Cyber security is one of the few fields in the UK where employer demand has held up consistently against a backdrop of patchy hiring elsewhere in tech. Apprenticeships, which combine a paid job with structured off-the-job training, have become a practical route in for school leavers and career changers who do not want to take on student debt for a traditional degree.
This is a guide for two audiences. First, anyone in the North West thinking about applying for a cyber security apprenticeship. Second, business owners weighing up whether hosting an apprentice could help close a gap on their own team.
How a UK cyber security apprenticeship works
An apprenticeship is a real job. The apprentice is employed and paid by the employer from day one, and at least 20% of their contracted hours are spent in off-the-job training delivered by an approved provider. The apprenticeship has a defined end point, an external assessment, and a recognised qualification level.
For cyber security, three levels are most relevant.
Level 3 Cyber Security Technician
The standard entry point. Equivalent to A-Level. Typically 18 months of training plus an end-point assessment. Suitable for school leavers with five GCSEs including English and maths. The work covers basic threat detection, network security under supervision, security operations centre tasks, compliance support, and configuring tools like firewalls and access controls.
Level 4 Cyber Security Technologist
Equivalent to a foundation degree. Typically 24 months. Builds on Level 3 with risk assessment, incident response, and SIEM tooling. Pathways usually split between defensive (defend and respond) and analytical (risk analyst). Some employers prefer apprentices with a year of IT background or a Level 3 qualification before starting Level 4.
Level 6 Degree Apprenticeship
Equivalent to a BSc honours degree. 42 to 48 months. Covers advanced topics including penetration testing, secure system design, malware analysis, and the human factors side of cyber defence. The apprentice finishes with a degree and several years of real working experience.
How it gets paid for
Apprenticeship training is funded by the government. Larger employers contribute through the Apprenticeship Levy. Smaller employers pay 5% of the training cost, with the government covering the remaining 95%. For apprentices aged 16 to 21, or 22 to 24 if they have an Education, Health and Care Plan or are leaving care, the government covers 100% of training costs for small employers.
The employer pays the apprentice’s salary at the appropriate national minimum wage for an apprentice or higher. Most cyber apprentices earn well above the minimum, particularly in the North West where competition for technical staff has pushed entry-level salaries up.
For applicants: how to find a cyber security apprenticeship in the North West
The official starting point is the government’s Find an Apprenticeship service at gov.uk. Search for “cyber security” and filter by location. Manchester, Liverpool, Preston and Warrington tend to have the most open vacancies, but smaller towns across Lancashire and Merseyside also appear regularly.
What to put on a CV when you have no experience:
- Any self-directed learning. TryHackMe, Hack The Box, free courses from Cisco Networking Academy or Microsoft Learn all count and are easy to verify
- Any technical hobby. Building PCs, running a home network, setting up a media server, basic scripting
- Soft skills the role actually needs. Attention to detail, willingness to follow procedure, ability to write a clear ticket update
- GCSE results and any relevant subjects studied since
Keep the CV to one page. Tailor the personal statement for each application. Apply early in the cycle — many cyber apprenticeship vacancies close before the advertised deadline because the employer fills the role on the first round of interviews.
For employers: should you host a cyber security apprentice?
For SMEs, an apprentice is not a cheap pair of hands. They are an investment that takes 18 months or more to pay back. The apprentice will need supervision, time from existing technical staff, and a structured plan for the work they are given.
The reasons to do it anyway:
Cyber security skills are hard to hire and retain at experienced level. Growing your own gives you someone who knows the business by the time they are competent to operate independently.
Apprentices who complete their training tend to stay. Retention rates in technical apprenticeships are well above industry average, partly because the employer has invested in them and partly because the apprentice has built a real working network inside one organisation.
The financial barrier to entry is low. Government funding covers most or all of the training cost for SMEs.
What you need to have in place before taking on an apprentice:
- A named line manager who has time to mentor
- A structured plan for the first six months covering what the apprentice will work on and who will check it
- An approved training provider
- Realistic expectations about how long it will take before the apprentice contributes independently
If those four things are not in place, hiring an experienced second-line engineer is the better option.
Why apprenticeships matter for North West businesses
The wider point is that the cyber skills gap is real, and it is felt most acutely by SMEs that cannot compete on salary with banks, professional services firms and government agencies. Apprenticeships are one of the few mechanisms that bring genuinely new people into the field rather than moving existing staff between employers.
For business owners reading this and concluding that an apprentice is not the right route right now, the more immediate question is whether your existing cyber security position is actually being managed. If it is not, that is the issue worth solving first, with or without an apprentice on the team.
About Blowfish Technology
Blowfish Technology is a managed IT and cyber security provider for North West UK SMEs, with offices in Ormskirk and Liverpool. We have been trading since 1999 and hold ISO 9001, ISO 27001 and Cyber Essentials Plus.
If you would like to talk about cyber security for your business, whether that is a review of your current arrangement, advice on what to put in place, or a conversation about taking on technical apprentices through us, get in touch.
Cyber security worth talking about
If you are not sure where your business stands on cyber security, we will tell you. No sales pitch, just a clear picture.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.