There are 3.5 million unfilled cybersecurity jobs worldwide. That number has barely moved in three years — not because companies stopped hiring, but because the pipeline of qualified people isn't keeping up with the threat surface expanding around them. For anyone considering this field, that's not a marketing pitch. It's a structural reality that shows up in hiring timelines, competing offers, and salaries that have held up even when the rest of tech softened.
This guide covers what cybersecurity actually involves (beyond the hacker stereotype), which roles pay best, what certifications move hiring decisions, and which courses give you the fastest path to employment.
What Cybersecurity Actually Covers
Most people picture cybersecurity as one job: someone finding vulnerabilities before attackers do. The reality is a cluster of about a dozen distinct specializations, some deeply technical, some analytical, some closer to law and policy than to code.
Blue Team, Red Team, and GRC
The most useful way to understand the field is through three broad categories:
- Red team (offensive): Penetration testers, ethical hackers, vulnerability researchers. You simulate attacks to find weaknesses before real attackers do. Requires deep technical knowledge of how systems fail.
- Blue team (defensive): Security operations centre (SOC) analysts, incident responders, threat hunters. You monitor for and contain active threats. More process-heavy, and usually the entry point for people new to the field.
- GRC (Governance, Risk, Compliance): Security policy, auditing, regulatory compliance — GDPR, ISO 27001, NIS2 Directive. Less hands-on-keyboard, more legal and process work. Consistently in demand from banks, healthcare providers, and the public sector.
Beyond these three, cloud security engineers (securing AWS, Azure, and GCP infrastructure), application security specialists (finding bugs in code before deployment), security architects, and CISOs all represent distinct career trajectories with different entry requirements and pay ceilings.
The Role Employers Are Hiring Most Right Now
SOC analyst is the highest-volume entry-level cybersecurity role. UK salaries start around £28,000–£35,000. The work involves shift patterns, significant alert triage, and SIEM tools. It can feel repetitive — but it's where most people build the foundational skills that unlock better-paid roles within 18–24 months. Most people who try to skip this step and go straight to penetration testing find the applications don't get far without the operational foundation.
Cybersecurity Salaries: What to Realistically Expect
UK salary data for cybersecurity roles (2025–2026 market):
- SOC Analyst (Tier 1): £28,000–£38,000
- SOC Analyst (Tier 2/3): £40,000–£60,000
- Penetration Tester: £45,000–£80,000 (senior)
- Cloud Security Engineer: £65,000–£95,000
- Security Architect: £80,000–£110,000+
- CISO (enterprise): £120,000–£200,000+
London typically adds 15–25% to these figures, particularly in financial services. Senior penetration testers at consultancies frequently bill £700–£1,200 per day contracting. Security architects at large banks often clear six figures within five to seven years of starting in the field.
Compared to software engineering, the cybersecurity salary ceiling is similarly high, but the floor is lower. The progression from SOC analyst to mid-level security engineer is slower than developer career ladders — typically 3–5 years rather than 2–3. The trade-off is that demand has proven significantly more recession-resistant.
Certifications That Actually Move Hiring Decisions
The certification landscape in cybersecurity is overcrowded with credentials that sound authoritative but carry little weight with recruiters. Here is what actually matters by career stage.
Entry Level
- CompTIA Security+: The most recognized entry-level certification globally. UK government and most enterprise employers list it as baseline for security roles. Achievable in 3–6 months of focused study from a standing start.
- ISC2 Certified in Cybersecurity (CC): Launched in 2022, free to sit. Lighter technical depth than Security+ but widely accepted for GRC-adjacent roles and recognized by UK employers. Good option if you're coming from a non-technical background.
- CompTIA CySA+: Solid follow-on to Security+ for blue team and SOC-focused roles. More hands-on with threat detection and behavioural analytics.
Mid to Senior Level
- OSCP (Offensive Security Certified Professional): The gold standard for penetration testers. Entirely practical — a 24-hour exam where you compromise real machines. Demanding, expensive, and the one cert that consistently moves salaries and recruiter interest for offensive roles.
- CREST CRT / CCT App: Required by most UK government-approved penetration testing firms. If you're targeting government-sector pen testing work, CREST is more relevant than OSCP domestically.
- CISSP: Management-level cert covering eight security domains. Required for CISO and security architect roles at most large enterprises. Needs five years of verified experience to apply for — not an entry-level path.
Avoid stacking vendor-specific certs (Microsoft SC-900, AWS Security Specialty) as primary credentials. They're contextually useful but rarely drive hiring decisions on their own. The recruiters who know the field can spot a CV full of vendor certs with no underlying foundational credential.
Top Cybersecurity Courses Worth Your Time
These are ranked by verified learner rating and filtered for courses that teach practical, employer-relevant skills rather than theory that doesn't survive contact with real environments.
Put It to Work: Prepare for Cybersecurity Jobs
The capstone module of Google's Cybersecurity Certificate on Coursera. Focuses specifically on job preparation — building a portfolio, understanding SOC workflows, and practising the interview and documentation skills that distinguish candidates at the entry level. Rating 9.7.
A Practical Guide to Cybersecurity Operations Foundations
Covers real SOC operations: SIEM usage, log analysis, and threat intelligence workflows. One of the better options for people who want to understand what the day-to-day defensive work actually looks like before committing to a certification path. Rating 9.6.
Building and Configuring Your Cybersecurity Attack Lab
For anyone heading toward penetration testing or red team work, a documented home lab is close to mandatory for job applications. This course shows you how to set one up properly — isolated VMs, home network segmentation, safe malware analysis environments. Rating 9.6.
The Official ISC2 CC Certified in Cybersecurity Exam Prep
The most direct study path to ISC2's CC certification, which remains free to sit. Good entry point if you're transitioning from a non-technical background and want a recognized credential without the full Security+ study commitment. Rating 9.5.
Unspoken Rules of Cybersecurity: A CISO's 20-Year Playbook
Not exam prep — this is organizational and career knowledge that nobody teaches formally. Understanding how security decisions get made inside companies, how to navigate budget conversations, and what actually matters to leadership. Highly useful for anyone targeting senior roles or consulting. Rating 9.5.
CompTIA SecAI+ Fundamentals: AI Cybersecurity Basics
AI is rapidly changing both the attack surface (AI-generated phishing, adversarial ML) and the defensive toolset. This course covers both sides at a practical level — useful context whether you're working in red team or blue team roles. Rating 9.6.
Cybersecurity in London: What the Local Market Looks Like
London is the largest cybersecurity employment market in Europe. Demand is concentrated in a few distinct clusters:
- Financial services: HSBC, Barclays, Lloyd's, NatWest, and the insurance firms at Lloyd's of London all run large internal security functions. FCA and PRA compliance requirements make GRC and risk roles particularly plentiful. These employers tend to favour CISSP and CISM at senior levels.
- Government and defence contractors: BAE Systems Applied Intelligence, GCHQ, and the MoD's Digital Service all hire significantly. SC clearance is required for most roles — which means UK nationals without criminal history have a structural advantage that's hard for non-citizens to replicate quickly.
- Consultancies: KPMG, Deloitte, PwC, Accenture, NCC Group, and Pen Test Partners all operate large cybersecurity practices from London. For early-career people, consultancy roles offer the fastest path to varied experience across industries and client environments.
- Fintechs and scale-ups: Revolut, Monzo, Wise, and the broader London fintech cluster hire aggressively. More autonomy, faster pace, often lower base salaries with equity components. Expect to be the only security person or one of two — broad ownership, less mentorship.
Mid-level cybersecurity roles in London — roughly 3–5 years experience, relevant certifications, some cloud exposure — routinely generate multiple competing offers. The supply constraint is most acute here. Entry-level (SOC analyst) roles are competitive because candidates outnumber open positions slightly; senior roles are harder to fill because there simply aren't enough people at that level.
Frequently Asked Questions About Cybersecurity
Do I need a computer science degree to work in cybersecurity?
No. A significant proportion of working cybersecurity professionals came from IT support, networking, software development, or unrelated backgrounds entirely. What matters more than a degree is demonstrable skills: certifications, a documented home lab, and evidence of practical work (CTF results, bug bounty findings, GitHub repos). Government and defence roles are more degree-preferential, but they're not representative of the broader market.
How long does it take to get a first cybersecurity job from scratch?
With focused effort, 6–18 months from zero to a first SOC analyst role is realistic. The typical path: Security+ completed in 3–6 months, a documented home lab project, and active applications with tailored CVs. People who take three or more years usually either distributed their study across too many certifications or applied without building any portfolio of practical work. Aiming for penetration testing as a first role extends the timeline substantially — that bar is higher than most candidates expect.
Is cybersecurity a stable long-term career?
More stable than most tech roles. The threat landscape expands with every new technology layer — cloud, IoT, AI systems — and the regulatory environment in the UK and EU keeps tightening, which maintains compliance-related demand even when discretionary tech budgets get cut. Cybersecurity hiring held up better than software engineering during the 2023–2024 tech layoff cycles.
What is the difference between cybersecurity and information security?
In practice, the terms are used interchangeably on job boards. Technically, information security is broader (includes physical security, personnel policies, paper records) while cybersecurity refers specifically to digital systems. Don't spend time on this distinction when reading job descriptions — read the actual responsibilities instead.
Do I need to know how to code for a cybersecurity career?
It depends on the role. SOC analysts and GRC professionals operate effectively with minimal coding. Penetration testers need scripting ability — Python and Bash are the most common. Security engineers and application security specialists need strong software development skills. If you're unsure which direction you're heading, learning basic Python scripting early gives you flexibility without locking you in.
How important is a home lab for cybersecurity job applications?
For technical roles, it's close to essential. Employers hiring penetration testers and security engineers see dozens of candidates with the same certifications. A documented lab — write-ups, GitHub repos, CTF walkthroughs — differentiates candidates who can actually do the work from those who passed an exam. For GRC roles, it's less relevant; a portfolio of policy documents and audit experience matters more.
Bottom Line
Cybersecurity is one of the few fields where the skills shortage is structural, not cyclical. The path from zero to employed is more clearly signposted than most tech careers — certifications with industry recognition, practical portfolio work, and a realistic entry-level target (SOC analyst, not penetration tester) put a first role within reach for most people who approach it systematically.
The most efficient route from scratch: Security+ or ISC2 CC as your first credential, a documented home lab, and two or three CTF competitions you can reference in interviews. Apply for SOC analyst roles first. Two years of SOC experience combined with cloud exposure and a CySA+ positions you for the mid-level security engineer roles where the meaningful salary jumps happen.
If you're already in tech — sysadmin, developer, network engineer — your existing skills transfer more directly than you might assume. A network engineer pivoting to cloud security can often make the move within 12 months with targeted certification work. The field rewards depth of relevant experience more than breadth of credentials.