How to get into cybersecurity in India from college or an IT job

The data's answer to how to get into cybersecurity is blunt: most people enter through an IT job first. In ISC2's 2025 global Cybersecurity Workforce Study, 56% of practitioners named IT experience as their pathway in, against 10% through cybersecurity education and 6% through certifications. For a student or an IT professional in India, that means adding hands-on security evidence to technical work, then targeting SOC, security analyst or VAPT roles.

How do most people actually get into cybersecurity?

ISC2's 2025 study surveyed 16,029 practitioners and decision-makers worldwide in May and June 2025 and published the findings in December 2025. Its pathway question shows that formal study and certificates are supporting routes rather than the main door.

The table below lists each pathway with the share of practitioners who used it and, where ISC2 reported it, the share who would recommend it.

Two details matter for younger readers. Among respondents aged 21 to 29, 23% entered by completing a cybersecurity degree programme, so degrees count for more at the start of a career than the overall 10% suggests. Also, 67% of those who entered through certifications would recommend that route, against 61% for cybersecurity education. ISC2 does not report recommendation rates for the other routes, and a recommendation rate is not a hiring outcome.

Why are first cybersecurity jobs hard to land in 2026?

Openings exist, but they are skewed towards experience. ISC2's 2024 global workforce study (September 2024) found 31% of participants' security teams had no entry-level professionals. It also found 15% had no junior professionals with 1 to 3 years of experience, and 62% of hiring managers with open roles were focusing on mid to advanced hires. Teams that never hire juniors cannot be entered from the bottom.

DSCI's cyber security skilling survey for 2025-2026, published in May 2026, found 73% of enterprises and 68% of service providers see limited availability of skilled candidates. In the same survey, 84% of organisations take 1 to 6 months to fill a security role. The same survey found 63% of enterprises and 59% of providers see limited hands-on practical skills among candidates, and 45% of enterprises lack hands-on lab environments for their own staff.

The macro picture is easing, not booming. ISC2's India findings, published in September 2026 from 524 practitioners, show hiring freezes falling from 54% to 44% between 2024 and 2025, while more than one-third of respondents still experienced layoffs. Anyone entering now competes with people who have been laid off and carry experience.

What do hiring managers look for in a first security hire?

ISC2's 2025 global study asked hiring managers directly. The technical skills they prioritise are cloud security (29%), AI (27%), security engineering (24%), security analysis (23%) and risk assessment (23%). The non-technical skills are problem solving (29%), collaboration (24%), communications (22%), willingness to learn (20%) and strategic thinking (16%).

There is a mismatch worth knowing about. ISC2's India findings say professionals place more value on governance, risk and compliance, while hiring managers rank technical domains such as security analysis and security engineering more highly. A career changer who arrives with a compliance-heavy profile and no hands-on analysis work is applying with the skills practitioners admire rather than the ones managers screen for. The full ranking, including the India-specific list where AI (52%) and cloud security (43%) lead, is in cybersecurity skills in demand in India in 2026.

Which entry roles to target first, and who hires for them?

Three role families are common first targets, and each exists because a rule or a standing duty creates the work.

Security Operations Centre (SOC) analyst roles monitor alerts and logs in shifts. SEBI's Cybersecurity and Cyber Resilience Framework circular of 20 August 2024 requires continuous security monitoring through an own, group, third-party or market SOC. It applies across five categories of regulated entity, which covers stock brokers, depositories, mutual funds and research analysts.

CERT-In's directions of 28 April 2022 require listed incidents to be reported within 6 hours. They also require ICT logs to be kept for a rolling 180 days inside India, which makes log management a permanent function at providers, data centres and body corporates.

Vulnerability assessment and penetration testing (VAPT) roles are driven by the RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices, in force from 1 April 2024. It requires banks and larger NBFCs to run vulnerability assessments at least every six months and penetration tests at least every 12 months on critical systems. Government and critical-sector testing flows through the 237 information security auditing organisations empanelled by CERT-In, up from 231 in January 2026, a concrete employer list for a first VAPT role.

On pay, AmbitionBox's typical range for SOC analysts in India with 1 to 5 years of experience is Rs 5.3 to 5.8 lakh a year (12.3k salaries, updated 29 October 2026). For security analysts with 1 to 5 years it is Rs 6.6 to 7.3 lakh (19.8k salaries, updated 29 October 2026). These are self-reported market figures for people already in the role, not fresher offers. How the day-to-day of these roles differs is set out in SOC analyst vs penetration tester vs GRC analyst.

How to get into cybersecurity from a CS, IT or electronics degree

A degree student has time and a qualification that passes degree filters, but no work history. The ISC2 pathway data says work history is what most practitioners had, so the college years are the time to build a substitute for it.

That means fundamentals before tools: networking, operating system internals, a scripting language and the command line, which the existing guide on whether cybersecurity is hard to learn covers for beginners. It then means evidence that a hiring manager can open: write-ups of lab exercises, a documented home lab, a small tool or script, and a record of capture-the-flag or vulnerable-application practice. DSCI's finding that 63% of enterprises see limited hands-on skills in candidates is the gap that evidence fills.

Internships and apprenticeships were the route for only 3% of ISC2's practitioners, and 31% of teams in the 2024 global study had no entry-level staff. An internship search should therefore run in parallel with building public evidence rather than instead of it. Employer attitudes may be moving in a student's favour. The WEF's Future of Jobs Report 2025 (January 2025) found 30% of employers in India plan to adopt skills-based hiring by removing degree requirements, against 19% globally. That is an intention, not a change already visible at most companies.

How to get into cybersecurity from IT support, DevOps, cloud or software work

This is the 56% route, and it favours people who stay close to what they already do. Support and systems administrators map to SOC and identity work, because they already read logs and manage access.

DevOps and cloud engineers map to cloud security. It is the top technical priority for hiring managers in ISC2's 2025 global study at 29% and the second most in-demand skill in ISC2's India findings at 43%. Software developers map to application security, where Naukri JobSpeak for December 2025 recorded Application Security Engineer postings at 20+ LPA up 52% year on year, though those are senior postings rather than entry roles.

The cheapest move is often internal. An IT professional who takes on access reviews, patching cadence, log retention or secure configuration inside the current employer builds the kind of IT experience that the 56% describe.

Do you need a degree or a certification to get a job in cyber security?

Neither is sufficient, and both help with filters. Fortinet's 2025 Global Cybersecurity Skills Gap Report, based on 1,850 IT and cybersecurity decision-makers in 29 locations surveyed by Sapio Research in February 2025, found 89% prefer to hire candidates who hold certifications. Only 73% are now willing to pay for employees to obtain them, down from 89% in 2023. Employers like the signal but are less willing to fund it.

Set that against ISC2's global pathway data: only 6% of practitioners entered through certifications and 10% through cybersecurity education, while 56% came through IT experience. A certificate is a preferred signal, a degree is a common filter, and hands-on evidence is what DSCI's respondents say candidates lack. No counted source shows which certification Indian job postings ask for most, so claims that one credential is the most requested should be treated as marketing.

As one structured route, the Certificate Programme in Cybersecurity & Ethical Hacking in the AI Era is an online programme from IITM Pravartak, the Technology Innovation Hub of IIT Madras. It is taught in live online classes with two optional campus immersions at IIT Madras Research Park. It covers ethical hacking, security operations, cloud security, DevSecOps, AI security, risk and compliance, and a breach-response capstone, with modules such as SOC Operations & Microsoft Sentinel and Threat Hunting, EDR & Incident Response. It is one way to build that evidence, not a replacement for showing it.

Frequently asked questions

How do you get a job in cyber security or in the cyber forensics domain?

Through an adjacent technical role in most cases, since 56% of ISC2's 2025 global respondents entered via IT experience. CERT-In's 6-hour reporting rule and 180-day log retention requirement keep incident response a standing function, so a SOC or incident response seat, plus documented log analysis practice, is a reasonable first step towards forensics.

What should a cybersecurity undergraduate put on a CV for a first internship?

Evidence a reviewer can open, because 63% of enterprises in DSCI's May 2026 survey see limited hands-on skills in candidates. That means lab write-ups, a scripting project, capture-the-flag records and any security task done in a college system. Pair it with proof of the non-technical skills hiring managers rank highest in ISC2's 2025 study, problem solving (29%) and communication (22%), such as a clearly written report.

Is choosing a cybersecurity specialisation in college a mistake compared with core IT?

Not if the fundamentals stay intact. Hiring managers in ISC2's 2025 study prioritise cloud security (29%), security engineering (24%) and security analysis (23%), all of which rest on networking, operating systems and programming. A specialisation that teaches those plus security is fine; one that skips them narrows options, because 56% of practitioners entered through IT work that needs exactly those basics.

How long does it take to get a first cybersecurity job?

The ISC2 and DSCI figures cited here include no time-to-first-job figure for India. The employer side is documented. DSCI's May 2026 survey found 84% of organisations take 1 to 6 months to fill a security role, and ISC2's 2024 global study found 62% of hiring managers with openings were focusing on mid to advanced hires. A realistic plan allows months of applications, run alongside building evidence.

What do people already working in cybersecurity advise beginners?

ISC2's 2025 global study offers a proxy. Those who entered through certifications (67%) and cybersecurity education (61%) would mostly recommend their route, 73% expect AI to create more specialised security skills, and 68% are satisfied in the field. The counterweight is that 16% regret entering given current market conditions and 28% have considered switching, so the data supports entering with evidence and patience.

Next step

The Certificate Programme in Cybersecurity and Ethical Hacking in the AI Era, IITM Pravartak page sets out the curriculum and how to apply. Related reading: SOC analyst vs penetration tester vs GRC analyst, which fits you.