After completing his A-levels, Konrad Thomson joined 3CT Security on a three year cyber security Degree Apprenticeship which he combined with the Trainee Cyber Essentials Assessor Pathway. His reasons were straightforward: “Because of my financial situation, I knew I’d have to work while I was at university anyway, so I thought I may as well just get a job that I’m actually interested in”.
Konrad explains, “apprenticeships give you two qualifications – you get the degree, but then there’s also an apprenticeship qualification.” Here Konrad is referencing his Degree qualification and the End Point Assessment – an assessment designed to demonstrate key Knowledge, Skills and Behaviors he has developed through work and study during the apprenticeship. He highlights how closely the process matches his work: “I can learn something at uni andthen do that same thing at work later in the week. Or sometimes it’s the other way around”.
The Trainee Cyber Essentials Assessor (TCEA) program is an entry-level pathway designed by IASME in discussion with the National Cyber Security Centre. The purpose is to attract individuals with no prior experience in IT or cyber security and equip them with the skills, knowledge, and mentorship needed to launch successful careers in the field.
Each trainee Assessor is employed by one of IASME’s licensed Certification Bodies, and works under the supervision of an experienced Cyber Essentials Assessor as their mentor. Under the supervision of the mentor, Trainee Assessors mark Cyber Essentials assessments from day one, although the mentor is always the one to sign off assessments.
After about two years of being a Trainee Assessor (and marking assessments under the mentor), candidates will usually go through the Assessor Skills Exam and become a full Cyber Essentials Assessor. Konrad has now completed his Cyber Essentials Plus Assessor.
Whilst Konrad completed a Degree apprenticeship, the Trainee Cyber Essentials Assessor program regularly integrates the ICT Level 3 Apprenticeship as part of the training pathway for eligible candidates. Combining structured learning with supervised, real-world Assessor work helps people build confidence quickly and develop practical skills they can use immediately in the role.
A day in the life at 3CT Security
3CT Security is a small cyber security consultancy. Konrad describes the focus as: “Cyber Essentials, Cyber Essentials Plus, and then also ISO 27001.”
Konrad tells us that his work in Cyber Essentials has been hands-on from early on: “in regards to Cyber Essentials, I mark all of the basic assessments”. He goes on, “just recently I’ve also started doing some Cyber Essentials Plus assessments”, which although based on the same technical requirements as Cyber Essentials, include a technical audit of the in scope IT systems to verify that the controls are in place.
Alongside Cyber Essentials, Konrad also supports ISO 27001 work through shadowing and reporting: “the full Assessors conduct the audit and then I write the audit report”.
Essential soft skills
When asked what has improved most most since starting the training, Konrad’s answer is simple: “my confidence in talking about cyber security.”
He explains that when he started work, any understanding he had was “just from school” . Yet because 3CT works with clients who have very little technical knowledge – especially the smaller businesses – he’s had to learn to translate technical requirements into simple, accessible language. That ability to communicate clearly is core to good Cyber Essentials assessment – and it’s something Konrad has built through repetition, feedback, and increasing responsibility.
Training Assessors for the workplace
Konrad’s development has been shaped by a deliberate balance: independence first, then review and coaching.
He describes how 3CT supported him when he was first learning to mark assessments. “They like me to have a go on my own, and then afterwards, we get together and compare our answers and see what I might have missed. There’s no other way to become competent other than practising marking those assessments.”
Practical outcomes
Konrad connects his own experience to the bigger point underlying the growth of the scheme. “As the demand for Cyber Essentials increases, there needs to be a bigger supply of Assessors.”
He also frames the Cyber Essentials assessment as a strong entry point for people new to cyber because it’s grounded in fundamentals rather than deep specialism. “You don’t actually need to be that technical in order to mark the CyberEssentials assessment, you just need a good understanding of the fundamentals of cyber security.”
When asked about the practical outcomes of the supervised trainee route, Konrad says, “it means people like me, can start working for a business and produce billable straight away… and we can learn while we’re doing it.”
What’s next?
Konrad recognises that his hands-on technical expertise, combined with a clear, accessible way of explaining complex topics, is a real strength. He explains, “You do a test, you get the result, and then you give it to somebody who may not understand the first thing about cyber security. So you have to break it down, tell them exactly what the issues are and what they need to do to solve them.”
Interested in TCEA?
If you are considering the Trainee Cyber Essentials Assessor entry-level route into a career in cyber security, Konrad’s advice is “I think it’s a good opportunity and if you’re thinking about doing it, you definitely should.”
If you’re a Certification Body looking to develop Assessor capacity, please contact [email protected]