If you have just finished +2 and can study for four years, get a bachelor's degree in computing first. If you already have a degree, or are partway through one, do not start a second one. Add a short, hands-on ethical hacking course and build proof of your skills.
That is our answer at Saarathi Academy in Old Baneshwor, Kathmandu, where we teach a 12-week cybersecurity and ethical hacking course. The reasons come from what security job ads in Nepal really ask for.
Do security jobs in Nepal ask for a bachelor's degree?
Most of them do. A penetration tester ad on merojob listed "Under Graduate (Bachelor)" as the education level. A penetration tester ad from a large Nepali fintech company asked for a bachelor's degree too. Even an associate security analyst role in Kathmandu that needed no experience still asked for a bachelor's.
So the degree works like a gate. Without it, you cannot meet the first line of many ads. That is the main reason we tell a +2 student to get the degree.
Does the degree need "cybersecurity" in its name?
No. Read the same ads again. The fintech ad accepted cybersecurity, IT, computer science "or a related field". The associate analyst ad named computer science, information security or IT, "or equivalent". None of the ads we read asked only for a degree with ethical hacking in its title.
A general computing degree keeps more doors open. If you find in your second year that you prefer backend work or data, you have lost nothing. A degree with security in its name is fine too, if you like its subjects. Just do not choose it only because you think employers require the name.
What do employers check besides the degree?
Experience and tools. The fintech ad wanted 2 to 3 years of penetration testing and vulnerability assessment. It also asked for hands-on use of Metasploit, Burp Suite, Nessus and Nmap. The merojob ad listed Burp Suite, Metasploit, Nmap and Wireshark, plus testing methods like OWASP and PTES. Certificates such as OSCP and CEH appeared as a plus, not a must.
This is where many graduates get stuck. A college exam asks you to write about a topic. A security job asks whether you can find a real hole in a test system. Then it asks you to write that hole up so a developer can fix it. Those are different skills, and the second one only grows with hours in a lab.
Both penetration tester ads wanted 2 or more years of experience. The first job is usually a junior one, like a junior VAPT analyst or a Tier-1 SOC analyst. VAPT means finding and proving security holes in a system, with written permission. A SOC is the team that watches a company's security alerts.
Should you choose a degree or a short course after +2?
Choose the degree. But do not wait for a final-year security subject to start hacking. Spend two or three evenings a week on free legal labs from your first year. Four years is enough time to get very good, if you use them.
By the time you graduate, you want two things. You want the degree that passes the ad's first line. You also want a folder of written findings from labs that shows you can do the work.
What if you already have a degree, or are in one?
Then a second bachelor's degree is the slow road. You already hold the gate. What you lack is proof that you can test a system and report on it.
A focused course of a few months, plus your own lab hours, builds that proof much faster. CS and IT students in their second or third year can do both at once. Our course lists them as one of the groups it is built for.
What should a short course add to a degree?
It should add the hands-on part, in order, with someone checking your work. Here is how ours is laid out, so you can compare.
The course runs for 12 weeks, 2 hours a day, Monday to Friday. Weeks 1 to 4 cover the terminal, networks, recon and Linux, before any hacking. Then you spend 3 weeks testing websites and APIs with Burp Suite on free, legal labs. Later you write a VAPT report you can show employers. In Week 10 you also work security alerts in the Wazuh SIEM, which is the defending side of the job.
Nepal job ads name CEH most often. Our course covers most CEH v13 topics, but it has no exam prep track and no exam voucher. Each batch has up to 10 students in the classroom, and the mentors still do the job they teach. The course ends with a certification exam you take online at home.
Is it legal to practise ethical hacking in Nepal?
Only with written permission. Testing a system without it is a crime under the Electronic Transactions Act 2063 (Sections 45 and 46). So practise only on targets built for practice, never on a college or company website.
What can you try tonight?
Open a terminal and type ssh bandit0@bandit.labs.overthewire.org -p 2220. The password is bandit0. On Windows, the same command works in PowerShell. This is OverTheWire Bandit, a game for absolute beginners where each level teaches one Linux skill.
When you can clear ten levels, try the free SQL injection labs in the PortSwigger Web Security Academy. You do not need an account to start. Later, the eJPT from INE Security is a practical, entry-level certificate worth a look. It is optional, and nothing in a degree or a course depends on it.
The week-by-week plan of our Cybersecurity and Ethical Hacking course is on the course page, and the full syllabus is public before you decide anything.
Top comments (0)