Do Cybersecurity Employers Hire on Skills or Degrees? What to Build First

Entry-level IT and security roles have tightened, and a bachelor's degree no longer guarantees an interview, let alone an offer. Spiceworks reported on September 3, 2026 that the old computer-science-to-help-desk path is fading, and employers increasingly ask what candidates have built, fixed, or defended, describing hands-on experience is the new gold standard for IT jobs.

Cybersecurity hiring has absorbed that shift directly. A degree or certification is one input in a skills-based screen, not the differentiator. Demonstrated lab work, incident troubleshooting, and tooling outcomes now separate candidates more than credential prestige does, which reframes how students and career changers should evaluate online cybersecurity degree and cert programs.

What Skills-Based Hiring Actually Means for Cybersecurity Roles

The old hiring model put the degree checklist first. The skills-first model inverts that: hiring managers evaluate whether you can perform security tasks before they weigh where you learned them.

From credential gate to demonstrated ability

Skills-based hiring means a candidate is screened against the actual work of a role, not just formal education. For cybersecurity, that may include identifying an attack pattern in packet captures, triaging an alert, hardening a cloud configuration, or writing a clear incident report. The NICE Framework, developed by the National Initiative for Cybersecurity Education, helps employers do this consistently by describing cybersecurity work through tasks, knowledge, and skill statements. That shared vocabulary lets a SOC analyst job posting specify evidence like "can analyze logs" instead of leaning only on "bachelor's required."

Why certifications are now a floor, not a differentiator

Spiceworks recently noted that cybersecurity certifications have shifted from differentiator to baseline.¹ Employers still value certs as proof of foundational knowledge, but they don't treat them as proof that someone can apply concepts in a real environment. The more important question has become what a candidate has built, fixed, automated, or supported. That is why home labs, CTF writeups, and documented projects carry weight.

A trade-like standard with room for credentials

Cybersecurity is increasingly compared to a trade, where credibility is earned through practice under pressure. The same Spiceworks analysis suggests degrees are now judged on ROI rather than prestige.¹ That doesn't make credentials irrelevant. It means the degree or cert should be one part of a portfolio that also shows hands-on work, curiosity, and an ability to keep learning.

How Employers Screen for Practical Skills (And How It Differs From a Degree Filter)

A cybersecurity degree and cybersecurity certifications show what you studied. A practical skills screen shows what you can do when an alert fires, a log looks abnormal, or a report is due in 45 minutes.

The screening funnel now runs on evidence

Employers still use job postings and resumes, but the language has shifted from credential lists to task lists. A posting may ask for experience triaging phishing alerts, correlating endpoint logs, or writing incident handoff notes. The resume stage is often an ATS and recruiter pass that looks for those same signals, not just an education line.

Tip: Treat the job posting as a rubric. Mirror its verbs in your resume bullets and show the artifact or tool outcome next to each one.

Practical assessments are short, scored, and role-specific

Most employers combine a hands-on exercise with a structured technical interview. Planning ranges vary by team, but common formats include: - Short screening exercise: 20 to 45 minutes, usually a focused log or alert question. - Log-triage exercise: 45 to 90 minutes, often asking you to decide what to escalate, investigate, or document. - SOC or incident-response simulation: 90 to 180 minutes, covering detection through post-incident handoff.

A sample SOC simulation rubric might weight detection at 25%, triage at 20%, response planning at 20%, documentation at 15%, communication at 10%, and tool use at 10% on an anchored 0 to 4 or 1 to 5 scale. SANS cybersecurity assessments separate hands-on, role-specific assessments from multiple-choice foundational screens, and a vulnerability assessment or written briefing may replace or add weight depending on the role. NIST guidance also defines proficiency levels from Level 0, no foundational knowledge, through Level 3, advanced, but employers set their own pass thresholds. The key is that one high score does not cancel a critical failure in safe escalation, evidence preservation, or incident judgment.

Degree filter vs. competency rubric

A degree filter is pass/fail and screens history. A rubric-based assessment scores output: did you identify the high-severity incident, preserve evidence, and hand off clearly? Structured interviews then ask each candidate the same scenario questions and score behavioral evidence, not impressions.

Tip: Before the interview, prepare one detection and one containment story using the STAR format, including what you would not do, such as isolating a host before confirming scope.

Keep these takeaways in mind: - Mirror job posting tasks on your resume and portfolio. - Practice timed triage exercises and write a short handoff note. - Do not let tool familiarity substitute for safe judgment. - In structured interviews, talk through your reasoning, not just the answer.

How Many Cybersecurity Jobs Really Skip the Degree Requirement?

Phillips 66's Cybersecurity Advisor I opening,¹ Johnson & Johnson's pentesting program lead role,² and Johns Hopkins APL's 2026 graduate cybersecurity analyst track³ all list a bachelor's degree as a requirement this year. So do two recent-graduate cybersecurity announcements on USAJobs.⁴⁵ Other 2026 postings on Indeed and CareerBuilder use softer language, such as "bachelor's preferred."⁶⁷ Both patterns exist at the same time, so a single headline percentage , or a blanket cybersecurity degree vs certifications verdict , can mislead you.

Why We're Not Quoting a Single Number

We searched Lightcast, CyberSeek, CompTIA, and ISC2, including ISC2's 2025 Cybersecurity Workforce Study. None of the sources we could check gave a current, verified share of U.S. cybersecurity postings that require a bachelor's degree compared with those that don't. We didn't want to pass along a recycled statistic, so here is how to check the numbers yourself. When you do find a figure, note its data year. An analysis of postings from several years ago describes a different hiring market than the one you're entering.

Where to Look

• BLS Occupational Outlook Handbook: Check the "How to Become One" tab for information security analysts and related roles to see the typical entry-level education.
• CyberSeek, Lightcast, CompTIA, and ISC2 reports: Look for breakdowns by education requirement. Confirm the data year and whether the report measures job postings or actual hires.
• School and program websites: Admissions pages show what a degree or certificate actually requires of you, including prerequisites and transfer credit for certifications.
• ISC2, ISACA, and CompTIA: These associations outline certification-based pathways and the cybersecurity certification work experience requirements attached to each credential.

Run Your Own Posting Audit

Pull 20 to 30 current postings on LinkedIn or Indeed for the exact role you want, in your target region. Sort them into three buckets: "bachelor's required," "degree preferred," and "or equivalent experience." That tally tells you more about your local market than any national average. If a posting is ambiguous, ask the recruiter whether the degree is a hard filter. Also ask program advisers what their recent graduates are hearing from employers.

How to Read What You Find

Requirements vary by role, employer, and hiring track. Federal recent-graduate programs and many large enterprises write the degree in as a firm requirement, while "preferred" wording leaves room for other evidence. When you see "equivalent experience," you can often qualify with alternatives such as an associate degree, a bootcamp, or certifications backed by documented lab projects. Treat each posting's language as a direct signal of which cybersecurity career path fits that employer.

Degree and Certification Expectations by Role: SOC Analyst, Pentester, GRC and Cloud Security

Degree expectations vary by specialty, but the pattern is consistent: a degree shows up in postings, while certifications and demonstrable work often decide who gets the interview. One posting analysis found that 60% of cybersecurity jobs required a related college degree. That figure is not broken out by role, so treat it as a general benchmark, not a rule for any single job.

SOC Analyst

A cited SOC analyst posting lists a bachelor's in cybersecurity, IT, computer science, or a related technical field.¹ Still, many employers prioritize certifications and project experience over the four-year degree.² CompTIA Security+ is the usual starting credential on the CompTIA Cybersecurity Path, and Network+ and Security+ are both mapped to SOC pathways. The proof to show: log analysis, alert triage, vulnerability assessment, and lab work with Splunk Free, sample logs, and Nmap or Nessus.

Penetration Tester

No pentest-specific degree percentage is published, so read postings closely. eJPT and PNPT map to pentesting pathways, while Security+ and Certified Ethical Hacker are recommended entry credentials. Capture-the-flag results, plus solid Linux and networking knowledge, are the relevant background for the penetration tester career path. Some practical certifications require you to attack real-world networks, which is stronger evidence than a multiple-choice score.³

GRC and Compliance Analyst

GRC is often the most approachable door. These roles are described as true entry-level cybersecurity jobs open to people coming from a bootcamp, a certification, or an adjacent IT job. ISC2 Certified in Cybersecurity (CC) and ISACA CISA appear in role-based certification guidance for governance analysts.⁴ Employers want evidence of reviewing security policies, collecting audit evidence, maintaining risk registers, tracking NIST CSF and ISO 27001 compliance, and supporting vendor-risk assessments.⁵

Cloud Security

Degree requirements have declined most sharply in cloud-security postings, according to one posting analysis, though no exact percentage is given.⁶ An AWS or Azure associate certification maps to cloud security analyst pathways. Back it up with a portfolio showing you operated security tools, analyzed logs, scripted in Python or PowerShell, and pulled data through APIs.

What This Means for Your Plan

Across all four roles, the degree is a common line item but rarely the deciding one. Pick the certification that matches your target role, then build artifacts that prove you can do the work.

Related Articles

Portfolio and Lab Projects That Substitute for Experience

A portfolio replaces experience only when it reads like work product instead of a scrapbook. Hiring managers are looking for evidence of tasks performed, decisions made, and results explained. Three sources can show you what that means.

Map Projects to a NICE Work Role

The NIST NICE Framework does not prescribe a portfolio, hands-on cybersecurity labs, or CTF format. What it gives you is shared language.

• Open the Framework's Work Role listings (42 roles) and pick the one you want.
• Read its Task and Knowledge/Skill statements. Search the page for "portfolio" or "demonstrated ability," but expect the value to be in the task wording.
• Rewrite each project summary using those task verbs, tools, and outcomes.

A project with no link to a role task is a red flag. A small set of complete artifacts beats a long list of shallow ones.

Triangulate Credible Evidence Standards

ISC2's 2025 hiring-manager research surveyed 929 managers. Entry-level work most often involved documentation (43%), alert and event management (35%), and reporting (32%). That points to detection write-ups, incident timelines, escalation notes, and runbooks as the strongest artifacts for a SOC analyst career path.

The same research shows about 90% of managers would consider prior IT experience alone, and 89% an entry-level certification alone. A portfolio is not proven to beat either one. It works best when it shows capability comparable to practical IT work.

Search ISC2 for "entry-level cybersecurity portfolio evaluation" and "hiring manager survey," and look for the Cybersecurity Career Guide. Search SANS for "Cyber Talent" webinars and podcasts. Then read the BLS Occupational Outlook Handbook entry for Information Security Analysts to confirm typical duties. Check career-services pages at SANS Technology Institute, WGU, or UMGC, and ISC2, ISACA, and ISSA, for rubrics or write-up expectations.

Ask the People Who Hire

Message security managers on LinkedIn, or attend a local ISSA or ISACA meeting, and ask what makes a portfolio credible. Then search "cybersecurity portfolio red flags" on hiring blogs and cybersecurity forums such as Reddit's r/cybersecurity. Where several sources agree, treat it as a standard.

Self-Evaluation Checklist

• Role link: Does each project name the NICE tasks it demonstrates?
• Reasoning: Do you separate observed facts from your interpretation?
• Limits: Do you state how your lab differs from enterprise scale and telemetry?
• Reproducibility: Could a reviewer follow your steps, with dates and tool versions?
• Provenance: Is your work separated from team or borrowed work?
• Safety: Are logs sanitized and secrets removed?
• Authorship: Can you explain every line without an AI assistant?

A CTF ranking or badge count shows participation. Add a short defensive lesson from each challenge, and it starts to look like professional reasoning.

Certifications That Signal Hands-On Competence (And Why They're Only a Baseline)

Security hiring is moving through a certification reset: credentials that once made a resume stand out now read as prerequisites, while real proof still comes from applied work. The shift is especially visible in cybersecurity, where hiring managers ask candidates to walk through their last simulated incident instead of listing certificate codes.

Are cybersecurity certifications without a degree enough to get hired? Rarely on their own. Employers treat them as baseline proof that you learned the vocabulary and core concepts, not necessarily that you can triage an alert, contain a compromise, or document a finding. A certification gets you past an initial filter; a lab write-up or incident walkthrough gets you the interview.

Knowledge-Based vs. Performance-Based Exams

CompTIA Security+ is the clearest foundational example. The current SY0-701 exam is 90 minutes and includes up to 90 questions.¹ It mixes multiple-choice, drag-and-drop, and performance-based questions, so it is not pure recall: candidates apply concepts in simulated security tasks. CompTIA lists English retirement for SY0-701 on June 11, 2027, with several non-English versions retiring August 13, 2027.¹ The prior SY0-601 retired July 31, 2024,² so if you are studying now, use the current version.

Other practical tracks, such as BTL1, PJPT, and GCIH, are often positioned as more hands-on, but current exam details change often enough that you should verify each vendor for the latest format, version code, and retirement status before scheduling; see our how to prepare for cybersecurity certification guide. Treat any advertised hands-on component as a claim to confirm, not a permanent fact.

Matching Certifications to Roles

• SOC and blue team: Security+ and CySA+ provide baseline defense vocabulary; pair them with detection lab write-ups.
• Pentesting: Practical tracks like PJPT or GCIH align with red team work, but employers will ask for actual findings.
• GRC: Security+ and compliance knowledge help, but policies and audit samples matter more.
• Cloud security: Vendor cloud security certifications plus infrastructure labs show you can secure real deployments, not just pass a multiple-choice exam.

How to Make Any Certification Count

Whichever exam you choose, pair every certification with a home lab, simulated alert, or short write-up showing what you did and why. For SOC roles, replay a PCAP and show your triage steps, including what you would escalate and why. For cloud roles, harden a test environment and document the before and after. That turns the credential into evidence an interviewer can actually read.

For next steps on structured certification paths, see our CompTIA path guide and the TryHackMe vs Hack The Box comparison on onlinecybersecurity.org.

Where an Online Cybersecurity Degree Still Matters (And How to Judge Its ROI)

Skills-based hiring is real, but it is not universal. There are corners of this field where an online cybersecurity degree still earns consideration a portfolio alone cannot.

The places a degree still carries weight

Large employers with formal HR screening layers often keep a degree field in the applicant tracking system, and candidates without one get filtered before a human reads the resume. Government and defense work is the clearest case: many civilian federal postings list a bachelor's as the minimum qualification, and some contractor and cleared positions carry a four-year requirement outright. Promotion into security management is similar, though the evidence there is qualitative rather than statistical. Degree holders tend to clear internal screening more easily when a team lead or CISO track opens up. ISC2's 2025 workforce research found roughly one in five working security professionals has no four-year degree, so the requirement is far from absolute.

The ROI test: transcript or artifacts?

Here is the question that should drive your enrollment decision. Does the program hand you a transcript, or does it hand you things you can show an interviewer? A degree that includes a persistent lab environment, a capstone you can publish, SOC simulation coursework, and an internship placement pipeline is competing on the same terms employers now screen for. A degree that is lecture, quiz, and paper is buying you the HR filter bypass and nothing more.

Use this checklist when comparing online cybersecurity programs:

• Lab access: Cloud or virtualized environments you control, not just vendor demos.
• Capstone: Something portfolio-ready you own and can discuss in detail.
• Career services: Actual internship and co-op placement, not a resume template library.
• Cost and payback: Total tuition against realistic entry salaries in your region.
• Cybersecurity degree accreditation: Regional accreditation plus any relevant designations.

Comparing routes honestly

Bootcamp outcome numbers circulating in 2026 (employment around 64 percent, six-month placement near 79 percent, breakeven in roughly 15 to 19 months on $12,000 to $20,000 tuition) come mostly from providers using inconsistent definitions. Treat them as directional. There is no clean independent study putting online degrees, certificates, and bootcamps on the same measuring stick. Judge each option by what it produces, not by which category it belongs to.

What Entry-Level Security Roles Pay: National BLS Benchmarks

These national figures come from the U.S. Bureau of Labor Statistics Occupational Employment and Wage Statistics program for 2025. They cover workers at every experience level, so the 25th percentile is the closest proxy for what a newer analyst or sysadmin might earn, while the manager row shows where hands-on skills can lead over time. Network and systems administration is the most common stepping stone into security work, and it is a role where lab builds and troubleshooting experience carry real weight in hiring.

Salary Snapshot for Information Security Analysts

If you're weighing whether hands-on skill-building pays off, this is the occupation most entry and mid-level security roles roll up into.

A Step-By-Step Plan to Build Verifiable Proof While You Study or Serve

What order should you actually do this in if you are working full time and taking classes at night? The sequence matters less than the artifacts it produces, but there is a progression that consistently works.

The Core Sequence

• Months 1 to 6: get your hands on production systems. A help desk, NOC, or IT support role (even part time or internal to your current employer) teaches ticket discipline, escalation, and user-facing troubleshooting. Employers read this as evidence you can operate under real constraints.
• Months 3 to 12: build the home lab. A hypervisor, a Windows domain controller, a Linux box, and a free-tier SIEM or log collector is enough. Break things on purpose, then document the fix.
• Months 6 to 18: compete and intern. Capture-the-flag events give you scored, timestamped results. A cybersecurity internship or co-op, even a short one, converts lab skills into supervised incident work.
• Final term: a capstone write-up tied to coursework. Take one project (a detection rule you wrote, a phishing simulation you ran, a cloud misconfiguration you found and remediated) and produce a clean report with scope, method, findings, and outcome.

A realistic target is 8 to 12 hours per week outside class on lab and portfolio work. Sustained over 18 to 24 months, that is enough to graduate with a body of evidence instead of only a transcript.

Routes for Service Members and Veterans

If you are still on active duty, DoD SkillBridge is the most direct on-ramp to cybersecurity careers for veterans. Per the Department of Defense, it is open to active-duty members during their final 180 days of service, all ranks are eligible, and participation cannot exceed 180 days.¹ You need approval from your first commander in the chain of command at O-4 or above, and you must complete required Transition Assistance Program components first.¹ Air Force Instruction 36-2671 adds specifics for airmen: at least 180 continuous days on active duty, separation within 180 days of starting, a discharge characterization of general under honorable conditions or higher, and completed TAP initial and pre-separation counseling.² Members in the Indispensability Program or on long-term MPA/RPA orders are not eligible.² Select Guard and Reserve groups may qualify within 180 days of separation.¹

Program lengths vary by provider: F3USA runs a 10-week track,³ and NPower lists a 16-week internship aimed at people with cyber, signals intelligence, or IT backgrounds.⁴ SkillBridge placements can take the form of industry training, cybersecurity apprenticeships, or internships.¹ For GI Bill funding of a degree or certification path, verify approval directly through the VA and your school's certifying official rather than trusting a provider's marketing claim.

Keep the Portfolio Current

Every milestone becomes an artifact: a lab diagram, a detection rule with test output, a CTF scoreboard screenshot, an incident write-up. Review and refresh the whole portfolio quarterly, pruning weak entries. Your next step: pick one lab project this week and write the report before you start the next one.