First cybersecurity job: where to apply and how

Landing a first job in cybersecurity is often harder than building the skills themselves. Job ads ask for experience, titles blur together, and you end up sending dozens of applications without a reply. This guide helps you pick a precise target, find the employers that genuinely train beginners and build applications that turn into interviews.

Pick a target before you apply

"I'm looking for a job in cybersecurity" is not a search, it is a sector. A recruiter reading a generic application has no idea where to place you, and sets it aside. Start by choosing one or two entry roles, then tailor everything else to that choice.

These are the most common ways in for a first role:

Entry role	What is expected from a beginner	Read more
SOC analyst (L1)	Systems and network basics, log reading, method, clear writing	Becoming a SOC analyst
Junior GRC consultant	Rigour, writing, understanding of frameworks (ISO 27001, NIS2)	Becoming a GRC consultant
Junior auditor or pentester	Strong technical basics, regular practice, report quality	Becoming a pentester
Junior security engineer (integration, operations)	System or network administration, deploying and running security tools	From sysadmin to cloud security
Technician or administrator with a security scope	Good knowledge of an IT estate, a wish to move into a dedicated role	Switching into cybersecurity

Choose based on what you have already practised, not only on what appeals to you. Pentesting attracts many beginners, and competition for junior roles is stiff. A first role in a SOC, in GRC or in security operations is a solid base to grow from.

The employers that hire beginners

Not every employer can take on someone in their first job. What matters is a team able to mentor you. Here are the main types to target, what they offer and what to check.

Managed security providers (MSSPs, managed SOCs)

They regularly hire L1 analysts, because their teams have to cover long hours. You see many client environments in a short time, which speeds up learning. Check the hours, the shift patterns and how skills development is organised.

IT services firms and consultancies

They hire juniors in audit, GRC or solution integration, and train them on the job. The variety of assignments is a real asset. Ask what happens between assignments and who supports you on your first engagements.

Large organisations with an in-house security team

Banks, insurers, manufacturers, operators: their teams are often structured, with written procedures and seniors on hand. Getting in can be more selective, but work-study programmes are a common way through the door.

Security vendors

Technical support, pre-sales, integration, research: a vendor gives you deep knowledge of a product and of the market. It is a good springboard if you enjoy tooling and working with customers.

The public sector

Government departments, local authorities, hospitals and public bodies also hire security profiles, beginners included. Entry routes (competitive exams, contracts) vary, so go straight to official sites such as that of ANSSI, the French national cybersecurity agency, which posts its own openings.

On the other hand, be wary of a first job where you would be the only person in charge of security. With no one to learn from, you will progress slowly and carry responsibilities well beyond a first role.

Where to find openings

Don't rely on a single channel. Junior roles get filled in several ways, and some never go through a public ad.

Company careers pages: draw up a list of around twenty target employers and check them regularly.
General and specialist job boards: search for precise titles ("SOC analyst", "junior GRC consultant") rather than "cybersecurity".
LinkedIn: as much to be found as to search. Our guide to building a cybersecurity LinkedIn profile explains how.
Work-study and internships: a successful work-study placement often leads to a job offer, and remains the most valued experience on a first CV.
Events: meetups, conferences, in-person CTFs, school job fairs. A ten-minute conversation is often worth more than an online application.
Specialist recruitment firms: they know which teams are willing to train and can present your profile beyond your CV.
Targeted speculative applications: sent to a specific team, with a clear reason, they work better than people think.

Reading a "junior" ad without losing heart

Many entry-level ads ask for two or three years of experience, a list of tools and several certifications. Don't stop at that list. A job description often mixes real requirements with a wish list.

To sort them out, ask yourself three questions:

Are the duties within my reach with some mentoring? If so, the experience requirement is probably negotiable.
What are the two or three essential prerequisites? Usually they are fundamentals (systems, networking, writing), not a specific tool.
Can I prove those prerequisites? A home lab, a work-study project or write-ups all count as evidence.

If you tick the essentials, apply. The worst that can happen is no reply.

Building an application that gets an interview

Ten careful applications beat a hundred identical ones. Each should show that you understood the role and that you can already do part of the work.

A CV built on evidence

Put forward what you have actually done: an Active Directory lab built and attacked, a documented log analysis, a configuration audit carried out during a work-study year. Our cybersecurity CV guide gives rewording examples, and our article on the cybersecurity portfolio explains how to present your work.

A short, precise message

A few lines are enough: the role you are applying for, why this team, one or two concrete pieces of evidence tied to the duties, your availability. Avoid generic letters that talk about "passion" without showing anything.

Organised follow-up

Keep a simple tracker of your applications: company, role, date, contact, next step. Follow up once, politely, after one or two weeks without a reply. Tracking keeps you from forgetting anything and shows you what works.

Preparing for each stage

Hiring for a first role often includes a call with HR, a practical exercise and a technical interview. Prepare for each.

The HR call: be clear about the role you want, your availability and your constraints (location, hours).
The practical exercise: more and more teams assess on a concrete case rather than a quiz. Our guide to preparing for a practical test helps you approach it calmly.
The technical interview: your reasoning matters more than memorised facts. Read our advice on acing a cybersecurity technical interview.

If a certification seems necessary to get past some filters, choose it according to the role you want: our article on certifications by role helps you prioritise.

Assessing an offer before you accept

Your first job shapes the next two or three years. An offer should be judged on much more than pay.

Mentoring: who will be your go-to person, and how much time can they give you?
Training: pairing, documentation, training budget, time set aside for learning.
Prospects: how do people progress in the team, and on what criteria?
Working conditions: hours, on-call duty, remote work, and how they are compensated.
The nature of the work: the share of repetitive tasks, and the chance to widen your scope over time.

First-job pay varies with region, sector, type of employer and on-call duties. Compare offers on all these criteria, and prepare the conversation with our guide to negotiating your cybersecurity salary.

The most common mistakes

Applying everywhere with the same CV and the same message.
Listing tools instead of describing what you can do.
Passing on an ad because it asks for two years of experience.
Overlooking work-study or adjacent roles (support, operations) that act as stepping stones.
Accepting an isolated role with no one to train you.
Stopping practice while you search: your recent work is your best material in interviews.

In short

A first cybersecurity job comes from a clear target, employers chosen for their ability to mentor, and applications that show concrete evidence. Spread your channels, prepare each stage of the process and judge offers on what they will teach you as much as on what they pay.

Looking for your first security role? Join the Cyber Recrut network for free: our shortlisted candidates prove their skills on hands-on labs, which lets a beginner stand out for what they can do, not just for the lines on their CV. See how we work.