Cyber Security Apprenticeships and Graduate Schemes: Routes Into the Profession

Apprenticeships and graduate schemes are the most structured way into cyber security, but the standards, funding rules and government programmes behind them change often enough that advice from even two years ago can be wrong. In England the Level 3 cyber security technician standard has been revised, the Level 4 technologist standard is shown as retired, and the NCSC's CyberFirst programme now sits inside the wider TechFirst skills programme. In the US, Registered Apprenticeship has its own federal rules. This guide explains what each route involves, which official standards define it, how to judge a scheme, and how to progress afterwards. It is for school leavers, graduates, career changers and the employers and managers who run these schemes. For the full map of security roles, see the Cybersecurity Careers Guide; this page goes deeper on structured entry routes. Facts were checked on official sources on 8 November 2026.

Key takeaways

• An apprenticeship is a job, not a course. In England you are an employee earning a wage and holiday pay, with at least 20% of normal working hours set aside for training, according to GOV.UK.
• Check the standard's version and status. Skills England shows the Level 3 Cyber security technician (ST0865) at version 1.1, approved for delivery, with a revised version due for new starts from 9 March 2027.
• Degree apprenticeships give a degree without tuition debt. The Level 6 Cyber security technical professional integrated degree (ST0409) typically takes 48 months and leads to a BSc (Hons).
• US Registered Apprenticeship has federal standards. Under 29 CFR 29.5, programmes need at least 2,000 hours of on-the-job learning (time-based route), a recommended 144 hours a year of related instruction and a rising wage schedule.
• Judge a scheme by the work, not the brand. The best schemes put you in a real team, such as a SOC, with a named mentor, rotations and a clear role at the end.

What the role does

"Apprentice" and "graduate" describe how you enter, not what you do. Most entry schemes lead into a small set of roles, and the official standards describe them closely.

• Level 3 technician work: Skills England describes the Cyber security technician as providing first-line cyber security support, under supervision, typically in a security operations centre (SOC) or network operations centre. Tasks include monitoring for threats, escalating issues, and applying controls such as patching, access control, firewall configuration, SIEM and anti-malware tools. Typical job titles listed include junior SOC analyst, junior penetration tester, incident response technician, access control administrator and junior information security analyst.
• Degree level work: the Level 6 standard summarises the occupation as "Leading teams which manage cyber security risks", covering research, risk assessment, secure design, and detection and response. Listed job titles include cyber risk analyst, cyber incident manager, cyber security engineer and cyber security design engineer.
• Graduate schemes: large employers, consultancies and government bodies run two-year programmes with rotations through teams such as security operations, governance and risk, identity and access management, and security architecture. They usually expect a degree in any subject and test aptitude rather than security knowledge.

For what the day-to-day work looks like once you land, see the SOC Analyst Career Guide and the Penetration Tester Career Guide.

Core skills and tools

Schemes recruit on potential. The Level 3 standard's knowledge, skills and behaviours (KSBs) are a good public checklist of what employers expect you to grow into:

Practical starting points: networking basics (TCP/IP, DNS, ports), Windows and Linux administration, how accounts and passwords work, and reading logs. A home lab is the cheapest way to build these; see the Building a Cybersecurity Home Lab Guide and the Cyber Ranges, CTFs and Hands-On Training Guide.

Where identity fits: access control administration is one of the listed technician job titles, and joiner, mover and leaver work is a common first task for apprentices. Learning how user accounts, service accounts and API keys are granted and removed is a fast way to become useful. See the IAM Engineer Career Guide.

Routes into the role

England

GOV.UK states that to start an apprenticeship you must be 16 or over, live in England and not be in full-time education. Apprenticeships last between 8 months and 6 years. Level 3 is equivalent to A level, Levels 4 to 7 are higher apprenticeships, and Levels 6 and 7 can be degree apprenticeships. Each standard on Skills England lists a maximum funding band: £11,000 for ST0865 and £24,000 for ST0409. That is the training cost the employer can draw on, not your pay. Scotland, Wales and Northern Ireland run their own apprenticeship systems.

Look at the version history, not just the title. ST0865 version 1.0 ran for starts from 13 May 2020 to 28 September 2025; version 1.1 is approved for starts from 29 September 2025 to 8 March 2027; a further revision is awaiting implementation. ST0409 version 1.1 is approved for delivery while a revision is in progress. Ask your provider which version and end-point assessment plan you will be assessed against.

United States

Registered Apprenticeship programmes are registered by the Department of Labor's Office of Apprenticeship or a recognised State Apprenticeship Agency (29 CFR 29.2 and 29.13). The standards in 29 CFR 29.5 set a minimum apprentice age of 16, a term measured by time (at least 2,000 hours), competency or a hybrid, a recommended minimum of 144 hours of related instruction per year, a progressively increasing wage schedule with an entry wage no lower than the federal minimum wage, a probation period of no more than 25% of the programme or one year, and a completion certificate issued by the Registration Agency. Apprenticeship.gov lists Cybersecurity Support Technician among high-demand tech occupations and reports that more than 58,000 registered apprentices in technology, cybersecurity and AI-related occupations were served in 2025.

UK government programmes

The NCSC says it has supported thousands of young people through CyberFirst since 2016 and describes TechFirst as the new and much larger programme, with the NCSC as its Cyber Pathway lead. The GOV.UK TechFirst guidance (last updated 19 October 2026) lists strands including TechFirst for Schools, an AI Apprenticeship Pathway pilot for young people at risk of not being in employment, education or training, an Undergraduate Scholarship, Doctoral Support, TechFirst Local and a Women's Programme. The NCSC page announces a TechFirst undergraduate scholarship launching in November 2026 offering £4,000 a year to up to 1,150 domestic students. These programmes are new, so check the strand pages for eligibility before planning around them.

Choosing between routes

• Leaving school and want to earn: a Level 3 apprenticeship gets you into a SOC quickly; a degree apprenticeship suits you if you want a degree and can commit to four years with one employer.
• Already have a degree: a graduate scheme gives breadth and a network; a higher apprenticeship can make sense if the employer offers one for graduates.
• Changing career: apprenticeships are open to adults, but the pay is lower during training. The Career Change into Cyber Security Guide covers the trade-offs.
• Small employer offering a place: check who will mentor you and whether there is a security team at all. A sole IT generalist can still be a good mentor if the training provider is strong.

Certifications that help

Most apprenticeships and graduate schemes do not require certifications to apply, and many fund them once you start. If you want one beforehand, pick an entry-level certificate that matches the role, not an advanced one.

• Before applying: the ISC2 Certified in Cybersecurity (CC) Guide and the CompTIA Security+ Guide cover the common entry-level options.
• During a SOC placement: the Blue Team Certifications Guide compares practical defensive certificates.
• After a degree apprenticeship: UK professionals can work towards UK Cyber Security Council registration; see the UK Cyber Security Council Chartered Status Guide.

Progression

An apprenticeship ends with an end-point assessment; a graduate scheme ends with a placement into a permanent role. Plan the next step from the start.

1. First 6 months: learn the team's tools and processes, keep a log of what you did and what you learned, and agree learning goals with your mentor.
2. By the end of year 1: own a small area, such as a set of detection rules, a patch report or access reviews for one system.
3. Before assessment: collect evidence against every KSB in your standard; the end-point assessment plan on Skills England says how you will be assessed.
4. After completion: move from Level 3 to a higher or degree apprenticeship, specialise (detection engineering, cloud, identity, testing), or step into analyst roles with more autonomy.

Mapping to frameworks: NICE (US) and the ENISA European Cybersecurity Skills Framework (ECSF) describe work roles you can map your scheme to, which helps when you apply for your next job. See the ENISA ECSF Skills Framework Guide.

For employers running a scheme

• Pick the standard first: choose the Skills England standard or US registered occupation that matches the real job, then the provider.
• Protect training time: the 20% off-the-job rule in England is a minimum; schedule it, do not let shift work consume it.
• Give least privilege access from day one: apprentices need real access to learn, but scoped, logged and reviewed like any other account.
• Measure the scheme: track completion rate, end-point assessment grades, retention 12 months after completion and the share of apprentices placed into the target role.

Common failure patterns

• Applying for the wrong level: graduates apply for Level 3 places and school leavers for degree schemes without checking entry requirements.
• Ignoring the version: learners follow outdated KSBs from an old standard version.
• Training time eaten by operations: the employer treats the apprentice as cheap SOC cover.
• No mentor: placements with nobody senior to learn from produce poor assessment evidence.
• Fake schemes: scams use invented "apprenticeships" or recruiter approaches to steal personal data or deliver malware; apply through official services and employer sites, and see the Contagious Interview Threat Actor Profile Guide for how fake job approaches are used by attackers.

Practitioner checklist

• Decide your target role and level before searching for schemes.
• Read the official standard page: version, status, duration, funding band and job titles.
• Check the NCSC certified degrees list if a degree apprenticeship matters to you; if a degree is not listed, it is not certified.
• In the US, confirm a programme is registered with the Office of Apprenticeship or a State Apprenticeship Agency.
• Build a small home lab and keep written notes you can show at interview.
• Ask each employer who your mentor is, what team you join and what role you move into afterwards.
• Apply only through official services and verified employer sites.
• From the first month, collect evidence against your standard's KSBs.

Standards and references

• Skills England: Cyber security technician (ST0865) version 1.1
• Skills England: Cyber security technical professional integrated degree (ST0409)
• Skills England: Cyber security technologist (ST0124)
• GOV.UK: Become an apprentice
• eCFR: 29 CFR Part 29 Labor Standards for the Registration of Apprenticeship Programs
• Apprenticeship.gov: Cybersecurity apprenticeships
• NCSC: NCSC certified degrees
• GOV.UK: TechFirst

Related NHI Mgmt Group resources: Cybersecurity Careers Guide · Cyber Security CV · Cyber Security Interview Preparation Guide · SOC Analyst Career Guide