Getting Into Cybersecurity as a Fresh Graduate: Where to Actually Start

A final year student, a low paid internship and a pull toward security

A final year software engineering student wrote to me with a situation I recognise from dozens of messages. They did not know how to start, but when they did, they landed an internship as an account manager and proposal bidder on a freelance platform. They figured most of it out on their own. The pay is very low, and they are not sure it is what they ever wanted.

What they want is cybersecurity or IT operations. What makes it hard: not knowing where to start, having nobody to guide them, a fear of not being good enough, and job hunting itself.

If that sounds like you, this post is the guidance they asked for. It covers whether to keep the internship, which entry route into security makes sense, which certifications are worth the money, what to practise, what to put in a portfolio, which job titles to search for, and a six month plan to get there.

My honest read

Cybersecurity is a good field to aim for, but "entry level cybersecurity" is mostly a myth. Very few companies hire someone with no experience straight into penetration testing or threat hunting. Most security professionals arrived through IT support, networking, system administration, cloud operations or development, then specialised. Knowing that early saves you months of frustration.

A software engineering degree is a real advantage. You can read code, script, understand how applications are built and broken, and learn tools quickly. Many people entering security from non technical backgrounds struggle with exactly those things.

The fear of not being good enough is universal in security. The field is vast and changes constantly. Nobody knows all of it. The people who do well are not the ones who feel confident; they are the ones who stay curious and keep practising.

Your internship is not wasted, but it should not become your career by default. More on that next.

Should you keep the low paid internship?

I get asked this constantly, and my answer depends on what the role gives you besides money.

Here is the part people underestimate: account management and bidding teach skills security teams value. Writing clear proposals is close to writing clear incident reports. Handling clients is close to handling stakeholders during an incident. Understanding how freelance platforms and online businesses work helps you understand fraud and account takeover risks.

So a reasonable approach: keep it for now, cap the hours, and treat it as a paid bridge. Put the skills on your CV honestly ("wrote and won client proposals; managed client communication across time zones"). Then give your best focused hours to the security plan below. Set a date, for example three to four months from now, to reassess.

Which route into security?

There are three realistic entry routes for a fresh graduate. They converge later, so choosing one now does not lock you in.

My recommendation: if you are genuinely drawn to security, aim at SOC analyst roles, while applying in parallel to IT and cloud operations roles. Operations is the safety net that still moves you in the right direction. If you also enjoy building software, keep application security in mind as a longer term specialisation.

Certifications: which ones, and which are worth paying for

Certifications matter more in security than in most of software, because hiring managers and HR filters use them to screen entry level candidates. But they are a supplement to hands on skill, not a substitute.

Current, legitimate options for beginners (always check the official site for current price and availability in your country):

• ISC2 Certified in Cybersecurity (CC). A foundational certification from the organisation behind CISSP. ISC2's free "One Million Certified in Cybersecurity" programme closed to new sign ups in May 2026 after passing its one million milestone, so check ISC2's site for current exam pricing and any regional offers. It is a solid first credential that shows you know the vocabulary and concepts.
• Google Cybersecurity Professional Certificate (Coursera). An eight course programme covering security fundamentals, Linux, SQL, Python, SIEM tools and incident response. It is a structured, practical way to learn, and Coursera financial aid is worth applying for if the subscription is hard to afford.
• CompTIA Security+. The most widely recognised entry level security certification, often named directly in job descriptions and required for many government related roles. The current exam is SY0-701; CompTIA has announced a new version is on the way, and a certification you earn now remains valid for three years regardless. It costs more than the others, so I would take it once you have the fundamentals and are actively applying.

A sensible order: learn through the Google certificate or free material, take ISC2 CC for a first credential, then Security+ when you are job ready. Do not stack certifications for a year before applying. One or two plus a strong portfolio beats five with nothing to show.

Hands on practice: where skill actually comes from

Interviewers for SOC and security roles ask scenario questions: "you see this alert, what do you check first?" You answer those well only if you have actually done it.

• TryHackMe. Beginner friendly guided rooms. Many introductory rooms are free; the full SOC Level 1 path needs a paid subscription, which is worth it once you have used the free rooms and know you enjoy it.
• Blue Team Labs Online. Defensive challenges in incident response, forensics and threat hunting, with a free tier.
• LetsDefend. A simulated SOC where you triage alerts and investigate incidents, with free content for beginners.
• Hack The Box. Harder, more offensive focused. Useful later to understand how attackers think; do not start here if you are aiming at SOC roles.
• OverTheWire Bandit. Free, excellent for getting comfortable with the Linux command line.

Aim for regular practice: three or four sessions a week beats one long weekend binge.

Build a small home lab

A home lab sounds expensive. It does not have to be. A laptop with 16 GB of RAM (or free cloud credits) is enough to start.

1. Install VirtualBox or VMware Workstation, both of which have free options.
2. Create a Linux virtual machine (Ubuntu) and a Windows virtual machine. Windows evaluation images are available from Microsoft for testing.
3. Install Security Onion or the free tier of Splunk or the Elastic Stack to collect logs.
4. Generate activity: failed logins, a port scan from another VM, a suspicious PowerShell command. Then find it in your logs.
5. Write down what you did and what you saw.

That last step turns a hobby into a portfolio.

A portfolio of write ups

Security hiring managers want to see how you think. The best way to show that as a fresh graduate is written work.

• Lab write ups. "I set up a home SIEM and detected a brute force attack: here is how." Screenshots, steps, what you learned.
• Room and challenge write ups. Your own explanation of how you solved a TryHackMe or Blue Team Labs challenge. Check each platform's rules; many ask you not to publish solutions to active challenges, so focus on retired or permitted ones.
• A phishing analysis. Take a sample phishing email (from a safe public dataset), analyse the headers, links and attachments, and write an incident style report.
• A small script. A Python script that parses logs and flags suspicious IP addresses, or checks a list of URLs against a threat intelligence feed. Your software background shines here.

Put them on GitHub or a simple blog, and link them from your CV and LinkedIn. Five good write ups are a stronger portfolio than most entry level candidates bring.

A six month roadmap

This assumes you are finishing your final year and keeping the internship at reduced hours, so roughly 10 to 15 hours a week of security work.

Job hunting: the hardest part, made more manageable

You said job hunting is what you find most difficult. A few things that make it less painful:

• Search the right titles. "Cybersecurity" alone returns senior roles. Search "SOC Analyst L1", "Junior Security Analyst", "Security Operations", "NOC Engineer", "IT Support Engineer", "Cloud Support Associate" and "Graduate Trainee IT".
• Look at managed security service providers (MSSPs) and SOC service companies. They hire entry level analysts far more often than product companies do, because they run 24/7 monitoring for many clients.
• Apply to graduate and trainee programmes at banks, telecom companies and large IT service firms. They often train security and operations staff internally.
• Tailor every CV to the role. For SOC roles, lead with your lab, write ups and certifications. For operations roles, lead with Linux, networking and scripting.
• Talk to people, not just portals. Message SOC analysts on LinkedIn and ask what their first year looked like. Most people are kinder than you expect, and referrals open doors applications do not. A job search is a pipeline, not a performance explains how to structure this.
• Expect rejections and track them. Keep a simple spreadsheet: role, date, stage, outcome. Patterns in the rejections tell you what to fix.

About the fear of not being good enough

I want to address this directly, because you named it and many people do not.

Feeling not good enough in security is not a sign that you do not belong. It is a sign that you understand how big the field is. Senior engineers feel it too; they have just learned to act anyway.

Three things help:

1. Measure yourself against last month, not against people online. Your learning log is the evidence. After six months, reread the first page.
2. Make your learning visible. Each write up is proof, to employers and to yourself.
3. Find your people. Security communities are generous. Join a local or online group, and come ask questions in our Discord. Having someone to ask when you are stuck changes everything.

You have already done something many people never do: you found an internship on your own, figured it out, and now you are asking where you want to go next. That is exactly the kind of initiative security teams need.

Ask your own question

Questions about choosing between security, operations and development come up again and again. I am collecting the most common ones, anonymised, with detailed answers in the career questions library.

Student or want early access to the Sefism member area, with a learning roadmap built for you and written answers to your own questions? Join the waitlist.

If you want to talk through your plan one to one, I offer free career guidance sessions on Topmate.

Stay in touch

• LinkedIn: where I share roadmaps, career advice and honest takes on hiring. Follow, or message me.
• X (Twitter): short practical thoughts on engineering and careers.
• Instagram: quick tips and a more personal side.
• Topmate: book a free 1:1 session for guidance on your situation.
• Sefism Discord: ask questions, share write ups and find others learning security.
• Sefism on YouTube: walkthroughs and talks.

Cover photo by Jakub Żerdzicki on Unsplash