How Do I Get My First Cybersecurity Job When Entry-Level Roles Want Three Years' Experience?
Keep up with IT Club
Add IT Club as a preferred source in Google Search.
A career changer with three years in financial risk management, Security+, eJPT, a purple-team lab and authorised production assessment experience asks how to get a first cybersecurity role when junior vacancies ask for years of prior security work. The practical answer: package existing risk experience as security evidence, build a small portfolio, apply beyond SOC L1 and prepare to demonstrate reasoning rather than collect certificates indefinitely.
This is a reader-submitted question. Matheus has given permission for IT Club to use his first name. Surname, employer details and other identifying information have not been included.
Matheus asks
I am moving into cybersecurity after around three years working in risk management in financial markets. I have Security+, eJPT, a purple-team home lab and experience conducting an authorised penetration test in a production Open Finance environment.
Many jobs described as entry level or SOC L1 still ask for around three years of previous security experience. What is the market actually looking for, and how can I close the gap enough to get my first cybersecurity role?
Reader name used with permission.
The short answer
You probably do not have an experience problem. You have a translation problem.
You do not need to manufacture three years of SOC experience. You need to show hiring managers how the three years you already have — in a regulated financial-risk environment — transfer to security work.
Risk management is not a substitute for technical security practice. But security is also a form of business risk management. Understanding controls, impact, evidence, escalation, uncertainty and stakeholder communication is valuable security experience when you make the connection explicit.
Your current evidence already has a useful shape: professional risk experience, Security+, eJPT, a purple-team lab and authorised assessment work. The next step is to turn that into a clear hiring story.
The junior market is competitive. Some adverts are poorly calibrated, and some employers really do need people who can work independently from day one. Neither fact means every entry-level role is closed to you. It means your application needs to reduce the employer's uncertainty about what you can actually do.
Start by removing the phrase “no experience”
Do not describe yourself simply as an entry-level cybersecurity candidate with no experience. That sentence throws away the strongest part of your background before anyone has assessed it.
A more accurate positioning statement would be:
Risk-management professional transitioning into cybersecurity
Combining three years of regulated financial-sector experience with Security+, eJPT and hands-on offensive and defensive security work.
That does not claim that financial risk management is identical to working in a SOC. It tells the reader that you bring an existing professional discipline and have deliberately built technical security evidence alongside it.
The same principle should apply to your CV, LinkedIn headline, application answers and interview introduction. You are not asking an employer to ignore your previous career. You are showing why it is relevant.
What transfers from financial risk into cyber security?
Translate your previous responsibilities into outcomes that a security hiring manager recognises. The wording must be truthful, but it does not need to repeat the vocabulary of your old department.
| Existing experience | Security relevance | Evidence to show |
|---|---|---|
| Assessing financial or operational risk | Threat, vulnerability, likelihood, impact and risk treatment | A concise example showing how you reached and communicated a decision |
| Reviewing controls | Control design, operating effectiveness and assurance | What evidence you examined, what was missing and what changed |
| Working with regulated processes | Governance, accountability, auditability and documented exceptions | How you handled evidence, approvals, escalation and deadlines |
| Explaining risk to stakeholders | Security reporting and risk communication | A plain-English explanation of a technical or control issue |
| Investigating unusual activity or incidents | Triage, analysis, escalation and response support | What you noticed, how you tested the hypothesis and who needed to know |
This is the bridge an employer needs to see. A hiring manager should be able to imagine you handling a finding, asking for evidence, prioritising a control gap and explaining the consequence to a non-specialist.
Do not inflate risk work into penetration testing, incident response or SOC experience you did not have. Transferable experience is strongest when the boundary is clear.
Your certifications are probably enough for now
Security+ and eJPT already give you useful baseline signals: a broad security foundation and evidence that you have studied and practised offensive security. Another certificate may eventually make sense for a specific route, but collecting qualifications should not become a substitute for demonstrating work.
The question to ask before starting another course is not “What certificate can I add?” It is “What hiring uncertainty would this remove?” If the answer is unclear, use the time to document a project, practise an assessment or speak to the requirements of a different role family.
ISC2's 2025 Cybersecurity Hiring Trends research found that hiring managers continue to value certification evidence, but it also describes a broader assessment: practical skills, non-technical skills and the ability to grow all matter. A certificate may get a CV read. It cannot explain how you reason under pressure.
Turn the purple-team lab into evidence, not a list of tools
A purple-team home lab is valuable when a reader can understand what you built and what you learned. “Built a lab using several tools” is not enough. Create two or three short case studies, each readable in a few minutes.
- 1What you built: the systems, identities, network boundaries and assumptions.
- 2What attack or scenario you tested: the objective, starting point and authorised scope.
- 3What telemetry or detections you used: logs, alerts, queries, endpoint signals or network evidence.
- 4What worked: the control or detection that produced a useful result.
- 5What failed: the blind spot, noisy alert, missing log or incorrect assumption.
- 6What you changed or learned: the improvement, trade-off and next test.
That structure demonstrates much more than tool familiarity. It shows that you can form a hypothesis, test it, interpret evidence, identify a limitation and communicate a result. Those are the behaviours an entry-level assessment is likely to probe.
A useful case-study title
Testing whether a simulated credential-compromise path was visible in endpoint and identity telemetry
Then explain the environment, test, evidence, result and change. Avoid turning the page into a screenshot gallery or a catalogue of commands.
Describe the authorised production assessment carefully
The authorised penetration test in a production Open Finance environment is significant evidence, but it needs to be documented without disclosing confidential information. Do not name the organisation, customer, platform, endpoint or finding combination that could identify it.
Instead, describe:
- The authorised scope and your role within it
- The broad methodology or assessment phases
- The categories of findings, without sensitive technical detail
- How risk and remediation were communicated
- What the production context changed compared with a lab
- What you learned about restraint, evidence quality and safe testing
A hiring manager does not need a dramatic exploit narrative. They need confidence that you understood authorisation, stayed within scope, handled evidence responsibly and could communicate a finding without creating a second risk.
Do not restrict the search to SOC L1
SOC analyst is a legitimate target, but it is not the only doorway into cyber security. Your existing background may make you more credible for several routes:
| Route | Why your background may fit | Evidence to emphasise |
|---|---|---|
| Cyber risk | Direct continuity with risk assessment and business impact | Risk decisions, prioritisation, reporting and stakeholder communication |
| GRC | Controls, evidence, governance and regulated working are central | Control testing, policies, exceptions, audit evidence and ownership |
| Security assurance | Assurance asks whether security claims are supported by evidence | Questioning assumptions, checking controls and writing clear findings |
| Vulnerability management | It combines technical findings with prioritisation and remediation risk | Severity versus business impact, remediation tracking and validation |
| Security operations | Your lab and technical study can support alert analysis and triage | Telemetry, investigation steps, escalation and concise incident notes |
| Junior penetration-testing or security-testing support | eJPT, authorised assessment work and safe testing discipline are relevant | Scope, methodology, evidence handling, findings and remediation advice |
Entering through cyber risk, GRC or assurance is not a lesser route. It may give you the most direct chance to use your strongest professional experience while you continue building technical depth. A later move into operations or testing is not invalidated because your first security job had a different title.
What does “three years' experience” really mean?
Job descriptions often combine a junior title with an idealised wish list. One employer may write three years because its internal template has not been updated. Another may want someone who has seen enough real incidents to work without constant supervision. A third may genuinely need a more experienced hire while still calling the role entry level.
Read the responsibilities, not only the number. If the role involves documenting procedures, monitoring alerts, producing reports, following an escalation path and learning under supervision, it may be worth applying even when the advert says three years.
ISC2's 2025 research is useful here because it explicitly includes recent career changers in its definition of early-career candidates. It also says that more than a third of hiring managers wanted advanced certifications or skills that were unlikely or unfeasible for entry- and junior-level hires. That is evidence that unrealistic expectations exist — not proof that every advert is realistic or that every candidate should ignore the requirements.
A practical application rule is: apply when you can show the core work, explain your gaps honestly and identify the support or supervision you would need. Do not apply blindly to every role. Do not self-reject solely because a templated requirement says three.
What hiring managers are likely to test
ISC2's research found that 84% of surveyed hiring managers use skills-based assessments or tests for entry- and junior-level cybersecurity applicants. That means your preparation should include doing the work, not just describing your interest in it.
The same research highlights teamwork and the ability to work independently among the leading non-technical priorities. Problem-solving, analytical thinking and critical thinking also rank strongly. For a UK candidate, this is particularly relevant: your ability to explain a decision, ask a sensible question and collaborate across teams may be as visible in an assessment as your technical knowledge.
Practise these five exercises
- 1Analyse an alert: state what you know, what you do not know, what evidence you would collect and what would make you escalate.
- 2Explain an investigation: give a sequence of checks rather than jumping straight to a tool or a conclusion.
- 3Prioritise vulnerabilities: compare exploitability, exposure, business impact, compensating controls and the cost of remediation.
- 4Communicate a security risk: explain the consequence to a non-technical stakeholder and recommend a proportionate next step.
- 5Write up findings: make the scope, evidence, impact, confidence and remediation clear enough for someone else to act.
Practise saying “I do not know yet, but I would check…” without sounding evasive. Good security work is not instant certainty. It is disciplined movement from an incomplete signal to a defensible decision.
A better CV order for this career change
For this particular story, the CV should not open with a long list of courses followed by a buried career history. Try this order instead:
- 1Professional risk experience: show the regulated environment, decisions, controls, evidence and stakeholder work.
- 2Security evidence and projects: give two or three purple-team case studies with links.
- 3Authorised assessment experience: describe scope, role, finding categories and lessons without confidential detail.
- 4Certifications: list Security+ and eJPT with dates and, where useful, the practical areas they support.
Use the job advert's language where it accurately describes your evidence. If it asks for alert triage, connect that to a case study. If it asks for risk reporting, connect it to your professional work. If it asks for teamwork, give an example of coordinating under a deadline rather than writing “good communicator” in a skills list.
What not to do
- Do not call yourself inexperienced when you have three years of professional risk work.
- Do not collect certificates indefinitely because each application feels like a rejection.
- Do not publish confidential production details to make an assessment sound more impressive.
- Do not present a home lab as equivalent to operating a live enterprise security environment.
- Do not apply only to SOC L1 roles if cyber risk, GRC or assurance gives you a better evidence match.
- Do not rely on tool names or screenshots when you could explain the decision and the evidence.
- Do not assume a universal cybersecurity skills shortage means every junior candidate will be hired quickly.
A realistic 30-day improvement plan
A focused month is more useful than an open-ended promise to become more employable. For example:
| Week | Output |
|---|---|
| 1 | Rewrite your positioning statement and CV around risk experience, security evidence and the roles you are targeting. |
| 2 | Finish two purple-team case studies. Each should show the scenario, telemetry, result, limitation and change. |
| 3 | Write a confidentiality-safe summary of the authorised production assessment and prepare a two-minute explanation. |
| 4 | Complete practical alert, vulnerability-prioritisation and risk-communication exercises; apply across several relevant role families. |
Measure progress by the quality of evidence you can show and explain, not by the number of applications sent or certificates started.
Sources and what they actually show
The figures in this article come from ISC2's 2025 research on hiring entry- and junior-level cybersecurity professionals. It surveyed 929 cybersecurity hiring managers across Canada, Germany, India, Japan, the U.K. and the U.S. in December 2024. This is hiring-manager research, not a guarantee of an individual outcome, and it should not be read as proof of a simple universal skills shortage.
Read ISC2's 2025 Cybersecurity Hiring Trends study →
Read ISC2's skills deep dive for early-career candidates →
Read ISC2's research on improving early-career hiring practices →
Explore NCSC careers and the range of work in UK cyber security →
The IT Club conclusion
You probably do not need three more years.
You need to package the last three years differently.
The strongest version of your message is: “I already understand business risk. I've deliberately built the technical security skills to complement it. Here's the evidence.”
Related IT Club reading
You Can't Fix Every Cybersecurity Risk at Once. So What Comes First? →
Does Cyber Security Training Actually Work? →
What Should Your IT Provider Actually Monitor? →
Have a question for Ask IT Club?
Send us a practical question about technology, cyber security or AI and we may publish a general answer for other readers. IT Club gives independent, practical guidance; it is not recruitment, legal or employment advice.
Plain-English Takeaway
You probably do not need three more years. You need to package the last three years differently: show how your risk-management experience transfers to security, make your hands-on work easy to assess, apply across several entry routes and prepare to explain your reasoning in practical exercises.
Frequently asked questions
Does financial risk-management experience count when applying for cybersecurity jobs?
Yes. It is not the same as three years in a SOC, but it can demonstrate experience with controls, risk, impact, evidence, escalation and communicating decisions to stakeholders. The CV must translate those skills into security language without overstating the role.
Do I need another cybersecurity certification before applying for my first role?
Not necessarily. Security+ and eJPT already provide useful baseline evidence. For many candidates, a few concise portfolio case studies and better explanations of existing professional experience will do more than collecting another certificate without new practical evidence.
Should I apply for a cybersecurity job that asks for three years' experience?
Apply when the actual responsibilities look junior and you can demonstrate the core work. Job descriptions often describe an ideal candidate rather than an absolute threshold. Treat the advert as evidence about the employer's expectations, not an automatic rejection rule.
Is GRC or cyber risk a lesser route into cybersecurity than a SOC role?
No. Cyber risk, GRC, assurance, vulnerability management, security operations and junior penetration-testing support are different entry routes into the same profession. A route that uses your existing strengths can be a more credible first step than forcing yourself into a role that ignores them.
Related Articles
Does Sage 200 Still Work with Microsoft 365?
Yes — Sage 200 can still work with Microsoft 365, but the answer depends on your Sage version, the feature, licensing, Office architecture, onboarding and client environment.
Read articleDo I Really Need to Spend £1,000+ on a Business Laptop?
Need a powerful business laptop without spending £1,000+? See why a refurbished workstation with 32 GB RAM can offer better value for many SMEs.
Read articleA Customer Has Asked for All Their Data — What Do You Do?
A customer asks what personal data you hold, says they never agreed to marketing and wants everything deleted. This practical UK guide explains what a small business should do first — without treating one email as one simple request.
Read article