Yes, many people enter security without a degree. A degree can help with some employers and with certification paths, but hiring managers usually look for demonstrated skill. Build proof through projects, a first adjacent job, and a credential only if a role you want asks for it.
What a degree does and does not do
ISC2's CISSP page is a useful example. It says a bachelor's or master's degree in computer science, IT or a related field can satisfy up to one year of the five year experience requirement, and that the degree is not required. An approved credential can also cover up to one year. So even a certification body treats the degree as an offset, not a gate.
Some employers, especially large or government linked ones, may list a degree in postings. Policies vary, so read each posting.
Paths in
- Adjacent role first. Help desk, system administration, QA, development and support often lead to security. You gain the context security people need.
- Internal move. Ask to join security reviews at your current job. Volunteer for access recertification or incident drills.
- Direct entry roles. Junior analyst or similar roles exist, but competition is high. Strong projects help.
- Apprenticeships and work based learning. The NIST NICE Framework page lists apprenticeships, competitions and work based learning among the uses of the framework, so such programs exist in the ecosystem.
What to build
- A small home lab where you break and fix things and write down what you learned.
- Contributions to open source security tooling, even documentation.
- Write ups of capture the flag challenges, explaining your reasoning.
- A repository showing a threat model of a small app.
Credentials: when they help
A credential can get a resume past a filter and shows you finished something hard. Pick one that matches the roles you want. If a credential requires experience you lack, check whether there is an entry status. ISC2, for instance, offers Associate status for people who pass the CISSP exam without the experience.
Show your thinking
Interviewers want to hear how you approach a problem. Practice explaining how you would investigate a suspicious login or review a pull request for security issues. Our post on interview preparation covers this in more detail.
Be realistic
Entry level security jobs are not abundant, and a path through another technical role is often faster. Treat it as a two step move if needed.
Quick check
Do I need a certification?
Not always. Look at five postings for the role you want and see how many ask for one.
Does a degree count toward CISSP?
Per ISC2, a relevant degree can satisfy up to one year of the required experience. It is not required.
Sources
Last reviewed: 19 October 2026.
