How degrees, certifications, projects, and apprenticeships fit together.
When I moved from dispatching tow trucks into a COBOL apprenticeship at CSAA, I did not enter technology through the doorway people now imagine.
I did not have a computer science degree. I did not have cybersecurity certifications. I did not have a polished portfolio filled with technical projects.
I had an opportunity, an ability to learn, and people who were willing to train me.
That beginning eventually led to a long career in technology, including several years at Proofpoint. The technologies changed enormously over that time, but the qualities that allowed me to move forward remained surprisingly consistent: curiosity, problem solving, communication, reliability, and the willingness to keep learning.
That is why I become uncomfortable when students are told that there is only one legitimate route into cybersecurity.
A degree can be valuable. For some positions it is strongly preferred, and for others it may be required. But a degree is not the only way a person can show potential or build skills that employers need.
The better question is not simply, “Do I need a degree?”
The better question is:
What evidence will convince an employer that I can do this work—or that I can learn to do it?
Why the Answer Is So Confusing
The Bureau of Labor Statistics says information security analysts typically enter the occupation with a bachelor’s degree and related experience. But the same government guidance also acknowledges that some people enter with a high-school diploma, relevant training, certifications, or experience in another area of information technology.
What does that mean in practical terms?
It means there is no single hiring standard across the entire cybersecurity field.
One employer may use a bachelor’s degree as an initial screening requirement. Another may care more about networking experience, a certification, or several years of systems support. A Registered Apprenticeship may be designed specifically for someone who does not yet meet the usual requirements for a full analyst position.
The role matters just as much as the employer.
The government’s NIST framework currently breaks cybersecurity work into 41 distinct Work Roles. That means a role in advanced security engineering has completely different expectations from a role in technical support, defensive monitoring, or user-access administration.
Asking whether cybersecurity requires a degree is a little like asking whether healthcare requires a degree. The answer depends on which job you mean.
The Field Is Growing, but Entry Is Not Automatic
The Bureau of Labor Statistics projects that employment for information security analysts will grow by 29 percent between 2024 and 2034.
That is a strong number. It confirms that organizations expect to need more people who can protect systems and information.
But it does not mean every beginner will walk directly into a cybersecurity analyst job.
Many of those positions still require related experience. Some employers want applicants who have already worked with networks, systems, users, or business operations. Others want proof that a candidate can handle confidential information and make careful decisions.
Students should feel encouraged by the growth of the field, but they should not be misled by it.
Demand creates opportunity. It does not eliminate preparation.
What a Degree Can Give You
A good college program can provide a broad foundation.
Students may learn networking, operating systems, programming, databases, security principles, risk management, communication, and analytical thinking. They may also gain access to internships, faculty guidance, alumni networks, and employers that recruit directly from the school.
A degree can be especially useful for a student who wants to keep several technology pathways open or pursue employers that routinely require a bachelor’s degree.
But a degree has limits too.
Graduation alone does not prove that someone can investigate a security alert, write a clear incident note, explain a risk to a manager, or work calmly when the answer is uncertain.
Those abilities usually develop through projects, labs, internships, apprenticeships, and employment.
That is why we never frame the decision at Quan Pathways as college or skills.
A strong college pathway includes practical experience. A strong nontraditional pathway still requires serious learning.
The real goal is to combine knowledge with evidence.
What Certifications Can—and Cannot—Prove
Certifications can help a beginner organize their learning and demonstrate familiarity with a defined body of knowledge.
They can also help a résumé survive an initial screening when an employer specifically names the credential.
But a certification should not be treated as a guaranteed admission ticket into cybersecurity.
Passing an exam proves that a person was able to learn and recall certain material. It does not automatically prove they can apply that material inside a real organization where the information is incomplete, the systems are complicated, and mistakes affect other people.
A certification becomes much more persuasive when it is connected to something the student has actually done.
Someone might build and document a home network, analyze sample logs, perform a basic security review, write an incident report, or create a small lab that shows how access controls work. A student might also use those skills during an internship, apprenticeship, volunteer assignment, or entry-level technology job.
CISA’s résumé guidance makes this point very clearly. It advises candidates not to simply list a tool, database, or programming language. Applicants should explain how they used it, what problem they were trying to solve, and what result they helped produce.
In other words, “I know Python” is weaker than, “I used Python to automate the review of repetitive log data and documented the results.”
The tool matters. The application matters more.
Experience Does Not Have to Begin in Cybersecurity
One of the most discouraging parts of an entry-level job search is seeing postings that ask for previous experience.
Students naturally wonder how they are supposed to gain experience when employers already expect them to have it.
The answer is partly to think more broadly about what counts.
Many cybersecurity professionals begin in related information technology jobs. They may work in technical support, networking, systems administration, cloud operations, or software development before moving more directly into security.
That makes sense because cybersecurity is built on top of systems, networks, applications, users, and business processes.
A person who has supported employees, managed user accounts, solved network problems, documented incidents, or administered systems may already understand part of the environment that security teams are trying to protect.
Even experience outside technology can carry useful signals.
Someone who has handled confidential records, followed regulated procedures, investigated discrepancies, worked with anxious customers, or remained calm during emergencies may already have habits that matter in cybersecurity.
That person still needs technical preparation. But they are not starting from nothing.
My own experience as a dispatcher did not look like the first chapter of a technology career. Yet it taught me how to communicate clearly, respond when people needed help, and take responsibility for the information I was handling.
The apprenticeship added the technical pathway.
Where Apprenticeship Fits
A Registered Apprenticeship brings together learning, employment, and experience.
The apprentice is paid, receives structured workplace training, works with a mentor, completes related instruction, and earns a recognized credential.
The practical advantage is that the student is not waiting until the end of training to begin becoming employable. The person is already learning inside a real job.
This can be especially valuable for someone who has ability and motivation but does not yet have the conventional résumé an employer expects.
Over time, the employer sees how that person learns, communicates, responds to feedback, and handles responsibility. The apprentice also gains something many beginners struggle to obtain: credible evidence of workplace performance.
An apprenticeship is not a shortcut around learning.
It is a different and often very effective structure for learning.
How We Help Students Choose a Path
Here at Quan Pathways, we tell students to begin with the work they want to do, not with the credential they think they are supposed to collect.
A student who enjoys investigating suspicious activity may be drawn toward defensive security or incident response. Someone who likes solving user and system problems may begin in technical support or systems administration. Another student may be more interested in risk, policy, compliance, or identity management.
Once the student has a direction, the next step is to study real postings.
What requirements appear repeatedly? Which qualifications are truly required, and which are merely preferred? Do employers want a degree, a certification, related experience, knowledge of particular tools, or some combination?
Then the student can build a pathway that produces real evidence.
For one person, that may mean community-college courses, a focused certification, several documented projects, and an apprenticeship. For another, it may mean a bachelor’s degree combined with internships and practical labs. A career changer may begin with an adjacent IT role and use existing industry knowledge to move toward security.
There is no single correct combination.
There is only the combination that gives a particular student enough knowledge, experience, and proof to become credible for the role they want.
Our View
We would never tell a young person that college does not matter.
We would also never tell that person that a degree is the only proof of ability.
Cybersecurity needs people who can learn, exercise judgment, communicate clearly, and understand that protecting systems is a business responsibility—not merely a technical puzzle.
A degree can open doors.
A certification can show preparation.
Projects can demonstrate initiative.
Related work can prove reliability.
An apprenticeship can connect all of those pieces through real employment and mentorship.
The strongest candidate is not automatically the person with the longest list of credentials. It is the person who can show a believable progression from learning, to application, to responsibility.
My career began because someone looked beyond my title and considered what I could become.
At Quan Pathways, we help students build that same kind of credible beginning.
We do not push every student toward the same doorway. We help each student identify the right one—and arrive with enough real evidence to be taken seriously.
Compare education, eligibility, and applicant next steps in our reviewed cybersecurity apprenticeship directory.
Research reviewed August 5, 2026. Hiring requirements vary by role and employer and should be checked against current job postings. Send us a correction.