Pathway · Career changer → cybersecurity
Career change to cybersecurity, starting from the honest place
A no-experience credential can be open for registration while security work still requires networking, systems, troubleshooting, and security evidence. Use this page to identify the material capability gap, compare CC with Security+, and treat IT support as one possible evidence-building route — not a mandatory rung.
The honest on-ramp
Test the foundation gap before choosing a credential
If networking, operating systems, troubleshooting, or documentation are the material gaps, an IT-support pathway can provide structured practice. If those capabilities are already demonstrable, move directly to the reviewed entry-security decision instead of repeating foundations.
Prior compliance, investigation, operations, or documentation experience may offer useful practice clues, but it does not substitute for the technical capabilities above.
You are here
What actually transfers — and what does not
Per O*NET (U.S. Department of Labor), investigation habits, procedure discipline, and documentation practice transfer into security work on specific work activities: identifying objects and events, processing information, communicating findings, and following documented procedures. Those overlaps are descriptive, not a promise the switch is easy: networking, operating systems, security tooling, and log analysis may still be material gaps. See the cited overlap for your specific background:
The realistic target role
Cybersecurity Analyst
Occupation-level BLS median: $129,180 (SOC 15-1212) — a national occupation figure across experience levels; it does not establish entry pay, credential-holder pay, or a promised outcome. BLS OEWS May 2025 — Information Security Analysts (15-1212), national checked 2026-06-25T08:28:38+00:00BLS projects +28.5% employment change for this occupation between 2024 and 2034 — from 182,800 jobs to 234,900. It is a forecast, not a guarantee, and it describes the occupation, not this certification.
The honest certification ladder
Four decision checkpoints, not a mandatory ladder
Fit labels derive from each vendor’s own published eligibility — entry-friendly, conditions-apply, or experience-gated. Start from the capability gap and preserve the CISSP experience boundary; do not treat the list as a required sequence.
CC - Certified in Cybersecurity Designed for entry · exam $199 (fee as of 2026-08-23)
ISC2 states no work experience is required for this credential. Use it to organize foundational security knowledge; the credential does not by itself establish readiness for security work.
Vendor’s recommended background: No work experience required
CompTIA Security+ Reach — conditions apply · exam $439 (fee as of 2026-06-13)
Use the reviewed Security+ versus CC comparison when broader security-operations scope is the material gap.
Vendor-recommended before it: CompTIA Network+ (a recommendation, not a registration gate).
Vendor’s recommended background: CompTIA recommends Network+ plus two years in a security or systems-administrator role (preparation guidance, not a registration requirement).
CompTIA CySA+ Reach — conditions apply · exam $439 (fee as of 2026-08-23)
Consider this decision only when analyst tasks and security-tool practice are the material gap, and verify the current exam identity on the linked page before paying.
Vendor’s recommended background: About 4 years in a SOC analyst or vulnerability analyst role.
CISSP - Certified Information Systems Security Professional Not yet — experience-gated · exam $749 (fee as of 2026-07-05)
On this track, but not yet, and that is intentional. The experience requirement is a vendor gate, not our judgment. The Associate of ISC2 path is shown on the certification page.
Why not yet: full certification requires 5 years of relevant paid work experience — a vendor requirement, not our judgment. ISC2 Associate pathway: passing this ISC2 certification exam without required experience can lead to Associate of ISC2 status (up to six years for this exam path).
Fees and eligibility from each vendor’s official pages (cited and dated on the linked certification pages).
The money picture
What it costs, and the levers that can cover it
Exam fees are only one part of the purchase decision. Renewal and maintenance vary by credential and route, so verify the linked decision before paying. Two possible funding levers are WIOA, which can fund training and exams through your local American Job Center (eligibility is determined locally, not by us), and Workforce Pell reaches short-term certificate programs at eligible community colleges. Both are covered with sources and caveats on the funding page:
The study path
Free and official first
Start with the issuer’s published objectives and any official free preparation available through the certification explorer. Investigate instructor-led training only when schedule, feedback, lab access, or employer funding makes the format useful. Compare the total transaction — labs, voucher, retake terms, recordings, schedule, and cancellation terms — without treating format as an exam or employment outcome.
Common questions
Career change to cybersecurity, answered honestly
- Can I get into cybersecurity with no IT experience?
- A credential’s registration rule and readiness for security work are different questions. ISC2 states that CC requires no work experience, but learners still need networking, systems, troubleshooting, and security evidence. IT support is one way to build some of that evidence; it is not a universal prerequisite.
- Should I start with ISC2 CC or Security+?
- Use the reviewed CC-versus-Security+ comparison. CC has no work-experience requirement; Security+ covers a different decision scope and CompTIA publishes recommended background rather than a registration gate. Choose from the capability gap, not a universal ladder.
- Should I take Security+ first?
- There is no universal first credential. Use Security+ when its reviewed scope matches the security-operations knowledge and evidence gap you need to close; otherwise use the comparison to choose a narrower starting decision.
- Do I need CISSP to start in security?
- No. CISSP is experience-gated by ISC2 — full certification requires years of cumulative paid work in its domains (the exact requirement renders in the ladder above, cited to ISC2). It appears on this page so you can see the whole track honestly, including the part that is not yet available to you. The Associate of ISC2 route exists for people who pass the exam before the experience.
- How long does it take to change careers into cybersecurity?
- No honest fixed answer exists. The sequence depends on your existing networking, systems, troubleshooting, and security evidence plus the time and lab access you can sustain. Fit Check provides a bounded next decision; it does not predict time to employment.
One bounded next decision
Use the three-question Fit Check to choose a work family, starting point, and constraint. It returns one action, a direction, or an explicit coverage gap; it does not predict hiring, salary, exam results, or time to employment.