10 In-Demand Skills to Build for a Career in Cybersecurity
From vulnerability scanning to incident write-ups, this guide maps the skills security job postings ask for and how long each one realistically takes.
By Marguerite Dunlevy · Oct 05, 2026 · 10 min read
Cybersecurity hiring is driven by a short list of repeatable tasks: watching networks for breaches, patching what scanners find, keeping firewalls and encryption current, and writing up incidents so other people can act on them (U.S. Bureau of Labor Statistics, 2025). Build the skills behind those tasks and you are building what employers are actually buying.
This guide covers ten skill areas, the tools employers name in postings, a sequenced learning plan with milestones, and an honest comparison of self-study, certification, bootcamp, apprenticeship and degree routes. Costs change constantly, so it tells you where to check current prices rather than quoting numbers that go stale.
The Skills Landscape
Three data sources tell you what to learn, and they agree more than they disagree.
First, the federal occupational data. The U.S. Bureau of Labor Statistics puts 2025 median pay for information security analysts at $129,180 a year ($62.11 an hour) and projects employment to grow much faster than average between 2025 and 2035, with openings projected each year on average across the decade (U.S. Bureau of Labor Statistics, 2025). BLS also describes the work concretely: monitoring networks for breaches, maintaining firewalls and encryption software, checking for vulnerabilities, researching security trends, preparing incident reports, and developing security standards (U.S. Bureau of Labor Statistics, 2025). Those six duties are your syllabus.
Second, the tool-level data. ONET flags Tenable Nessus as an "In Demand" technology skill for this occupation, meaning it appears frequently in employer job postings (ONET OnLine, 2026). Its wider technology list for the role names Metasploit, PortSwigger Burp Suite, HP WebInspect, Rapid7 Nexpose, Symantec Endpoint Protection and McAfee VirusScan (O*NET OnLine, 2026). Learning a scanner and a web proxy is not a hobby detour; it is listed vocabulary.
Third, the certification market. CyberSeek, built by CompTIA and Lightcast with support from NIST NICE, publishes a chart comparing holders of common cybersecurity certifications against openings requesting each one (CyberSeek, 2025), and figures sourced from that heat map show more CISSP openings than certified individuals nationally (Thorteaches, citing cyberseek.org). State-level breakdowns show which certifications employers in your state actually ask for (WorkingNation), which matters because demand is uneven by employer type — most analysts work for computer companies, consulting firms, or business and financial companies (U.S. Bureau of Labor Statistics, 2021).
ONET classifies the occupation as Job Zone Four, "Considerable Preparation Needed": most jobs in this zone require a four-year degree, but some do not (ONET OnLine, 2026). Read that as: skills and evidence can substitute for credentials with some employers, not all.
Core Skills to Learn
Each skill below lists why employers ask for it, one concrete way to practise it, and a part-time learning estimate (roughly 8-10 hours a week). Check current prices directly with the vendor or training provider before committing.
- Network and system monitoring for breaches. The first duty BLS lists for the role (U.S. Bureau of Labor Statistics, 2025). Build a home lab with two or three virtual machines, generate traffic, and practise identifying what is abnormal. 2-4 months to basic competence.
- Vulnerability scanning. Tenable Nessus is flagged as an "In Demand" skill for this occupation, meaning it shows up frequently in postings (ONET OnLine, 2026). Install the free-tier scanner against your own lab, then repeat with Rapid7 Nexpose, also named for the role (ONET OnLine, 2026). 4-8 weeks.
- Patch and remediation prioritisation. Scanning produces hundreds of findings; employers pay for the judgement about which five get fixed first. Practise by writing a one-page remediation plan after each lab scan. 4-6 weeks, layered on the skill above.
- Firewall and encryption administration. Named explicitly in the BLS duty list (U.S. Bureau of Labor Statistics, 2025). Configure host and network firewall rules in your lab and set up certificate-based encryption for a test service. 1-3 months.
- Web application testing. PortSwigger Burp Suite and HP WebInspect both appear on ONET's technology list for the occupation (ONET OnLine, 2026). Work through a deliberately vulnerable practice application with Burp's community edition. 2-4 months.
- Exploitation fundamentals. Metasploit is listed for the role (ONET OnLine, 2026). You do not need to be a penetration tester, but understanding how a finding becomes an incident changes how you triage. 3-6 months.*
- Endpoint protection. Symantec Endpoint Protection and McAfee VirusScan appear on the same ONET list (ONET OnLine, 2026). Learn deployment, policy tuning and alert triage on any mainstream endpoint product — the concepts transfer. 4-6 weeks.
- Incident reporting and written communication. BLS lists preparing incident reports as a core duty (U.S. Bureau of Labor Statistics, 2025). Write a timeline, impact statement and recommendation for every lab exercise; keep them as portfolio evidence. Ongoing; 4-8 weeks to a usable template.
- Security standards and policy drafting. BLS lists developing and recommending security standards among the duties (U.S. Bureau of Labor Statistics, 2025). Draft an access-control and patching standard for a hypothetical 50-person company. 2-3 months alongside other study.
- Baseline certification knowledge. CompTIA Security+ is described as confirming the baseline skills needed for core security functions and as a global benchmark for network and operational security practice (Cybersecurity Guide). A Security+ purchase bundle includes an exam voucher, one retake, a 12-month CertMaster Learn licence and a 12-month CertMaster Labs licence (TechTarget); CompTIA publishes current pricing. 8-16 weeks of part-time study.
Building a Learning Plan
- Weeks 1-6: fix the foundations. 8-10 hours a week on networking basics, Linux and Windows administration, and scripting. Milestone: you can build a three-machine virtual lab from scratch, move traffic between the machines, and explain what each port is doing.
- Weeks 7-18: tools before theory. 8-10 hours a week running Nessus and Nexpose scans against your lab and working through a vulnerable web app with Burp Suite — all three named in ONET's technology list for the occupation (ONET OnLine, 2026). Milestone: three written scan reports, each ending with a prioritised fix list a non-technical manager could follow.
- Months 5-7: certify the baseline. 6-8 hours a week on Security+ material, which covers core security functions and is positioned as a benchmark for network and operational security practice (Cybersecurity Guide). Before you book, check CyberSeek's state-level data on which certifications employers in your state request (WorkingNation). Milestone: consistent passing scores on practice exams, then the exam itself.
- Months 8-11: build the evidence file. 5-6 hours a week turning lab work into a portfolio: incident reports, a draft security standard, and a remediation plan — mirroring duties BLS lists for the role (U.S. Bureau of Labor Statistics, 2025). Milestone: a public repository or PDF pack of six artefacts you can hand to an interviewer.
- Months 10-14: get supervised reps. Apply for internal transfers, help-desk-to-security moves, or a U.S. Department of Labor-approved Registered Apprenticeship — approved titles for this occupation include Cyber Defense Analyst, Cyber Security Support Technician and Cybersecurity Analyst (NOF) (ONET OnLine, 2026). Milestone:* you are handling real alerts under supervision, not lab alerts.
- Months 12-18: target the applications. 4-5 hours a week matching your evidence to posting language. Search under the job titles ONET records for this occupation — Information Security Officer, Information Systems Security Analyst, Information Systems Security Officer, IT Security Analyst, Network Security Analyst (ONET OnLine, 2026) — not just "cybersecurity." Milestone: interviews, and a record of which skill gaps each rejection exposed.
Comparing Learning Paths
Prices change by provider, state and year, and no single public dataset reports completion or placement rates across all four routes. Treat the outcome column as what is documented, not as a guarantee.
| Path | Typical duration | Cost: where to check | What is documented about outcomes |
|---|---|---|---|
| Self-study plus home lab | 6-18 months part-time | Tool vendors publish free community tiers and paid tiers; budget for hardware only | No central completion data. Evidence is your portfolio against the duties BLS lists for the role (U.S. Bureau of Labor Statistics, 2025) |
| Certification track (e.g. CompTIA Security+) | 8-16 weeks part-time | CompTIA publishes current bundle pricing; the purchase includes an exam voucher, one retake, and 12-month CertMaster Learn and CertMaster Labs licences (TechTarget) | CyberSeek charts holders of each certification against openings requesting it (CyberSeek, 2025); figures from that heat map show more CISSP openings than certified individuals nationally (Thorteaches, citing cyberseek.org) |
| Bootcamp | Commonly 3-9 months, full- or part-time | Ask each provider for current tuition and its published outcomes report before enrolling | Providers self-report placement; there is no single federal dataset verifying bootcamp hiring outcomes for this occupation |
| Registered Apprenticeship | Typically 1-4 years, paid and on the job | Earn while training; check sponsor terms | U.S. Department of Labor-approved titles for this occupation include Cyber Defense Analyst, Cyber Security Support Technician and Cybersecurity Analyst (NOF) (O*NET OnLine, 2026) |
| Bachelor's degree | 4 years full-time | Check the institution's published tuition and fees | BLS lists a bachelor's degree as typical entry-level education, with under 5 years of related experience and no on-the-job training required (U.S. Bureau of Labor Statistics, 2025); ONET places the role in Job Zone Four, where most occupations require a four-year degree but some do not (ONET OnLine, 2026) |
Frequently asked questions
Do I need a degree to get hired in cybersecurity?
BLS lists a bachelor's degree as the typical entry-level education for information security analysts, along with less than 5 years of related work experience and no on-the-job training required (U.S. Bureau of Labor Statistics, 2025). O*NET places the occupation in Job Zone Four, where most jobs require a four-year degree but some do not (O*NET OnLine, 2026). In practice: a degree widens the pool of employers who will screen you in, and Registered Apprenticeship routes such as Cyber Defense Analyst and Cyber Security Support Technician exist as alternatives (O*NET OnLine, 2026).
Does a certification actually improve my hiring odds?
It depends which one and where. CyberSeek publishes a chart comparing the number of people holding each common cybersecurity certification against the number of openings requesting it (CyberSeek, CompTIA and Lightcast, 2025), and figures drawn from that heat map show more CISSP openings than certified individuals nationally (Thorteaches, citing cyberseek.org). State-level breakdowns show which certifications employers in your state request (WorkingNation). Check your own state's data before paying for an exam, rather than assuming national demand applies locally.
How much does this cost to get started?
The cheapest viable start is free: community or free-tier versions of the scanning and testing tools named for this occupation — Nessus, Nexpose, Burp Suite, Metasploit (O*NET OnLine, 2026) — running on a laptop. Paid steps come later. A CompTIA Security+ bundle includes an exam voucher, one retake, and 12-month CertMaster Learn and CertMaster Labs licences (TechTarget); CompTIA publishes current pricing, and bootcamp and degree costs vary by provider and state. Get a written price before you commit to any of them.
How long until I am employable?
From an existing IT or help-desk role, plan 6-18 months of part-time study using the plan above. With no technical background, 18-36 months is more realistic, because the first 6 months go on networking and operating-system fundamentals before any security tooling. Those are preparation ranges, not hiring promises — no study plan guarantees an offer.
Is the job market actually growing, or is that marketing?
BLS projects employment of information security analysts to grow much faster than average from 2025 to 2035, with openings projected each year on average over the decade, and reports 2025 median pay of $129,180 a year, or $62.11 an hour (U.S. Bureau of Labor Statistics, 2025). CyberSeek tracks national online cybersecurity openings using job demand data from Lightcast (formerly Burning Glass) combined with BLS supply data and figures from certification bodies (NIST, 2016; CyberSeek, 2025).
Which single skill should I learn first if my time is limited?
Vulnerability scanning, closely followed by writing up what you found. Nessus is flagged as an "In Demand" technology skill for this occupation because it appears frequently in employer postings (O*NET OnLine, 2026), and preparing incident reports and recommending security standards are listed duties (U.S. Bureau of Labor Statistics, 2025). Four to eight weeks of focused practice gives you a scan-and-report artefact you can show in an interview.
Sources
- U.S. Bureau of Labor Statistics — Information Security Analysts : Occupational Outlook Handbook (2025)
- U.S. Bureau of Labor Statistics — Information Security Analysts Occupational Outlook Handbook (archived PDF) (2021)
- O*NET OnLine — 15-1212.00 - Information Security Analysts (2026)
- O*NET OnLine — Technology Skills: Information Security Analysts (2026)
- CyberSeek (CompTIA and Lightcast, supported by NIST NICE) — Cybersecurity Supply And Demand Heat Map (2025)
- National Institute of Standards and Technology (NIST) — NIST Announces CyberSeek, an Interactive Resource for Cybersecurity Career Development (2016-11)
- Thorteaches (citing cyberseek.org/heatmap.html) — IT Security – from Cyberseek.org: 'More open CISSP job openings, than the total number CISSP certified individuals in the US'
- WorkingNation — Cybersecurity jobs are everywhere. Here's how to find them
- TechTarget — What is CompTIA Security+? An introduction to Security+ certification
- Cybersecurity Guide (cybersecurityguide.org) — An Overview of the CompTIA Security+ Certification Process
Written by
Marguerite Dunlevy
Marguerite oversees coverage of job hunting and career pivots, with a focus on how people make decisions when the path forward isn't obvious. She's drawn to the messy middle of a career change more than the tidy success story. Her writing tends to ask what a 'good job' even means to the person doing it.
