Certifications (ISC2 CC, Security+) and Cybersecurity Careers | Free Cybersecurity Course: Protect Your Data, Devices and Business

What you'll learn

The main entry-level cybersecurity roles and what each one does day to day.
What the U.S. job market looks like, according to the Bureau of Labor Statistics.
How ISC2 Certified in Cybersecurity (CC) and CompTIA Security+ compare in 2026, including the new Security+ V8.
How to build a realistic study plan and hands-on experience, legally and ethically.
How to get your free certificate for completing this course.

Cybersecurity is a broad field with room for very different people: analysts who love puzzles, communicators who turn risk into plain English for executives, engineers who build secure systems and detail-oriented people who keep compliance on track. The usual entry path combines foundational knowledge (which you've built in this course), one entry-level certification, hands-on practice in a home lab and a first job in IT or security operations. This final lesson maps the roles, compares the two most popular starter certifications with their 2026 details and helps you plan your next 90 days.

$129,180median annual pay for information security analysts in May 2025 (U.S. Bureau of Labor Statistics)

21%projected job growth for the occupation from 2025 to 2035, "much faster than average"

≈14,100openings projected each year, on average, over that decade

Explore the roles
Understand the market
Choose a certification
Build real experience
Plan your next 90 days

Entry-level roles and where they lead

SOC analyst (tier 1)

Monitors alerts in a security operations center, triages them and escalates real incidents, exactly the work from lessons 13 and 14.

Leads to: incident responder, threat hunter, detection engineer.

GRC analyst

Governance, risk and compliance: risk registers, policies, vendor reviews, audits against frameworks like NIST CSF (lessons 9 and 10).

Leads to: risk manager, privacy or compliance lead, security manager.

IT support with security duties

Help desk or systems roles that handle MFA, access requests, patching and device management (lessons 7 and 12).

Leads to: systems or cloud administrator, security engineer.

Junior security or cloud engineer

Configures firewalls, identity, logging and cloud security settings (lessons 6, 11 and 15).

Leads to: security architect, application or cloud security specialist.

You may also hear about penetration testers and red teams, who attack systems with written authorization to find weaknesses before criminals do. It's a real career, but most people reach it after years in defensive or IT roles, and it's always performed under contract and clear rules of engagement.

The U.S. job market in numbers

The Bureau of Labor Statistics groups many of these jobs under "information security analysts." Its latest data shows a median annual wage of $129,180 in May 2025 (about $62.11 an hour), roughly 192,900 jobs in 2025 and projected growth of 21% from 2025 to 2035, with about 14,100 openings a year on average. BLS lists a bachelor's degree as the typical entry-level education, plus some experience (under five years) in a related role, often in IT. Keep in mind that a median describes the middle of the whole occupation; entry-level salaries are lower and vary a lot by city, industry and clearance requirements.

1. According to BLS, what is the typical path into an information security analyst job?

A bachelor's degree in a related field plus some experience in a related occupation, often in IT
No education or experience; a certification alone is enough
A doctorate and 10 years of experience

BLS lists a bachelor's degree as typical and less than five years of related work experience, frequently in IT roles such as network or systems administration. Certifications help you stand out and show baseline knowledge.

ISC2 CC vs. CompTIA Security+ in 2026

These are the two most common first certifications. The details below were checked in November 2026; prices and formats change, so confirm on ISC2's and CompTIA's websites before you register.

ISC2 Certified in Cybersecurity (CC)Foundational, no experience required

Exam: About 2 hours; 100–125 adaptive (CAT) questions; scaled passing score of 700 out of 1,000; taken at Pearson VUE test centers.
Cost: $199 exam fee in the U.S., plus a $50 annual maintenance fee once certified.
Content: New outline effective September 1, 2026, with five domains.
Ideal if: You're new to the field and want a recognized first credential.

First step

CompTIA Security+Widely requested in job postings

Exam: Up to 90 questions (multiple choice and performance-based) in 90 minutes; passing score of 750 on a 100–900 scale.
Cost: $439 list price for a U.S. voucher after CompTIA's 2026 price increase.
Content: V8 (SY0-801) launches on or around November 17, 2026; SY0-701 stays available in English until June 11, 2027.
Ideal if: You have some IT experience or want roles that require it, including many U.S. Department of Defense positions under DoD 8140.

Job-market standard

What's on each exam

The updated CC outline (effective September 1, 2026) has five domains: Security Principles; Security Governance; Identity and Access Management (IAM) Concepts; Networking and Cloud Security Concepts; and Security Operations and Incident Response. Every one of them maps to lessons you've completed.

Security+ V8 (SY0-801) is organized into five weighted domains. CompTIA recommends the equivalent of a security administrator with two years of hands-on experience:

Security+ V8 (SY0-801) domain weights

Security Operations27%

Threats, Vulnerabilities and Attacks24%

Security Architecture19%

General Security Concepts16%

Program Management and Oversight14%

About ISC2's free CC program

For several years, ISC2's "One Million Certified in Cybersecurity" initiative offered free CC training and exams. ISC2 has concluded the program: it closed to new enrollments on May 20, 2026, and people who already hold unexpired exam codes can use them through December 31, 2026. If you enrolled, schedule your exam soon.

2. What is the passing score for the CompTIA Security+ exam?

700 on a 0–1,000 scale
750 on a 100–900 scale
80% of questions correct

Security+ uses a scaled score from 100 to 900, and 750 passes. ISC2 CC uses a different scale: 700 out of 1,000.

Which one first?

Completely new to IT? Start with CC: it's cheaper, needs no experience and builds confidence. Then work toward Security+.
Already in IT support or networking? Go straight to Security+; it's the certification most often named in U.S. job postings for entry-level security roles.
Later on: CompTIA CySA+ for analysts, cloud provider security certifications, and ISC2's CISSP for experienced professionals (it requires five years of cumulative paid work experience in its domains, with a one-year waiver for some degrees).

Building real experience, legally and ethically

Employers want to see that you can do the work, not just pass a test. You can build evidence at home:

Home labBuild a small defensive labRun virtual machines on your own computer, harden a Windows and a Linux system, set up a firewall and send their logs to a free SIEM.
PracticeInvestigate safelyUse blue-team challenges and intentionally vulnerable training environments built for learning, and practice reading logs and triaging alerts.
PortfolioWrite it upPublish short write-ups: "How I hardened my home router," "Triage of a simulated phishing alert," a sample risk register or incident response plan.
CommunityVolunteer and connectHelp a nonprofit or a family business with the 90-day plan from lesson 9; join local security meetups and ISC2 or ISACA chapters.

The one rule you can't break

Only test systems you own or have explicit written permission to test. Scanning or accessing other people's systems without authorization can violate the federal Computer Fraud and Abuse Act and state laws, no matter how good your intentions are. Ethics is part of every security certification, and employers check for it.

3. A friend asks you to "check how secure" his employer's website is as a favor. What's the right response?

Run a quick scan; it's harmless if you don't change anything
Test it from a coffee shop so it can't be traced
Decline unless the website's owner provides written authorization that defines exactly what you may test

Testing without the owner's written authorization can be illegal, even with good intentions. Your friend doesn't own the site; the employer must authorize it formally.

Your study plan

Consistency beats cramming. A realistic plan for a working adult:

Goal	Hours per week	Weeks	Total hours
ISC2 CC (after this course)	6	8	48
Home lab and first two write-ups	8	4	32
Security+ preparation	8	10	80

Use the official exam outline as your checklist: rate yourself on every objective, study the weakest ones first and take timed practice tests in the final two weeks.

4. You estimate you need 80 hours to prepare for Security+, and you can study 8 hours a week. How many weeks should you plan?

10 weeks
8 weeks
12 weeks

80 ÷ 8 = 10 weeks. Add a buffer week for life getting in the way, and book the exam date once you're consistently passing practice tests.

Common mistakes

Collecting certifications without hands-on practice.

Pair each certification with a lab project you can explain in an interview.

Skipping IT fundamentals to jump straight to "hacking."

Networking, operating systems and identity are the foundation of every security role.

Applying only to jobs with "security" in the title.

Help desk, system administration and cloud support roles are common stepping stones.

Studying from outdated material.

Check the exam code and outline version before you buy any book or course.

Practice exercise

Marisol is a 32-year-old retail store manager in San Antonio with strong people skills, no IT job experience and about 7 hours a week to study. She just finished this course. Build her 90-day plan with total hours, a certification choice and two portfolio projects, and suggest a target role.

See solution

Weeks 1–8: ISC2 CC preparation at 6 hours a week = 48 hours. Schedule the exam for week 9.
Weeks 9–12: home lab at 8 hours a week = 32 hours: harden a virtual Windows machine, centralize its logs in a free SIEM and write up two projects: (1) a phishing alert triage walkthrough, (2) a 90-day security plan and risk register for a fictional retail store, scored with the checklist template.
Total: 48 + 32 = 80 hours over 12 weeks, about 6.7 hours a week, within her 7-hour budget.
Target roles: IT help desk with security duties, or a junior GRC or security awareness role, where her management and communication experience is a genuine advantage. Security+ comes next, while she works in her first role.

Summary

Entry roles include SOC analyst, GRC analyst, IT support with security duties and junior security or cloud engineer.
BLS reports a $129,180 median wage (May 2025) and 21% projected growth from 2025 to 2035 for information security analysts.
ISC2 CC is the no-experience starting point; Security+ is the job-market standard, with V8 launching in November 2026 and SY0-701 available until June 11, 2027.
Build proof of skill with a home lab, write-ups and volunteering, and only test systems you own or are authorized to test.
Plan your study in hours per week and follow the official exam outline.

Congratulations: you've completed the course!

You started with the CIA triad and finished able to secure your own accounts and devices, build a small-business security plan, score risks, read the OWASP Top 10, manage access, triage alerts and lead an incident response. That's a solid foundation for protecting yourself, your family and your workplace, and for starting a career in the field.

Get your free certificate: create a free account (or log in), mark each lesson as completed, and download your certificate of completion from your account once all 16 lessons are marked. Keep the cybersecurity checklist template too; re-scoring it every quarter is the easiest way to keep improving.

Ready for what's next? Browse all our free courses to keep learning.