Skip to content
CertGPS
Career path

From No Experience to Security Analyst: What the Job Asks For and a Staged Route

What a security analyst does, what BLS says employers ask for, and a four-stage route from no IT background to a first analyst job, with the certifications for each.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

From No Experience to Security Analyst: What the Job Asks For and a Staged Route

Nobody publishes evidence that a complete beginner can reach a security analyst job in three months, so this route makes no such promise. The Bureau of Labor Statistics describes the usual way in as a bachelor's degree plus related work experience, often in an IT department. You can control the order: learn how computers and networks behave, prove it with an exam, get hired into a feeder job, then move into analysis.

What a security analyst actually does

NIST's NICE Workforce Framework describes relevant analyst work under Defensive Cybersecurity (work role PD-WRL-001) and describes it as analyzing data collected from defense tools to reduce risk. Its task list is concrete: identify anomalous network activity, detect attacks and intrusions, isolate malware, write signatures for network tools, and resolve security incidents. The Bureau of Labor Statistics (BLS) adds checking systems for vulnerabilities and maintaining firewalls and encryption software.

In a security operations center (SOC), that turns into a queue. Alerts arrive from an endpoint agent, a firewall or a SIEM (security information and event management system). The analyst decides which ones are real, gathers evidence from logs, escalates or closes each one, and writes down why. Much of the shift is reading logs and writing short, accurate notes. BLS also says most analysts work full time, and some are on call outside business hours.

What employers ask for, according to published data

The BLS Occupational Outlook Handbook lists a bachelor's degree as the typical entry-level education and "less than 5 years" of work experience in a related occupation. It says many analysts come from IT departments, often as network and computer systems administrators, and that many employers prefer candidates with a security certification. BLS counted 192,900 information security analyst jobs in 2025, put the May 2025 median pay at $129,180, and projects 21% employment growth from 2025 to 2035. That median covers analysts at every career stage, so don't read it as a starting offer.

CyberSeek, the job-posting tool CompTIA runs with Lightcast, tells the same story from the employer side. Its career pathway lists cybersecurity specialist, cyber crime analyst, incident and intrusion analyst and IT auditor as entry-level security roles, and names IT support, networking and systems engineering among the feeder roles that most often lead into them. Security, in other words, is usually a person's second job in IT.

The route in four stages

StageWhat to learnCertificationReady to move on when
1. Computing foundationsIP addressing, ports, DNS, Linux and Windows command lines, where logs liveNetwork+ or GFACTYou can trace a web request hop by hop and find a failed login in a Linux authentication log
2. Security basicsControls, identity, common attacks, incident response stepsSecurity+, or CC to test your interestYou can do the Security+ scenario objectives (firewall changes, a log investigation) without notes
3. Feeder job plus defensive labsTicket handling and account administration at work; alert triage and forensics in a labBTL1 or CDSAYou've written up full investigations from a lab, start to finish
4. First analyst roleSIEM queries, escalation rules, incident reportsSC-200 in a Microsoft shop; CySA+ laterYour employer has you on the queue

Stage 1 is easy to rush, and gaps there show up in every later exam. Network+ ($399) tests whether you can address, route and troubleshoot a network; CompTIA recommends 9 to 12 months of network support work before sitting it, which tells you how much practice it assumes. GFACT ($399) is GIAC's foundations exam, covering hardware, operating systems, networking and enough programming to read code, and GIAC names career changers among its audience.

Stage 2 is where Security+ belongs. It costs $439, has no prerequisites, and CompTIA maps it to US Defense Department 8140 work roles such as cyber defense analyst. CompTIA writes it for people with about two years of hands-on security administration, so passing it with no job behind you is possible but means extra lab time. Plan around the version change: SY0-801 is expected to launch on or around November 17, 2026, and SY0-701 retires in English on June 11, 2027. If you aren't sure the field suits you, ISC2 Certified in Cybersecurity is $199 plus a $50 yearly fee and needs no experience, though it tests concepts more than tasks.

Stage 3 runs two tracks at once. Take a help desk or IT support job if you can get one; BLS says support roles can be open to people with a high school diploma plus IT certifications, and they give you the IT experience that BLS and CyberSeek both point to. In the evenings, practise the analyst work itself. BTL1 gives you up to 24 hours in a compromised lab network and 20 task-based questions; Centri, which runs it, recommends it for people with up to two years of experience and maps it to the NICE cyber defense analyst role. HTB CDSA is harder: a seven-day investigation across several networks, graded on a written incident report, after you finish Hack The Box Academy's 15-module SOC Analyst path.

Stage 4 is the first analyst job, and the certification choice follows the employer's tools. If the SOC runs Defender XDR and Sentinel, SC-200 ($165) tests exactly that stack. Leave CySA+ for later, since CompTIA writes it for about four years as a level 2 SOC or vulnerability analyst.

Why three months doesn't hold up

The vendors' recommendations make that promise hard to justify for a complete beginner. CompTIA suggests most of a year of network work before Network+, two years before Security+ and four before CySA+. Those are recommendations rather than requirements, and people do pass sooner. But even a fast learner studying full time has to fit a networking foundation, a security exam, lab practice and job applications into the same weeks, and BLS describes an occupation that hires people with experience. In our view, a plan built on a short timeline stalls at the application stage, where postings ask for experience that no course supplies. Measure progress by the readiness signs in the table's last column, which you can test yourself.

If you can afford only one exam this year

Pick Security+ if you can give it the lab hours, because it goes deeper than CC and CompTIA maps it to the cyber defense analyst role. Pick CC if you're still deciding whether security is for you, and Network+ if the networking questions in Security+ practice tests keep beating you. Our first certification guide compares the options in more depth.

Then put the effort you'd have spent on a second certificate into getting hired at stage 3. Readers already working in IT can start at stage 2 or 3; the IT-to-security route covers that move, and the SOC analyst ladder picks up after the first analyst job. If you're studying alone, our self-taught guide is about turning that study into evidence an employer can check.

Sources