No Degree? Here’s What UK Cyber Security Employers Actually Expect

Can You Work in Cyber Security Without a Degree?

You can work in cyber security without a degree. Plenty of people do. But it is harder than most online guides admit, and the main obstacle is not the degree. It is experience.

If you skipped university, or you are changing career in your thirties, you deserve a straight account of what employers ask for. This article uses the UK government’s latest research on the cyber security job market, published on 29 September 2026, along with what employers told the researchers in interviews. It covers the routes people take, the jobs worth applying for first, and where a diploma or certification helps and where it does not.

Short Answers:

•       Most advertised cyber jobs ask for a degree. Yet about two thirds of the cyber firms that had recruited recently said they had hired through non-degree routes.

•       Experience is the bigger barrier. Very few postings welcome people with under a year of experience. Most ask for two to six years.

•       Most people start in IT, not in cyber. Even many cyber security graduates begin on a help desk.

•       Apprenticeships are real but scarce. England saw only 500 cyber security apprenticeship starts in 2024/25.

•       Diplomas and certifications help you learn and show commitment. They do not replace a degree requirement, and they do not guarantee an interview.

•       Your best route depends on where you are today. The last section sets out three starting points.

Do you really need a degree for cyber security?

On paper, often yes. In practice, less often than the adverts suggest.

The government study was carried out by Ipsos and Perspective Economics for the Department for Science, Innovation and Technology. The researchers looked at online job adverts from 2025. They counted 34,932 postings for core cyber security roles, meaning jobs where security is the main part of the work. Among the postings where an education level could be identified, 77% asked for at least a bachelor’s degree or equivalent. A further 10% wanted a master’s degree or PhD. Only 12% were open to people with GCSEs, A levels or a foundation-level qualification.

So if you only apply to adverts that list a degree, you will be ruled out of most of them before anyone reads your CV.

But adverts are one side of the story. The researchers also surveyed cyber security firms. Of the 118 firms that had advertised vacancies since January 2024, 65% said they had hired through non-degree routes. Smaller firms in particular tend to care more about whether you can do the work. One micro business in the study described its approach as simply hiring whoever can do the job.

Two other facts are worth knowing.

First, the 34,932 figure counts only jobs where security is the main duty. The researchers found another 32,032 postings that asked for cyber skills inside a wider role. Those are often easier to reach from an IT background.

Second, a degree is no guarantee of work. About 15 months after graduating, 11% of cyber security graduates were unemployed, compared with 6% of graduates overall. Only 30% had moved into a cyber security professional role. Another 11% were working in IT user support. If graduates often begin on the service desk, there is no shame in doing the same.

What employers look for first: experience

The same study shows how demand for beginners has shrunk. Among postings that stated how much experience they wanted, the share open to people with under a year has fallen every year since 2022.

In 2025, 64% of those postings asked for two to six years of experience. Overall, postings for core cyber roles fell by about half between 2022 and 2025, and the drop came mostly from entry-level and early-career jobs. Postings asking for under two years of experience fell by 53%.

There is a little good news. Core cyber postings rose by 7% in 2025, from 32,671 to 34,932. The researchers describe this as a market settling down rather than a return to the busy years. In 2023 there were 48,492.

One caution before you quote these numbers anywhere: more than 70% of postings did not say how much experience they wanted. Treat the figures as a clear direction, not an exact count.

What employers said in interviews

The interviews, which the researchers say are not a representative sample, add colour to the numbers. These themes came up repeatedly:

•       The entry-level market is crowded. Employers said they were swamped with applications from junior candidates who did not have the right skills.

•       IT experience is increasingly expected. Some employers and recruiters said entry-level security jobs now often want time on an IT help desk or similar.

•       Automation is reducing the old training roles. Routine monitoring work in security operations centres used to teach newcomers the basics. As more of it is automated, there are fewer places to learn on the job.

•       Candidates overclaim. Several employers said people arrive at interview saying they can do tasks they then fail in the technical test.

•       CVs are harder to trust. Employers reported more applications that looked as if an AI tool had written them, which makes it harder to tell who can actually do the work.

•       Some firms no longer advertise. One small firm said a single LinkedIn advert brought in around 1,300 CVs in a week. The researchers noted that heavy application volumes could push employers towards referrals and personal contacts.

Put together, the message is plain. Employers are not looking for the person with the most certificates. They want someone who has already shown, in some real setting, that they can handle technical work and learn quickly.

Five ways in without a degree

These routes can be combined. Most people who succeed use at least two.

1. Start in IT support or another technical job

This is the most common route, and it appears in UK careers guidance. Prospects and the National Careers Service both describe moving into security through IT work and experience. A service desk or support role teaches you how Windows accounts work, how networks fail, how to explain a technical problem to a worried person and how to keep records. Those are daily tasks in many security jobs.

It is not glamorous, but it answers the question employers keep asking: has this person worked in a real IT environment?

2. Apply for an apprenticeship

An apprenticeship gives you a paid job and structured training together. Skills England lists a Level 4 Cyber Security Technologist apprenticeship (reference ST1021) that typically takes 24 months, with options in cyber defence and response, risk, and engineering.

The catch is competition. In England there were 500 cyber security apprenticeship starts in 2024/25, down 15% from 590 the year before, and 290 people completed one. Wider digital apprenticeships are far more common, with 31,410 starts, and some of them (IT support or network roles, for example) can lead towards security. About 28% of cyber firms in the study offered apprenticeships, compared with 17% offering graduate schemes. That figure covers England only for the starts data, and Scotland, Wales and Northern Ireland run their own schemes, so check what applies where you live.

3. Study a regulated diploma

A diploma gives you a structured path through the subject, which helps if you are teaching yourself and keep hitting gaps. It also shows an employer you can finish something.

Be clear about what it is, though. UK qualifications sit on a ladder of levels. Level 4 is comparable to the first year of a degree (a Certificate of Higher Education or HNC), and Level 5 to a foundation degree or HND. A bachelor’s degree is Level 6. So a Level 4 or Level 5 diploma is not a degree, and you should not describe it as one. An advert that asks for a degree or equivalent may still turn you down, and the employer, not the college, decides how to read it.

Where a diploma does help is in giving you a recognised qualification, a base of knowledge, and a possible route into a top-up degree later. ICOL offers cyber security diplomas studied online and assessed by assignment, including a Level 4 Diploma and a Level 5 Diploma. You can check any regulated qualification on the Ofqual register, and our guide to what Ofqual is explains why that matters.

4. Earn a certification

Certifications test specific knowledge. ISC2 offers Certified in Cybersecurity, which has no work-experience requirement, and CompTIA certifications such as Security+ are widely used. They can be a sensible first step.

However, the government’s interviews picked up a sense of certification fatigue among recruiters, who see a growing number of paid certifications. A long list of badges does not impress anyone. Choose one or two that match the jobs you are applying for, and be ready to explain what you can actually do with that knowledge.

5. Build something you can show

Employers keep saying that candidates claim skills they cannot demonstrate. A small, honest portfolio fixes that. Examples:

•       A home lab of virtual machines where you set up accounts, apply updates and break things on purpose

•       Written notes explaining how you investigated a sample log file or a simulated alert

•       A short risk assessment for an imaginary small business, with a plain-English summary

•       A write-up of a beginner capture-the-flag exercise, explaining your mistakes as well as your answers

One rule matters here. Only practise on systems you own or have clear permission to test. Unauthorised access to a computer is an offence under the Computer Misuse Act 1990, whatever your intentions. Use purpose-built labs and your own equipment.

Which jobs should you apply for first?

Aiming only at roles with “security” in the title can slow you down. Look at the whole ladder.

This table is a guide to job-search categories, not a list of current vacancies. Also, “junior” and “entry-level” on an advert do not always mean the employer will accept someone with no experience at all. Read the requirements, and apply if you meet most of them.

Governance and risk work deserves a closer look. In the government’s survey of cyber firms, governance and risk management was the most common specialism (45% of firms), followed by security management and audit and assurance (37% each). Auditing, governance, ISO 27001 and risk management each appeared in roughly a fifth of postings. If you write clearly and like organising evidence more than staring at logs, this side of the field may suit you.

Location matters too. Of the 2025 postings that listed a region, 31% were in Greater London and 13% in the South East, followed by the North West and Scotland (9% each). Postings with no location, which suggests remote work, fell to 16% from a peak of 28% in 2022. Fully remote entry-level jobs are therefore rare.

Degree, diploma, certification or apprenticeship?

No option wins every time. Each solves a different problem.

If you want a fuller comparison of diplomas and certifications, we will cover it in a separate guide.

Skills worth building

The 2025 postings give a rough picture of what employers name most often. Beyond general cyber security knowledge (which appeared in 66% of postings), the common requests were:

• •       Auditing (22%)
• •       Governance (20%)
• •       ISO 27001, the information security standard (20%)
• •       Risk management (19%)
• •       Incident response (18%)
• •       Microsoft Azure (16%)
• •       Automation (15%)
• •       Artificial intelligence (9%, up from 4% the year before)

You will not learn all of these before your first job, and employers do not expect it. Pick the area closest to the jobs you are chasing. If you are heading for support or monitoring roles, concentrate on networking, Windows and Linux basics, and reading logs. If you lean towards governance, learn how a risk register works and what ISO 27001 is for.

Soft skills count too. The study notes that people who combine technical ability with communication and people skills are in short supply. Writing a clear incident report or explaining a risk to a manager who is not technical is a real part of the job.

How to get experience when nobody will hire you yet

This is the loop that frustrates beginners most: no experience, so no job, so no experience. A few ways to break it:

•       Use your current job. If you work in an office, a school, a shop or a care setting, you already see security in action. Offer to help with password policies, phishing awareness or access reviews. A line on your CV about work you did at your employer is worth more than a tutorial certificate.

•       Volunteer for IT tasks. Charities and community groups often need help with devices and accounts.

•       Document what you learn. A simple notebook or short blog posts show how you think.

•       Meet people. With firms leaning on referrals, a polite message to someone in a role you want, or a visit to a local meet-up, can do more than another application.

•       Prepare for the technical interview. Employers say candidates fail practical tests. Practise explaining how you would approach a problem, and say honestly where your knowledge stops.

How long will it take, and what will you earn?

Nobody can give you an honest fixed timeline. It depends on whether you already work in IT, how many hours a week you can study, where you live, who you know and when apprenticeship windows open. An apprenticeship alone takes about two years. Anyone who promises a cyber security job in six months is guessing.

Pay deserves a sober look. In 2025 the median advertised salary for core cyber roles was about £58,000 (the mean was about £60,800). That sounds generous, but 76% of postings gave no salary at all, and the roles that did tend to be the experienced ones. For a more realistic comparison, cyber security graduates who entered cyber professional roles had a median salary in the £30,001 to £35,000 band around 15 months after graduating. Expect an IT support or service desk start to sit below that. Check live adverts in your area before you plan around a figure.

Where you start decides your plan

Path A: no degree and no IT experience. Begin with IT fundamentals. Look at an entry-level qualification or a short course, then build a small lab. Apply for IT support roles and wider digital apprenticeships. Move towards security duties once you have a year or so of working experience.

Path B: no degree, but already working in IT. You are closer than you think. Pick a security area, study it with a structured course or a relevant certification, and ask your manager for security tasks at work. Then apply for security roles with real examples from your job.

Path C: changing career from a non-technical field. List the skills you already have. Writing, investigating, record keeping and managing risk all transfer. Learn IT fundamentals, then look at governance, risk and compliance as well as technical roles. Show how your past experience fits.

These are suggestions based on the evidence, not promises of a job.

Mistakes to avoid

•       Treating a certificate as a ticket to an interview. It is one piece of evidence. Pair it with something you have done.

•       Applying only to jobs with “security” in the title. You may miss the IT and risk roles that lead there.

•       Claiming skills you cannot show. Employers say overclaiming is common, and technical tests expose it fast.

•       Describing a diploma as a degree. It damages trust. Be accurate about the level.

•       Ignoring your local market. If most roles are in a city you cannot reach, widen your search or look for hybrid IT roles nearby first.

•       Believing promises of quick results. The market for beginners is tight, and that is not your fault.

Your next step

You do not need a degree to start, but you do need a plan. Work out which of the three paths matches you, pick one or two actions for the next month, and keep a record of what you learn.

If you are at the very beginning, read our guide to how to get into cyber security in the UK. If you would like to talk through a structured qualification, browse our cyber security courses or contact our admissions team. An advisor can explain levels, entry requirements and fees, and will tell you honestly what a diploma can and cannot do for your goals. For more on how levels compare, see our guide to diploma levels in the UK.

Sources

•       UK Government (DSIT): Cyber security skills in the UK labour market 2026, published 29 September 2026

•       UK Government (DSIT): Cyber security skills in the UK labour market 2025

•       Skills England: Cyber Security Technologist, Level 4 apprenticeship standard (ST1021)

•       Prospects: Cyber security analyst job profile

•       National Careers Service: Cyber intelligence officer job profile

•       ISC2: Certified in Cybersecurity

•       legislation.gov.uk: Computer Misuse Act 1990

•       Ofqual: Find a regulated qualification