How I Got Into Cybersecurity Without the Traditional Path

Every “how to become a cyber security analyst” article on the internet reads the same way: a checklist of certifications, a list of job titles, maybe a salary band. None of it tells you what the first two years actually feel like, or why some people who tick every box on that checklist still can’t get hired.

So instead of another checklist, here’s the honest version: how I actually got into this industry, without a computer science degree, coming from a background — sports coaching — that has nothing to do with firewalls.

Coaching taught me the part nobody puts in the job spec

Coaching is about reading a room, staying calm when things go wrong in real time, and explaining something technical to someone who has zero context for it. Turns out that’s most of security. Incidents don’t wait for you to feel ready, and the person you’re briefing rarely has the same mental model of the problem you do. Those two skills — staying level-headed under pressure, and translating “here’s what’s actually happening” for someone who isn’t technical — matter more day to day than most people starting out realise.

I didn’t plan the jump into cyber as a career pivot with a five-year roadmap. It came from being curious about the technical side of a problem, then following that curiosity properly instead of staying at “interested hobbyist” level.

Nobody hires “cybersecurity” — they hire a specific gap

This is the bit the generic career guides skip. Nobody advertises for a generalist “cybersecurity person.” They advertise because a specific gap opened up: someone left, a compliance deadline is looming, an audit found something. Your job as someone breaking in is to make it obvious you can close a specific gap, not to demonstrate you’ve read about every domain in the field.

That means the honest advice isn’t “get Security+ then apply everywhere.” It’s: figure out what’s actually being hired for around you right now, and go deep enough in one adjacent area that you’re a plausible answer to a real gap — not the most qualified person on paper, just believable enough to get the first real shot.

What actually moved the needle for me

• Being useful before being certified. Solving real, small, unglamorous problems — fixing access issues, tidying up logging, asking annoying questions about who has admin rights to what — builds credibility faster than a certificate on its own.
• Picking one thing and going deep, not spreading thin across every domain. Depth in identity and access, for instance, is more hireable than shallow familiarity with everything.
• Treating certifications as a filter to pass, not a substitute for judgement. They get you past the CV screen. They don’t teach you what to do at 2am when something’s actually on fire.

What a cyber security analyst actually does, day to day

Since this is the role most people picture when they say “I want to get into cybersecurity,” it’s worth being specific about what the job actually involves — because the reality is less dramatic than the job title suggests, and that’s not a bad thing.

A security analyst spends most of their time watching for anomalies: reviewing alerts flagged by monitoring tools, working out which ones are genuine threats and which are noise, and escalating the real ones. A meaningful chunk of the role is also compliance-adjacent — gathering evidence that controls are actually working, not just documented on paper, and helping the organisation stay inside whatever regulatory or contractual framework it operates under. The “exciting incident response” part of the job is real, but it’s a smaller fraction of the week than people expect; most days are closer to careful, methodical triage than a movie hacking scene.

That distinction matters if you’re deciding whether this path is actually for you. If what draws you in is the idea of constant high-stakes firefighting, the day-to-day of an analyst role might disappoint you. If what draws you in is the satisfaction of catching something small before it becomes something large, it’s a genuinely good fit.

The honest answer on salary and qualifications

People rarely ask this directly, so I’ll answer it directly: entry-level analyst salaries vary enormously by region and sector, and anyone promising a specific number without knowing your market is guessing. What I’d say instead — qualifications matter less than demonstrable, specific skill early on, and salary tends to track how narrow and in-demand your specialism becomes, not how many certifications are on your CV. A generalist with five surface-level certifications typically earns less than a specialist with two certifications and a genuinely deep, demonstrable skill in one area employers actually need.

On qualifications specifically: you don’t need a computer science degree, and you don’t need every certification going. You need enough of a foundation to be credible in an interview, plus evidence — even self-directed, home-lab evidence — that you can actually do the work, not just describe it.

What I’d tell someone starting today

Stop trying to become “a cybersecurity professional” in the abstract. Pick a lane — identity, cloud security, detection and response, governance — and get good enough at it that you can hold a real conversation about it with someone who already works in it. Get in front of real systems, even messy home-lab ones, rather than only reading about them. And don’t wait until you feel 100% ready to apply; nobody feels ready, they just get started and catch up on the job.

The path in doesn’t have to look like anyone else’s. Mine didn’t start anywhere near a keyboard.

Final Thoughts

If you’re trying to break into cyber without the traditional background, you’re not the exception you think you are — plenty of us got here sideways. Got questions? ping me on LinkedIn.