When I started exploring cybersecurity more seriously, one question kept appearing:
Do you need a cybersecurity degree to actually work in cybersecurity?
It was relevant to me for a slightly different reason than it might be for someone leaving high school and deciding what to study.
I already have a degree in Information Technology.
I’ve worked in tech, web development and digital marketing. I’ve spent most of the last decade specialising in SEO. I’m now an SEO Manager, and I’m not planning to leave SEO tomorrow and suddenly announce myself as a cybersecurity professional.
I’m learning because I’m curious.
I want to understand more about the technology underneath the websites I’ve spent years optimising.
But the deeper I’ve gone into cybersecurity, the more I’ve wondered what the path would look like if I ever wanted to take it further.
Would my existing IT degree matter?
Would I need another degree specifically in cybersecurity?
Would certifications be enough?
What about someone trying to enter the field without any degree at all?
I don’t think there’s one answer that applies to everybody.
But I’ve learned enough so far to realise that “get a cybersecurity degree” isn’t the only path into the field.
I Already Had a Tech Background, but Cybersecurity Still Felt New
My degree is in Information Technology.
Before SEO, I worked in IT and web development.
So I wasn’t starting from zero.
I’ve spent years around websites, servers, DNS, HTTP, HTTPS, redirects, APIs, JavaScript, CMS platforms and technical problems.
Then I started learning cybersecurity and quickly discovered that recognising a term isn’t the same as understanding it deeply.
I knew what an IP address was.
Cybersecurity made me want to understand networking properly.
I’d worked with HTTPS for years.
Security made me think differently about what was actually happening underneath it.
I’d encountered Linux.
Now I wanted to become more comfortable using it.
I’d spent years looking at websites through the question:
“Can search engines access and understand this?”
Cybersecurity introduced another question:
“Who else can access this, and what could they do if something is configured incorrectly?”
Same internet.
Completely different lens.
My IT background helped.
It definitely didn’t make cybersecurity automatically easy.
A Cybersecurity Degree Can Obviously Be Valuable
I don’t want this article to become one of those:
“Degrees are useless! Just watch YouTube!”
posts.
I don’t believe that.
A good cybersecurity or computer science degree can give someone structured exposure to networking, operating systems, programming, databases, security principles, cryptography, risk, computer architecture and software development.
Depending on the programme, there may also be labs, projects, internships and opportunities to learn directly from people with industry experience.
University can also force you to study things you might avoid if you were teaching yourself.
That’s underrated.
When you’re self-learning, it’s very tempting to keep doing the fun stuff.
A structured programme sometimes says:
No. You’re learning this boring thing because you need the foundation.
Years later, the boring thing suddenly becomes useful.
I experienced some of that with my own IT degree. There are concepts I encountered years ago that I’m appreciating differently now because I’m looking at them through cybersecurity.
So I’m definitely not against degrees.
My question was whether a cybersecurity-specific degree is required.
That’s where things become more interesting.
Cybersecurity Doesn’t Seem to Have One Entrance
One of the first things I noticed while researching the field is how broad it is.
When we say:
“I want to work in cybersecurity.”
That could mean security operations, incident response, cloud security, application security, penetration testing, digital forensics, governance and risk, identity and access management, security engineering, threat intelligence or vulnerability management.
These aren’t all the same job.
They don’t necessarily require identical skills either.
Someone coming from software development might naturally move toward application security.
Someone with strong networking experience might move toward network security.
Someone from IT support or systems administration already understands users, permissions, devices and infrastructure.
Someone with auditing, compliance or risk experience may find a different route into security.
That changed the question for me.
Instead of asking:
“What qualification do you need for cybersecurity?”
I’ve started asking:
“What skills does this particular cybersecurity role actually require?”
That’s a much more useful question.
Certifications Were Another Route I Kept Finding
This is partly why I started with the Google Cybersecurity Certificate.
I wasn’t looking for another university degree.
I wanted a structured introduction to the field.
Something that could give me a map.
The certificate introduced areas such as security risks, networking, Linux, SQL, assets and vulnerabilities, incident detection and response, and Python.
It didn’t turn me into a cybersecurity expert.
I don’t think any beginner certificate can do that.
But it helped me understand the landscape.
That’s valuable when you’re starting because cybersecurity can feel enormous.
You hear:
SIEM.
SOC.
IDS.
IPS.
IAM.
EDR.
NIST.
OWASP.
CVE.
CIA triad.
TCP.
UDP.
And you’re sitting there thinking:
I thought we were just stopping hackers.
A structured beginner programme helped put some of those pieces into categories.
Then I Started Looking at Other Cybersecurity Certifications
Once you start researching cybersecurity, prepare yourself for acronyms.
There are certifications everywhere.
CompTIA Security+.
ISC2 Certified in Cybersecurity.
Cisco certifications.
Microsoft security certifications.
AWS security certifications.
Eventually, more advanced certifications such as CISSP appear.
At first, it’s tempting to think you need to collect them.
I don’t want to do that.
I’m trying to avoid turning cybersecurity learning into Pokémon:
Gotta catch ’em all.
A certificate should have a purpose.
What am I trying to learn?
What gap does this certification help fill?
Does it make sense for my current level?
Can I apply what I’m learning?
Those questions matter more to me than accumulating badges on LinkedIn.
The More I Learn, the More I Think Hands-On Practice Matters
This is probably the biggest shift in my thinking.
You can learn the definition of a firewall.
You can pass a quiz about it.
You can explain what it does.
Then somebody puts you in an environment and asks you to actually investigate network traffic.
That’s different.
The same thing happens with Linux.
Watching someone type commands in a tutorial makes perfect sense.
Then you open the terminal yourself.
Suddenly:
Permission denied.
Great.
Now we’re learning.
I’ve realised there’s a large gap between:
“I understand this concept.”
and:
“I can actually do this.”
That’s why I’m increasingly interested in labs and small projects.
Using Linux. Working with networking concepts. Looking at logs. Writing simple Python scripts. Understanding permissions. Investigating alerts. Breaking things safely. Fixing them. Documenting what happened.
That’s the part I don’t think a degree or certification can replace on its own.
This Reminds Me a Lot of SEO
I’ve seen something similar throughout my SEO career.
Someone can complete an SEO course.
They can tell me what a canonical tag is.
They know title tags.
They understand backlinks.
They’ve heard of Search Console.
Then I give them a real website.
Traffic has dropped 35%.
Some pages aren’t indexed.
There was a migration six weeks ago.
Analytics tracking changed.
Several redirects are wrong.
Google has just rolled out an update.
The client wants an answer by tomorrow.
Now we’re doing SEO.
Real work is messy.
Cybersecurity seems similar.
The certification gives you concepts.
The lab gives you controlled practice.
Then the real world gives you something that doesn’t look exactly like the tutorial.
That’s where experience starts becoming valuable.
What If You Don’t Have a Degree?
If someone messaged me and said:
“Chris, I don’t have a degree. Does that mean cybersecurity isn’t for me?”
I wouldn’t tell them to give up.
I’d tell them to look at the actual roles they’re interested in and investigate the skills those roles require.
Then build from the foundations.
Networking. Operating systems. Linux. Security fundamentals. Basic scripting. Common threats and vulnerabilities. Identity and access. Logs.
You might use structured courses, certifications, documentation, labs, books and community resources.
Whatever combination keeps you learning.
But don’t confuse consuming information with building skill.
At some point, you have to do something with what you’ve learnt.
The Job Description Problem
There’s another reason people become convinced they need a cybersecurity degree.
Job descriptions.
You find an “entry-level” cybersecurity role.
Bachelor’s degree required.
Three years of experience.
Security+.
CISSP somehow.
Knowledge of 47 security tools.
Ability to defend the entire internet.
Available weekends.
Probably able to fight Batman.
Close tab.
This reminds me of SEO job descriptions.
People often reject themselves before the employer gets the opportunity.
I wouldn’t do that.
If a cybersecurity position says a degree is preferred and you have strong relevant skills, certifications, projects and adjacent IT experience, I’d still consider applying.
Let the employer decide.
Obviously, there will be organisations and positions where specific educational requirements are genuinely mandatory.
But “preferred” and “required” aren’t always the same thing.
Read carefully.
Your Existing Career Might Be More Relevant Than You Think
This is something I’m discovering personally.
I initially thought about my SEO career and cybersecurity as two completely separate things.
They’re not.
Technical SEO has already made me comfortable investigating websites, status codes, DNS, HTTP headers, servers, CMS platforms, JavaScript, APIs, crawlers, log files, migrations, redirects, performance and bots.
These aren’t cybersecurity skills by themselves.
But they’re context.
More importantly, SEO has trained me to investigate weird things.
Traffic suddenly drops.
Why?
First, rule out tracking.
Then technical changes.
Then indexing.
Then rankings.
Then SERPs.
Then algorithm updates.
Then competitors.
Then seasonality.
You build hypotheses.
Check evidence.
Eliminate possibilities.
Keep investigating.
I’m still a cybersecurity beginner, so I’m careful not to pretend that diagnosing an SEO traffic drop is equivalent to responding to a security incident.
It isn’t.
But I recognise the mindset.
Something happened.
What changed?
When?
What evidence do we have?
What systems are affected?
What doesn’t fit the pattern?
That investigative thinking is one of the things attracting me to cybersecurity in the first place.
I’m Also Learning Python for the Same Reason
Python keeps appearing in both worlds I’m interested in.
SEO.
Cybersecurity.
Data.
AI.
Automation.
I’m not learning Python because I want to become a software developer.
I’m learning it because I don’t want:
“I don’t know how to code.”
to be the reason I can’t investigate something or build something useful.
Cybersecurity has given me another reason to continue.
Parsing data.
Working with logs.
Automating repetitive tasks.
Interacting with APIs.
Manipulating files.
Looking for patterns.
Understanding scripts other people have written.
I’m nowhere near where I want to be yet.
But that’s okay.
The goal isn’t to wake up tomorrow as a security engineer.
The goal is to keep expanding the toolkit.
So, Would I Go Back and Get a Cybersecurity Degree?
At this stage?
Probably not.
That’s a decision based on my situation, not universal career advice.
I already have an IT degree.
I already have years of professional experience in technology and digital work.
I’m not currently trying to abandon SEO and compete for an entry-level cybersecurity position.
For me, another bachelor’s degree probably isn’t the most useful next step.
I’d rather put that time into deeper networking knowledge, Linux, Python, security fundamentals, certifications where they make sense, hands-on labs and projects.
If I eventually decide to specialise much more deeply in cybersecurity, maybe my education decisions change.
That’s the nice thing about learning without needing to know exactly where it ends.
But If I Were 18 Again?
This is harder.
If 18-year-old Chris told me:
“I want to work in cybersecurity. Should I study it?”
I’d say university is absolutely worth considering.
But I’d also tell him something I wish more students understood:
Don’t wait for your degree to give you a career.
Build alongside it.
Learn Linux because you’re curious.
Create a home lab.
Learn some Python.
Understand networking.
Do beginner security labs.
Read incident reports.
Build small projects.
Document what you’re learning.
Apply for internships.
Talk to people already working in the industry.
Use the university environment to give yourself structure, then use your own curiosity to go beyond the curriculum.
Four years is a long time.
Imagine graduating with four years of small experiments behind you instead of beginning your practical learning at graduation.
I Don’t Think the Real Question Is Degree vs Certification
That’s where I’ve landed so far.
People love turning career decisions into binary choices.
Degree or certifications?
University or self-taught?
Theory or practical experience?
I don’t think careers work that neatly.
A degree can give you foundations.
Certifications can give you structured learning around specific areas.
Labs can give you practice.
Projects can give you evidence.
IT experience can give you context.
Programming can expand what you’re able to build.
Communication skills can help you explain what you’ve discovered.
You don’t necessarily choose one.
You build a stack.
And everybody’s stack can look slightly different.
Cybersecurity Seems to Reward People Who Keep Learning
This might be the thing cybersecurity and SEO have most in common.
You never really finish.
Technology changes.
Threats change.
Tools change.
AI changes things.
New vulnerabilities appear.
New defensive approaches emerge.
The moment you decide:
“I know cybersecurity now.”
is probably the moment the industry finds a new way to humble you.
SEO has already prepared me for that feeling.
Google has been doing it to us for years.
So I’m comfortable with the idea that learning cybersecurity isn’t about reaching a point where I know everything.
I just want to know more tomorrow than I know today.
Do You Need a Cybersecurity Degree?
From everything I’ve learned while exploring the field, I don’t think there’s a simple yes or no answer.
A cybersecurity degree can be valuable. For some roles and employers, it may be required or strongly preferred.
But it isn’t the only thing that matters.
Your existing experience, certifications, practical skills, projects and technical background can all become part of the path.
For me, the biggest lesson has been that there isn’t one perfect route into cybersecurity.
Maybe one day cybersecurity will become a much bigger part of my career.
Maybe it simply makes me a more technically capable SEO.
Maybe it takes me somewhere I haven’t considered yet.
I don’t need to know that today.
A degree can open doors. A certification can give you direction. Experience can give you context. Hands-on practice can turn knowledge into ability.
And curiosity?
That’s what gets you to start in the first place.
