Skip to content

If You Want to Take It Further

A university degree isn't required to start learning cyber security.

There are several routes, roughly ordered below by how much they're actually likely to get you working sooner, for less money and less time — not by prestige.

None of this is telling you what you should do. Everyone's path looks different, and there's no single required order here — this also isn't written by someone whose job is hiring people. It's just an honest opinion on what's actually worked, for what that's worth.

One real path, for context — not the only one

A school-based apprenticeship, still in high school, over 20 years ago. Then a TAFE traineeship into a small IT shop → Certificate IV in IT → a stint doing IT in schools → MSP land → service desk → cyber security for the last 2.5 years. First industry certification landed 9 months into the cyber role, not before it. No degree anywhere in that chain — just curiosity, held for two decades.

TAFE / VET — the best bang for buck for most people

TAFE and other vocational providers offer shorter, cheaper, more practical pathways into IT and cyber security than a degree, and for the vast majority of hands-on roles this site is aimed at — SOC analyst, IT support, sysadmin, service desk, junior security — that's genuinely all you need to get a foot in the door. Locally, Bendigo TAFE and GOTAFE both run IT and cyber-related courses. A traineeship (working while studying) is often the fastest and cheapest version of this route.

Victorian Government Cyber Internship Program

Build your cyber career with the Victorian Government

Worth calling out on its own: this is a real, walked pathway, not just a link on a list. A previous work experience participant went on to complete a Certificate IV in Cyber Security and is now working in the Cyber Incident Response Service at the Department of Government Services.

The program is part of the Free TAFE initiative — it takes recent Certificate IV in Cyber Security graduates and places them working alongside Victorian Government cyber teams in one of several streams: incident response, cyber awareness and education, threat intelligence, GRC, or security operations. Expressions of interest open periodically (they're not year-round), so check the page above for current dates rather than assuming it's always open.

If you're weighing up whether TAFE is "worth it" compared to jumping straight into a job, this is a concrete answer: TAFE plus this internship is a genuine, funded route from "no experience" to "working in cyber for the Victorian Government" in a relatively short timeframe.

If you want a certification too

Build Evidence, Not Certificates is the philosophy on this site, and it still stands — a portfolio beats a wall of certificates. But a couple of entry-level certs genuinely help get an application noticed, especially with zero professional experience to point to yet. There's no rush on this — plenty of people (see above) land the role first and pick up their first cert well after starting, once they know which direction they're actually headed.

  • CompTIA A+ — not a security cert at all, it's general IT. But it's a solid "jack of all trades, master of none" starting point that signals you understand how a computer actually works, which is exactly the foundation Get the Foundations is built on.
  • CompTIA Security+ — the standard entry-level security cert, widely recognised and often literally listed as a minimum requirement in junior security job ads.
  • ISC2 Certified in Cybersecurity (CC) — a genuinely free entry-level cert from a major industry body, worth doing purely because of the price.
  • Microsoft SC-900 — useful specifically if you're heading toward a Microsoft-shop environment (which is most Australian workplaces), covers security, compliance and identity concepts at a foundational level.

Pick one, not all four. Then go build the evidence to back it up.

Cloud security and GRC — a starting point

Career Paths lists Cloud Security and GRC as directions worth exploring, but neither gets covered elsewhere on this site — that's a gap, not a judgement on either one, just outside what's been personally walked. Here's a genuine starting point for each instead of nothing.

Cloud security

flAWS.cloud is a free, gamified set of challenges built around real AWS misconfigurations — no prior cloud experience assumed. (It's really served over plain http, not a broken link — part of the site's own lo-fi charm.) Once that's comfortable, flAWS 2 goes further into serverless and container security, split into an attacker path and a defender path. Between the two, it's a genuinely good hands-on introduction to what cloud security actually involves day to day — the cloud equivalent of Build Your Own Lab.

GRC (Governance, Risk and Compliance)

The ACSC's Information Security Manual (ISM) is the Australian government's actual cyber security framework — free, official, and the closest thing to watching GRC work in practice instead of reading about it in the abstract. It pairs well with the Essential Eight: the ISM is the detailed rulebook, the Essential Eight (soon the Essentials series) is the prioritised subset most organisations actually start with.

This section is thin, and that's known

Both of these are a starting point, not a real pathway — actively looking for someone with genuine Cloud Security or GRC experience to build this out properly. If that's you, get in touch — until then, treat this as "better than nothing," not "figured out."

Industry organisations

Cheap or free, and useful for the networking side covered in Find Your People:

AISA — Australian Information Security Association

ACS — Australian Computer Society

And don't underestimate the value of building skills outside formal education generally.

University — usually a later-career move, not a starting one

For most of the roles this site is aimed at, a degree isn't the thing standing between you and a first job — TAFE, evidence and a foot in the door usually get there faster and cheaper. Where a degree tends to matter more is further up the chain: moving into architecture, leadership, policy or specialist research roles later on, some of which do expect one. If and when that's actually the direction you're heading, worth knowing what's on offer locally:

  • La Trobe University (Bendigo) — Cyber Security / IT
  • Deakin University — Cyber Security
  • RMIT University — Cybersecurity
  • Federation University — Cyber security programs
  • Other universities across Australia offer cyber security, computer science and related degrees

Paper over skills has never been the way to bet, whichever route gets you there: one good operator beats ten sheets of paper and no skills, any day.