alerts and documenting investigations.
A security alert is a notification generated when a monitoring tool detects potentially suspicious activity.
Alert triage involves examining the available information to determine whether the activity needs further investigation.
After completing the exercises, create an original case study explaining:
- What triggered the alert and what you investigated.
- Which evidence you examined and why it mattered.
- How you reached your conclusion.
- What you would recommend investigating next.
Keep your report concise and make sure the findings are supported by the evidence available in the lab.
This gives employers an example of your investigation and reporting skills.
Project 2: Document a Penetration Testing Finding
For offensive security roles, use TryHackMe's Writing Pentest Reports room to develop your reporting skills.
A penetration testing report explains the vulnerabilities discovered during an authorised security assessment, the risks they create, and how they can be addressed.
Choose one vulnerability from a practice lab you're permitted to document.
Build a short report that explains the weakness, the evidence supporting your finding, its potential impact, and your recommended remediation.
Where the lab allows it, demonstrate how you verified that the weakness was addressed.
Employers can use this work to assess whether you understand the technical issue and can communicate it clearly.
Project 3: Build and Test a Detection Rule
If you're developing more advanced defensive skills, consider Detection Rules Development.
A detection rule is logic used by a security tool to identify activity that may require investigation.
For example, a rule might identify an unusual relationship between two processes running on a Windows system.
After completing the room's prerequisites and practical tasks, document a detection you've tested using permitted data.
Explain the behaviour it targets, which logs it requires, and how you evaluated it against suspicious and legitimate activity.
Include any limitations you discovered. This demonstrates that you can develop and evaluate a security detection rather than simply reproduce a rule.
How Should You Present Your Projects?
Each portfolio project should make it easy for someone to understand your contribution.
Use a consistent structure:
- Objective: What problem were you trying to solve?
- Environment: Which tools, lab, or systems did you use?
- Approach: What steps did you take and why?
- Findings: What did the evidence establish?
- Outcome: What did you learn or recommend?
Avoid publishing protected lab answers, credentials, flags, or confidential information. Follow the room's sharing rules and use original explanations or sanitised examples where necessary.
A few well-documented projects can provide stronger interview material than a long collection of completed rooms you struggle to explain.
Which Cyber Security Certifications Can You Get Without a Degree?
Professional certifications can help demonstrate your knowledge and practical skills.
Many cyber security certifications do not require a university degree, including TryHackMe's SEC1, SAL1, and PT1.
Choose according to your experience and the work you want to do.
TryHackMe's guide to certifications that don't require a degree explains how these assessments support practical skill development.
Do Employers Value Practical Certifications?
Certifications can help employers understand which skills you've been assessed on, particularly when you're new to the industry.
However, their value depends on the role and the employer's requirements. For example, SAL1 is relevant to learners preparing for SOC analyst responsibilities, while PT1 is more closely aligned with penetration testing.
Select a certification based on the work you want to demonstrate. Also distinguish a learning path completion certificate from a professional certification.
A learning path records completed training. A professional certification requires passing a separate assessment.
TryHackMe explains this distinction in its guide to certificates of completion and professional certifications.
A certification can strengthen your application, but it doesn't automatically replace professional experience or satisfy every employer's education requirements.
How to Write a Cyber Security CV Without a Degree
If you don't have a degree, make your relevant skills and practical work easy to find.
You can still build a strong CV around technical projects, certifications, existing experience, and the responsibilities you're ready to handle.
Focus on the skills mentioned in the vacancy.
For a junior SOC analyst application, for example, employers may want evidence of log analysis, alert triage, and incident documentation.
Rather than listing these skills without explanation, connect them to work you've completed.
Show What You Did, Not Just What You Studied
Consider the difference between these examples.
Completed cyber security labs and learned about SOC investigations.
Investigated simulated security alerts in a TryHackMe SOC lab, correlated authentication events, documented findings, and prepared incident handovers.
The second example explains the actual work and skills involved.
Use similar descriptions for other projects, but make sure every statement accurately reflects your contribution.
Include Relevant Experience From Other Jobs
Previous work in IT support, network administration, software development, or other technical roles can provide useful experience.
For example, someone who managed user accounts or investigated network problems may have developed skills applicable to identity security or incident investigation.
Even non-security roles can help demonstrate communication, documentation, and problem-solving.
Describe those responsibilities accurately and explain how they relate to the job you're applying for.
Keep paid experience and lab projects in separate sections so employers can distinguish professional responsibilities from practical training.
How to Prepare for a Cyber Security Technical Interview
A technical interview gives an employer an opportunity to understand how you approach problems.
You may be asked to explain a security concept, investigate a scenario, or discuss one of your projects. Prepare to walk through your work from the original problem to the conclusion.
For example, if you've documented a suspicious login investigation, you should be able to explain which logs you examined, what made the activity unusual, and which evidence would help confirm or challenge your assessment.
Questions You Should Be Ready to Answer
Practise explaining:
- Why you chose a particular tool or investigation method.
- What the available evidence established.
- Which alternative explanations you considered.
- What you would investigate next.
- What you would do differently after reviewing your results.
You don't need to pretend you know everything.
If you're unfamiliar with a tool or technique, explain how you would approach learning it or investigating the problem.
Employers can assess your reasoning as well as your technical knowledge. Be prepared to discuss any certification or project you've included on your CV.
What If You Have No Degree and No IT Experience?
You can still begin learning cyber security, although your route into employment may involve building technical experience first.
The UK government's 2026 cyber security labour market research found that some employers increasingly expected previous IT experience for entry-level security positions, including experience gained through help desk roles.
That makes roles in IT support, service desk operations, and related technical areas worth considering.
You can develop networking, operating system, troubleshooting, and user administration skills while continuing to study security.
Apprenticeships and other training routes may also be suitable, depending on their entry requirements and availability.
A Practical Starting Plan
If you're beginning without a degree or relevant experience, use the following approach:
You can work on these activities alongside one another. For example, you might begin applying for suitable IT support positions while continuing to build your SOC investigation skills.
The important thing is to develop experience you can explain and connect that work to the requirements of your target roles.
Build a Cyber Security Career Around the Skills You Can Demonstrate
A university degree can be valuable, but it isn't the only way to develop cyber security skills or qualify for relevant opportunities.
Employers who accept alternative routes still need evidence that you can perform the work.
With TryHackMe, you can build foundational knowledge, practise real security tasks in controlled environments, and develop projects that show your abilities.
Start with the Cyber Security 101 learning path, then choose a specialisation that matches the role you want to pursue.
As your confidence grows, document the investigations, assessments, or technical projects you've completed.
Ayomide Joseph A.
