If you have been watching cyber security career content online, you have probably absorbed a version of it that looks something like this: a lone figure in a dark room, surrounded by multiple monitors, running mysterious terminal commands while green text scrolls by. That image is not entirely wrong, but it leaves out most of the picture.
The reality of a career in cyber security in 2026 is broader, more collaborative, and more accessible than the aesthetic suggests. And the gap between people who are ready to work and people who just studied for it comes down to one thing: whether they have done it, or only read about it.
This guide is for beginners, career changers, and anyone building practical experience. We will walk through what the work actually looks like day to day, what skills employers are really testing for, and how to build them before you get your first job offer.
The honest state of the cyber security job market
The headlines are mostly accurate. Demand for cyber security professionals continues to outpace supply. According to ISC2's annual workforce study, the global workforce shortfall stands at around 4.8 million unfilled roles. The US Bureau of Labor Statistics projects the field will grow 29% between 2024 and 2034 — significantly faster than average across all occupations. Cyber security has been at near-zero unemployment for several years running.
|
4.8M
global roles unfilled (ISC2)
|
29%
projected growth 2024–2034 (BLS)
|
$65–85K
typical Tier 1 SOC salary (US)
|
What the headlines tend to understate is that breaking in has become more selective, not less. The 'just get your Security+' era is winding down. The Fortinet 2024 Cybersecurity Skills Gap Report found that 91% of employers prefer candidates with certifications — but increasingly, they want certifications that prove applied skill, not just exam knowledge. Employers have learned to distinguish between candidates who have passed exams and candidates who can actually investigate an alert, write a detection rule, or explain why traffic on port 445 over the internet is suspicious.
That is not discouraging news. It is clarifying news. It tells you exactly where to put your energy.
What the work actually involves
Cyber security is not a single job. It is a collection of related disciplines, each with its own day-to-day reality. The three most common entry paths are defensive operations (SOC work), penetration testing, and GRC (governance, risk, and compliance). They have different day-to-day rhythms, different toolsets, and different entry requirements.
Security Operations Centre (SOC) analyst
The SOC is where most people start. A Tier 1 analyst is the first line of response when something suspicious happens in an organisation's environment. The job is built around alert triage: you receive notifications from SIEM platforms and EDR tools, assess whether they represent genuine threats or false positives, document your findings, and escalate confirmed incidents to senior analysts.
A realistic Tuesday as a Tier 1 analyst might involve reviewing 50 to 100 alerts, correlating log data from multiple systems to determine whether a user account behaving strangely reflects a compromised credential or an IT policy change, writing up three incident tickets, and attending a brief team handoff. Most days are methodical rather than dramatic.
| What textbooks say | What you actually spend time on |
|---|---|
| Monitoring dashboards | Triaging alerts, filtering false positives, escalating real ones |
| Incident response | Writing tickets, documenting investigation steps clearly |
| SIEM analysis | Building queries, correlating events across sources |
| Threat intelligence | Reading security bulletins, applying context to live alerts |
| Detection engineering | Tweaking detection rules, reducing noise, improving coverage |
The skills that matter most in this role are not exotic. You need to understand TCP/IP well enough to recognise anomalous traffic. You need Windows event IDs and Linux command-line fundamentals. You need to be able to build a SIEM query, follow a process, and write a clear incident note. And critically, you need to be curious enough to ask why a process spawned a particular child process, not just flag it and close the ticket.
Penetration tester
Penetration testers are hired to find vulnerabilities before attackers do. Entry-level roles in this area are more competitive than SOC positions and usually require a demonstrated ability to exploit real systems, not just describe how it is done in theory.
Day-to-day work involves scoping engagements, running enumeration and exploitation toolchains against agreed targets, documenting findings in a way that non-technical stakeholders can act on, and collaborating with internal security teams. The reporting side of the job is often underestimated: a penetration test that finds a critical vulnerability is only valuable if the report communicates it clearly enough to get fixed.
GRC analyst
Governance, risk, and compliance roles are often overlooked by people entering cyber security from a technical background, but they represent a large proportion of available positions and are among the most accessible entry points for career changers from legal, business, finance, or project management backgrounds.
GRC work involves assessing an organisation's security posture against frameworks like NIST CSF or ISO 27001, documenting risks, writing and maintaining policies, and supporting audit processes. The technical bar is lower than SOC or pentesting, but the communication and analytical skills required are high.
Why there is a skills gap even with plenty of candidates
You might wonder how a field with millions of unfilled roles can also be competitive for entry-level applicants. The answer is that the gap is largely a skills quality gap, not a headcount gap. Organisations are not struggling to receive CVs. They are struggling to find applicants who can pass a practical assessment.
ISACA and ISC2 data shows that 90% of cyber security teams report internal skills gaps, even when they are fully staffed. The problem is not just hiring — it is that the skills required to work in security have evolved faster than most training programmes have kept up. Employers in 2026 are specifically looking for hands-on exposure to the tools and workflows used in real environments.
The skills that map most directly onto employability in 2026 are:
- SIEM proficiency — being able to construct queries, correlate events, and build dashboards in platforms like Splunk or Microsoft Sentinel
- Network analysis — reading packet captures, identifying anomalous traffic patterns, and understanding protocol behaviour (practised using tools like Wireshark)
- Windows and Linux fundamentals — navigating filesystems, reading event logs, understanding user and process activity
- Incident investigation methodology — following a structured process from alert to escalation, with clear documentation at each step
- Tool familiarity — practical experience with Wireshark, Nmap, Metasploit, Burp Suite, or forensic tools like Volatility and Autopsy, depending on your chosen path
AI has entered the picture here too. More than 64% of cyber security job listings in 2026 require some AI, machine learning, or automation familiarity. This does not mean candidates need to build models. It means they need to understand how AI-powered detection tools work, and how to use them effectively alongside traditional analysis.
Why passive learning does not produce job-ready skills
Most people begin their cyber security education the same way: they watch videos, read articles, follow tutorials, and work through certification study materials. There is nothing wrong with that as a starting point. Foundational knowledge matters. But passive learning alone has a ceiling.
Consider the difference between reading about how to analyse a packet capture and actually opening Wireshark, loading a PCAP file containing real network traffic, filtering by protocol, following TCP streams, and identifying what the attacker actually exfiltrated. The second experience teaches you things the first one cannot. You discover what normal traffic looks like. You develop the muscle memory for the tooling. You learn what the workflow feels like under mild time pressure.
The same applies to SIEM analysis, malware investigation, log correlation, and every other core skill in the field. The knowledge transfer from reading or watching to being able to execute confidently in a job interview — or on your first incident — only happens through repeated practice on real systems.
What effective cyber security practice actually looks like
Effective practice has a few distinguishing characteristics. It happens in environments that resemble real systems. It requires you to make decisions, not just follow steps. It gives you feedback on whether what you did was correct and why. And it is structured enough that you build on previous knowledge rather than repeating the same entry-level exercises indefinitely.
Scenario-based learning over passive content
The most effective preparation involves working through scenarios that mirror real incidents: a phishing email that has been clicked, a suspicious process running on an endpoint, unusual outbound traffic at 3am. These scenarios require you to apply multiple skills in sequence — not just identify that something is wrong, but investigate it, trace it, and document what you found.
Tool-first, theory-second
The instinct when learning a new tool is to read the documentation before touching anything. For cyber security, it is often more effective to reverse that: get your hands on the tool first, encounter the problems the documentation solves, and then read the documentation with the benefit of that context. This is particularly true for tools like Wireshark, Splunk, Nmap, and Burp Suite, which have steeply learnable interfaces once you have used them in a real context.
CTF challenges as skill checkpoints
Capture the Flag competitions give you a structured, time-pressured environment to test whether skills you have been building actually work when you are on your own. They are also an efficient way to encounter techniques you have not seen before: a well-constructed CTF challenge in the forensics or web exploitation category will often expose you to a method or tool that would take weeks to encounter through study alone.
Building a portfolio as you go
One of the most consistently cited hiring signals for entry-level candidates in 2026 is a documented portfolio of practical work: write-ups of CTF challenges you have solved, lab reports from investigations, notes from rooms you have completed. You do not need a finished product. You need evidence that you have done things, thought carefully about them, and can explain your methodology.
Where TryHackMe fits
TryHackMe is a browser-based learning platform built around exactly the kind of practice described above. Every room runs entirely in your browser — no local virtual machine required, no complex setup, no hardware investment. You connect to a live environment, receive a scenario or challenge, and work through it using real tools.
This matters practically: the barrier to starting is near zero. You do not need a capable laptop, a home lab, or three hours to configure a VM. You open a browser tab and you are working in a real Linux or Windows environment within seconds.
Learning paths aligned to real job roles
TryHackMe's structured learning paths are built around the actual skills required for specific roles. The SOC Level 1 path covers the day-to-day workflow of a Tier 1 analyst: SIEM investigation, phishing analysis, network traffic analysis, endpoint security, and threat intelligence. Completing it gives you documented, demonstrable experience in the exact areas entry-level SOC hiring managers are assessing.
Rooms that build the skills employers test for
Beyond the structured paths, individual rooms let you practise specific skills. If you have an interview coming up for a SOC role and want to sharpen your Splunk query skills, you can go directly to the Splunk rooms. If you are preparing for a penetration testing assessment, the Metasploit or Burp Suite rooms give you focused, practical reps.
The SAL1 certification
For candidates targeting their first SOC role, TryHackMe's Security Analyst Level 1 certification (SAL1) is worth understanding. It is a practical, scenario-based certification that assesses the skills a Tier 1 analyst actually needs — assessed through performance in a realistic environment rather than through a multiple-choice exam. It is designed to function as evidence of job readiness, not just knowledge.
Where to start, depending on where you are
The right starting point depends on your background and what you are trying to achieve. Below are three common profiles and the most direct path forward for each.
What a realistic progression looks like
If you have been watching cyber security career content online, you have probably absorbed a version of it that looks something like this: a lone figure in a dark room, surrounded by multiple monitors, running mysterious terminal commands while green text scrolls by. That image is not entirely wrong, but it leaves out most of the picture.
The reality of a career in cyber security in 2026 is broader, more collaborative, and more accessible than the aesthetic suggests. And the gap between people who are ready to work and people who just studied for it comes down to one thing: whether they have done it, or only read about it.
This guide is for beginners, career changers, and anyone building practical experience. We will walk through what the work actually looks like day to day, what skills employers are really testing for, and how to build them before you get your first job offer.
The honest state of the cyber security job market
The headlines are mostly accurate. Demand for cyber security professionals continues to outpace supply. According to ISC2's annual workforce study, the global workforce shortfall stands at around 4.8 million unfilled roles. The US Bureau of Labor Statistics projects the field will grow 29% between 2024 and 2034 — significantly faster than average across all occupations. Cyber security has been at near-zero unemployment for several years running.
What the headlines tend to understate is that breaking in has become more selective, not less. The 'just get your Security+' era is winding down. The Fortinet 2024 Cybersecurity Skills Gap Report found that 91% of employers prefer candidates with certifications — but increasingly, they want certifications that prove applied skill, not just exam knowledge. Employers have learned to distinguish between candidates who have passed exams and candidates who can actually investigate an alert, write a detection rule, or explain why traffic on port 445 over the internet is suspicious.
That is not discouraging news. It is clarifying news. It tells you exactly where to put your energy.
What the work actually involves
Cyber security is not a single job. It is a collection of related disciplines, each with its own day-to-day reality. The three most common entry paths are defensive operations (SOC work), penetration testing, and GRC (governance, risk, and compliance). They have different day-to-day rhythms, different toolsets, and different entry requirements.
Security Operations Centre (SOC) analyst
The SOC is where most people start. A Tier 1 analyst is the first line of response when something suspicious happens in an organisation's environment. The job is built around alert triage: you receive notifications from SIEM platforms and EDR tools, assess whether they represent genuine threats or false positives, document your findings, and escalate confirmed incidents to senior analysts.
A realistic Tuesday as a Tier 1 analyst might involve reviewing 50 to 100 alerts, correlating log data from multiple systems to determine whether a user account behaving strangely reflects a compromised credential or an IT policy change, writing up three incident tickets, and attending a brief team handoff. Most days are methodical rather than dramatic.
The skills that matter most in this role are not exotic. You need to understand TCP/IP well enough to recognise anomalous traffic. You need Windows event IDs and Linux command-line fundamentals. You need to be able to build a SIEM query, follow a process, and write a clear incident note. And critically, you need to be curious enough to ask why a process spawned a particular child process, not just flag it and close the ticket.
Penetration tester
Penetration testers are hired to find vulnerabilities before attackers do. Entry-level roles in this area are more competitive than SOC positions and usually require a demonstrated ability to exploit real systems, not just describe how it is done in theory.
Day-to-day work involves scoping engagements, running enumeration and exploitation toolchains against agreed targets, documenting findings in a way that non-technical stakeholders can act on, and collaborating with internal security teams. The reporting side of the job is often underestimated: a penetration test that finds a critical vulnerability is only valuable if the report communicates it clearly enough to get fixed.
GRC analyst
Governance, risk, and compliance roles are often overlooked by people entering cyber security from a technical background, but they represent a large proportion of available positions and are among the most accessible entry points for career changers from legal, business, finance, or project management backgrounds.
GRC work involves assessing an organisation's security posture against frameworks like NIST CSF or ISO 27001, documenting risks, writing and maintaining policies, and supporting audit processes. The technical bar is lower than SOC or pentesting, but the communication and analytical skills required are high.
Why there is a skills gap even with plenty of candidates
You might wonder how a field with millions of unfilled roles can also be competitive for entry-level applicants. The answer is that the gap is largely a skills quality gap, not a headcount gap. Organisations are not struggling to receive CVs. They are struggling to find applicants who can pass a practical assessment.
ISACA and ISC2 data shows that 90% of cyber security teams report internal skills gaps, even when they are fully staffed. The problem is not just hiring — it is that the skills required to work in security have evolved faster than most training programmes have kept up. Employers in 2026 are specifically looking for hands-on exposure to the tools and workflows used in real environments.
The skills that map most directly onto employability in 2026 are:
- SIEM proficiency — being able to construct queries, correlate events, and build dashboards in platforms like Splunk or Microsoft Sentinel
- Network analysis — reading packet captures, identifying anomalous traffic patterns, and understanding protocol behaviour (practised using tools like Wireshark)
- Windows and Linux fundamentals — navigating filesystems, reading event logs, understanding user and process activity
- Incident investigation methodology — following a structured process from alert to escalation, with clear documentation at each step
- Tool familiarity — practical experience with Wireshark, Nmap, Metasploit, Burp Suite, or forensic tools like Volatility and Autopsy, depending on your chosen path
AI has entered the picture here too. More than 64% of cyber security job listings in 2026 require some AI, machine learning, or automation familiarity. This does not mean candidates need to build models. It means they need to understand how AI-powered detection tools work, and how to use them effectively alongside traditional analysis.
Why passive learning does not produce job-ready skills
Most people begin their cyber security education the same way: they watch videos, read articles, follow tutorials, and work through certification study materials. There is nothing wrong with that as a starting point. Foundational knowledge matters. But passive learning alone has a ceiling.
Consider the difference between reading about how to analyse a packet capture and actually opening Wireshark, loading a PCAP file containing real network traffic, filtering by protocol, following TCP streams, and identifying what the attacker actually exfiltrated. The second experience teaches you things the first one cannot. You discover what normal traffic looks like. You develop the muscle memory for the tooling. You learn what the workflow feels like under mild time pressure.
The same applies to SIEM analysis, malware investigation, log correlation, and every other core skill in the field. The knowledge transfer from reading or watching to being able to execute confidently in a job interview — or on your first incident — only happens through repeated practice on real systems.
What effective cyber security practice actually looks like
Effective practice has a few distinguishing characteristics. It happens in environments that resemble real systems. It requires you to make decisions, not just follow steps. It gives you feedback on whether what you did was correct and why. And it is structured enough that you build on previous knowledge rather than repeating the same entry-level exercises indefinitely.
Scenario-based learning over passive content
The most effective preparation involves working through scenarios that mirror real incidents: a phishing email that has been clicked, a suspicious process running on an endpoint, unusual outbound traffic at 3am. These scenarios require you to apply multiple skills in sequence — not just identify that something is wrong, but investigate it, trace it, and document what you found.
Tool-first, theory-second
The instinct when learning a new tool is to read the documentation before touching anything. For cyber security, it is often more effective to reverse that: get your hands on the tool first, encounter the problems the documentation solves, and then read the documentation with the benefit of that context. This is particularly true for tools like Wireshark, Splunk, Nmap, and Burp Suite, which have steeply learnable interfaces once you have used them in a real context.
CTF challenges as skill checkpoints
Capture the Flag competitions give you a structured, time-pressured environment to test whether skills you have been building actually work when you are on your own. They are also an efficient way to encounter techniques you have not seen before: a well-constructed CTF challenge in the forensics or web exploitation category will often expose you to a method or tool that would take weeks to encounter through study alone.
Building a portfolio as you go
One of the most consistently cited hiring signals for entry-level candidates in 2026 is a documented portfolio of practical work: write-ups of CTF challenges you have solved, lab reports from investigations, notes from rooms you have completed. You do not need a finished product. You need evidence that you have done things, thought carefully about them, and can explain your methodology.
Where TryHackMe fits
TryHackMe is a browser-based learning platform built around exactly the kind of practice described above. Every room runs entirely in your browser — no local virtual machine required, no complex setup, no hardware investment. You connect to a live environment, receive a scenario or challenge, and work through it using real tools.
This matters practically: the barrier to starting is near zero. You do not need a capable laptop, a home lab, or three hours to configure a VM. You open a browser tab and you are working in a real Linux or Windows environment within seconds.
Learning paths aligned to real job roles
TryHackMe's structured learning paths are built around the actual skills required for specific roles. The SOC Level 1 path covers the day-to-day workflow of a Tier 1 analyst: SIEM investigation, phishing analysis, network traffic analysis, endpoint security, and threat intelligence. Completing it gives you documented, demonstrable experience in the exact areas entry-level SOC hiring managers are assessing.
Rooms that build the skills employers test for
Beyond the structured paths, individual rooms let you practise specific skills. If you have an interview coming up for a SOC role and want to sharpen your Splunk query skills, you can go directly to the Splunk rooms. If you are preparing for a penetration testing assessment, the Metasploit or Burp Suite rooms give you focused, practical reps.
The SAL1 certification
For candidates targeting their first SOC role, TryHackMe's Security Analyst Level 1 certification (SAL1) is worth understanding. It is a practical, scenario-based certification that assesses the skills a Tier 1 analyst actually needs — assessed through performance in a realistic environment rather than through a multiple-choice exam. It is designed to function as evidence of job readiness, not just knowledge.
Where to start, depending on where you are
The right starting point depends on your background and what you are trying to achieve. Below are three common profiles and the most direct path forward for each.
What a realistic progression looks like
People consistently underestimate how quickly practical skills compound when you are working in a hands-on environment consistently. Six months of regular, structured practice on TryHackMe - four to five hours a week - is enough to build genuinely interview-worthy skills for a Tier 1 SOC role.
The progression typically follows a recognisable arc. The first few weeks feel slow: concepts are unfamiliar, tools seem opaque, and you are spending as much time figuring out the environment as solving the actual challenge. By the end of the first month, the tooling becomes familiar and you start to see patterns. By month three, you start encountering scenarios you can approach with confidence rather than uncertainty. By month six, you have enough breadth to speak fluently about your methodology in an interview — and enough depth in your chosen area to pass a practical assessment.
This is not a guarantee or a formula. Individual pace varies. But the direction is consistent: people who practise regularly in hands-on environments get job-ready significantly faster than people who study passively, regardless of starting point.
Start building the skills that get you hired
The field needs people who can do the work. The tools, the scenarios, and the structured paths to get you there are available today, browser-ready, with no local setup required.Start with the Pre-Security path if you are brand new, or go straight to the SOC Level 1 path if you have some IT background. If you have a specific role in mind, the Jr Penetration Tester path, Cyber Defence path, and DFIR module each offer a targeted route. And when you are ready to benchmark yourself against a hiring standard, the SAL1 certification gives you something concrete to show for it.
The progression typically follows a recognisable arc. The first few weeks feel slow: concepts are unfamiliar, tools seem opaque, and you are spending as much time figuring out the environment as solving the actual challenge. By the end of the first month, the tooling becomes familiar and you start to see patterns. By month three, you start encountering scenarios you can approach with confidence rather than uncertainty. By month six, you have enough breadth to speak fluently about your methodology in an interview — and enough depth in your chosen area to pass a practical assessment.
This is not a guarantee or a formula. Individual pace varies. But the direction is consistent: people who practise regularly in hands-on environments get job-ready significantly faster than people who study passively, regardless of starting point.
Start building the skills that get you hired
The field needs people who can do the work. The tools, the scenarios, and the structured paths to get you there are available today, browser-ready, with no local setup required.Start with the Pre-Security path if you are brand new, or go straight to the SOC Level 1 path if you have some IT background. If you have a specific role in mind, the Jr Penetration Tester path, Cyber Defence path, and DFIR module each offer a targeted route. And when you are ready to benchmark yourself against a hiring standard, the SAL1 certification gives you something concrete to show for it.
Nick O'Grady