“No experience” means one thing to the applicant and another to the person hiring. To you it means no security job. To them it means no IT job of any kind, and almost nobody gets hired from there. I have worked a help desk and sat the overnight shift in a SOC, and most of the analysts I shared a floor with came in through a side door.
What a tier 1 analyst does all day
You sit in front of a queue. Alerts land in it from a SIEM, an endpoint agent, the mail gateway and the identity provider, each with a severity somebody else assigned. You take the next one, decide what it is, and close it with a code the team can trust. That might be a sign-in from two countries an hour apart, or a flagged process on a laptop. The one after it is a phishing email one user reported, and now you have to find out who else got it.
Most of the queue is nothing. A VPN that made a login look like impossible travel, an admin running a script that resembles malware. The skill is clearing the nothing fast and still catching the one that is real. You pull the sign-in history, the process tree, the IP’s reputation and the mail headers, and you write what you found in a note the next shift can read. Anything above your access goes up; a password reset goes down to the help desk.
The four routes in
Help desk first is the common one, and the one I would pick again. A year or two on a service desk teaches you how accounts, mail, endpoints and networks fail, which is the raw material of alert triage. You already know what a locked account looks like from the inside and how to talk to a user who is sure they did nothing wrong. The SOC is testing for exactly that, and the help desk pays you to learn it. The timing of the move from help desk into a SOC has its own post.
The cert route works when the cert matches the job. Security+ is what the filter wants on an entry posting, and CompTIA’s own store lists the voucher at $439 as of mid-2026. It proves vocabulary, which gets you a phone screen. BTL1 and CySA+ sit closer to the work, because both put you in front of logs. Which of the three to sit depends on where you start. Sitting all three before you apply is a way of putting off the applications.
Labs and a home SIEM are the route when the help desk will not have you either. Stand up free Splunk or Elastic on an old PC, forward logs from a couple of VMs, then do things to those VMs and find them in the logs. Work through the LetsDefend and TryHackMe SOC paths. Afterward you will have opinions about alerts, which is what an interviewer listens for.
The direct hire out of school or a bootcamp exists. I have seen it twice. Both had a referral, and one had a lab they could talk about for forty minutes. Plan for the other three.
What the hiring manager screens for
The resume filter checks for Security+ or an equivalent, any IT work, and the posting’s nouns. The human who reads it next checks whether you have looked at a log. In the phone screen they ask you to walk through an alert out loud: what you look at first, what makes you close it as a false positive, what makes you escalate. They are listening for order. Someone who says “isolate the host” before “check what the process did” is going to isolate a CFO’s laptop during an earnings call.
They also check whether you can write. A SOC runs on notes, and the tier 2 analyst who picks up your case at 3 a.m. should be able to read what you did in under a minute. Half the interview questions I have asked were secretly writing tests.
Evidence when you have no job history
A cert line on a resume is a claim. Evidence is a thing somebody can look at. The cheapest evidence is a write-up: pick an alert you worked in a lab, write what it said, what you checked in what order, what you concluded, what you would do differently. Two pages. Put three of them in a public repo and link it from the resume. I have interviewed people on one good write-up and passed on four certs with nothing to show.
The second-cheapest is a lab you can describe precisely: which collector, which log sources, what broke when you set it up, what you searched for last week. Vague answers there tell the interviewer the lab was a weekend that ended two months ago.
Simulators count when they make you decide and then say whether you were right. The ServiceDesk Simulator now runs a second desk, the Security Simulator, in beta: you work a queue of alerts and escalated tickets through a SIEM-style alert console, an identity console, an endpoint console and a mailbox audit, close each with one of eight close codes and a note, and then it tells you what actually happened. The beta has a waitlist. Whatever you practice on, the write-up afterward is what goes on the SOC resume with no experience.
The numbers game
CyberSeek counted 514,359 cybersecurity job openings in the US in the twelve months ending March 2026. Most are senior, and the entry-level ones draw hundreds of applications each, so the count says nothing about your odds on one posting. Your odds come from volume and referrals. Apply to SOC analyst, security analyst, security operations and cyber defense postings, and to help desk openings at companies that have a SOC, because the internal move is the most reliable direct hire there is. Expect silence, then a phone screen, then silence.
The pay is lower than the figure you have read. The Bureau of Labor Statistics put the May 2025 median for information security analysts at $129,180, and that includes the senior people. A first SOC seat pays well under it; what tier 1 actually earns is worth knowing before you accept a night shift for less than the help desk paid. Take the seat anyway if it is the only one offered. Eighteen months of real alerts is the experience every posting asks for.