A friend of mine cleared his Class 12 boards with a 72%. Not bad — but definitely not "IIT dream" territory. His parents wanted him to repeat for JEE. He had other plans. Eighteen months later, he's working as a junior penetration tester at a Bengaluru cybersecurity firm, earning just above ₹9 LPA. No degree. Just certifications, a portfolio of CTF write-ups, and one very convincing interview.

Cybersecurity in India is one of the only technical fields right now where skills genuinely outrun credentials — where a 19-year-old with the right certificates can sit across from a CS graduate and be hired first. Here's exactly how that happens, and what the path looks like if you start today.

---

Why Cybersecurity Hires Differently Than Most IT Fields

Most Indian IT companies — TCS, Infosys, Wipro — have strict degree requirements for entry-level hiring. Cybersecurity teams at those same companies, and at banks, startups, and dedicated security firms, operate very differently. They're hiring for skills they can verify: Can you find a vulnerability? Can you write a clear report? Can you think like an attacker?

These are things you can demonstrate with certifications and a GitHub/blog portfolio. You cannot fake them with just a degree. That's why cybersecurity hiring managers across India — especially at firms like Lucideus, Sequretek, and TAC Security, and the security divisions of banks like HDFC and Axis — have been openly hiring non-degree candidates for years, as long as they have the right certs and a provable track record.

Cybersecurity roles in India are skills-first. Your GitHub matters more than your marksheet at interview time.

---

What Roles Actually Exist at Entry Level

The field isn't just "hacker." Here's what freshers in India are actually getting hired for in 2026:

• SOC Analyst (Security Operations Centre) — Monitor network alerts, triage incidents. Most common entry point. Heavily hiring.
• Penetration Tester (Junior) — Find and report vulnerabilities in client systems. Requires more skill but higher pay ceiling.
• Security Analyst — Broader role: risk assessment, compliance, incident response. Good for people who like structure.
• Bug Bounty Hunter — Freelance-first. Find bugs in companies' systems legally and get paid per bug. Can start at 16.
• Threat Intelligence Analyst — Research and report on attacker groups and malware campaigns. More research-oriented.

---

The Certification Roadmap — Start Here, Go There

The key is to not chase every certification. The field has a confusing number of them, and beginners waste months studying for the wrong one. Here is the sequence that makes sense if you're starting from zero at 17–18:

*eJPT is often recommended over CEH for practical learners — it tests real skills, not just theory. OSCP is the gold standard but save it for after your first job.

Alongside certifications, spend serious time on free platforms. TryHackMe and Hack The Box are the two most used practice environments in the world — both accessible to Indian students with a laptop and internet connection. TryHackMe is more beginner-friendly; Hack The Box is more competitive. Use both.

TryHackMe has guided learning paths specifically for beginners — free tier is generous enough to build real skills.

---

Building a Portfolio Before You Have a Job

This is the part that separates people who get hired from people who don't. Hiring managers in cybersecurity ask to see proof of work. The best forms of proof are CTF (Capture the Flag) write-ups, bug bounty reports, and a GitHub showing your scripts and tools.

CTFs are hacking competitions where you solve security challenges and earn "flags." They're free, legal, and run by organisations like CTFtime.org constantly. Write up your solutions clearly and post them on a blog (Medium or your own site). Three or four good write-ups can genuinely replace a degree in the eyes of a technical interviewer.

---

The Degree Question — Honest Answer

Should you skip college entirely? Probably not. Here's the nuanced version: a college degree — even a BCA or B.Sc. IT from a state university — helps with certain hiring pipelines, especially government and PSU roles, and with H-1B visa processes if you want to work abroad later. It also gives you time to build your skills while you have a structured environment.

But a degree is not mandatory to get your first cybersecurity job in India in 2026. The proof is in active job boards: filter for "SOC Analyst" or "Ethical Hacker" roles on Naukri or LinkedIn and you'll find numerous listings that say "12th pass with CEH/Security+ considered." That wasn't true five years ago. It is true now.