I do not have a computer science degree. I studied journalism.

Twenty-five years later, I secure Microsoft 365 environments for companies, at rates I once assumed were fictional and certainly unavailable to a journalism graduate.

So when someone asks whether they need a degree for this field, the answer has two parts. You do not need one. And without one, you have to prove cybersecurity skills without a degree vouching for you, which is a harder problem than most career advice admits. This article is about how that proof actually works.

The short answer

No. You do not need a degree to work in cybersecurity.

This is not a private theory. It is one of the few areas of IT where an employer looks first at what you can actually do, and only afterward - or not at all - at what qualification you hold.

But "you do not need a degree" is not the same sentence as "you do not need anything". You will need something. It is just something different.

Three situations where a degree genuinely helps

To be fair, there are cases where a degree makes a real difference, and it would be dishonest to pretend otherwise.

Large corporations and the public sector. Here a degree is sometimes a hard requirement in the posting. Not because it makes you better at the job - because HR has a checklist, and without the qualification your CV does not pass the first automated filter. That is a real, mechanical barrier, and no amount of skill gets you past a form field.

You are 19 with no experience and no direction. A degree gives you structure, peers in the industry, time to experiment, and a first line on your CV. That has genuine value.

Narrow specialisms. Cryptography, research, deep engineering. A solid academic foundation is a real advantage there.

But be honest about the size of that last category. It is maybe 5 percent of the market. Most of us are not writing encryption algorithms. We configure, we monitor, and we put out fires.

So if you are young with time and money, a degree will not hurt you. The problem starts when you treat it as an entry ticket you are not permitted to start without. That part is simply false.

How to prove cybersecurity skills without a degree: three things employers check

Three things, in my experience of both hiring and being hired.

1. Evidence that you can do it

A certification you genuinely passed. A home lab you built yourself. A project on GitHub. A LinkedIn post where you explain a topic clearly.

Anything that demonstrates: this person does things, rather than only talking about them.

The format matters less than the existence. What you are trying to defeat is the recruiter's reasonable suspicion that you have consumed a lot of content and produced nothing.

2. The ability to learn faster than the industry changes

In cybersecurity you are never "trained". Every week brings a new attack technique, a new vulnerability, a new tool, a new vendor change you did not ask for.

A degree from ten years ago does not keep up with that. A habit of continuous learning does. Employers who have been burned by the first kind of candidate look specifically for the second.

3. The ability to explain difficult things in plain language

Here is the part that surprises people, and it is the reason I mention journalism at all.

A client does not want to hear about attack vectors or CVE scores. They want to know whether their company is safe and what it will cost.

Translating complexity into plain language is exactly the skill I brought out of journalism into a field that supposedly had nothing to do with it. A degree that "wasted" four years on the wrong subject handed me an advantage most engineers do not have.

Whatever you did before this - support, sales, teaching, logistics, healthcare - there is a version of that skill you can carry across. Your old experience is not wasted time.

And one related skill worth naming separately: the ability to sell yourself as an expert. I know a substantial number of people I consider genuinely excellent specialists who have no idea how to position themselves as someone worth betting on. That is a learnable skill and it is worth the investment.

Two minutes today: open two or three "junior SOC analyst" or "junior security" postings in your market and read the requirements. I would bet that next to the word "degree" you find "desirable", not "required".

The self-taught trap

Now the warning, because I do not want you leaving with the impression that wanting it is enough.

The route without a degree has one specific trap. Since no qualification vouches for you, the entire burden of proof sits on your side. A self-taught person with nothing to show is invisible to a recruiter, and invisible is worse than underqualified.

A degree says: someone checked me.

Without one, you have to say: check me yourselves. Here is my lab. Here is my certification. Here is a problem I solved and how. Here is where I placed in a CTF.

Capture-the-flag competitions deserve a mention here - they are a genuinely good and slightly underrated way to point some light at yourself, because the results are public and verifiable.

The worst possible strategy is spending two years on video courses and leaving behind not a single trace. Without a degree and without evidence, you do not exist to a recruitment process. With evidence, you exist even without the paper. That is the entire difference.

How it actually went for me

I studied journalism and - fortunately or unfortunately - realised fairly quickly that it was not my path.

My "bootcamp" was this: I bought a thick book about Exchange Server. That book got me a foothold in an IT department as the person who does everything.

After that came a more or less conscious strategy. Build a portfolio. Build skills. Develop as an IT person who gradually moves his interests toward security and cloud, because that is where the priority is. Sysadmin, then engineer, then architect, then my own consultancy.

If I had decided back then that without a computer science qualification there was no point even trying, I would be doing something entirely different today. That is the best evidence I can offer you.

Bottom line

A degree opens some doors. Skills and evidence are what keep them open.

You do not need permission to start. To prove cybersecurity skills without a degree you need traces - a lab, a certification, a solved problem, a post that explains something clearly. Start leaving them this month.

If you are wondering what the work itself looks like, read what a cybersecurity specialist actually does all day. And if the worry is age rather than qualifications, see "Cybersecurity Career Change After 40."

📧 I write weekly about M365 security for SMBs - join the newsletter on LinkedIn → https://www.linkedin.com/in/tomasz-szulczewski/