Are you studying for a BTS SIO (Services Informatiques aux Organisations) and interested in cybersecurity? Good news: you are in exactly the right place. Since the curriculum framework was updated in 2020, cybersecurity is no longer a niche option reserved for engineering schools: it is a full skill block in the BTS SIO, assessed in the exam and included in both options. In this guide, we break down the actual role of cyber in the qualification, the security differences between SISR and SLAM, what examiners expect from you, and above all how to stand out to land your first job in the industry.
Cybersecurity in the BTS SIO: what the curriculum framework says
The 2020 BTS SIO curriculum framework is structured around three skill blocks. The first ('Support and Provision of IT Services') is common to both options. The second corresponds to your specialism: SISR (Solutions d'Infrastructure, Systèmes et Réseaux) or SLAM (Solutions Logicielles et Applications Métiers). The third block is the one we are focusing on here: 'Cybersecurity of IT Services'.
In practical terms, this Block 3 covers four main areas, whichever option you choose:
- Protecting personal data: GDPR, records of processing activities, individual rights, breach notification. This is the legal and organisational side, often underestimated by students even though it always comes up in the exam.
- Preserving the organisation's digital identity: online reputation, electronic signatures, digital footprints, and admissibility of evidence.
- Securing equipment and usage: user awareness, IT policy, digital hygiene, access management.
- Guaranteeing availability, integrity and confidentiality: this is the technical core: hardening, monitoring, incident response, business continuity (PCA/PRA).
In terms of volume, this represents around 4 hours a week in the second year (along with an introduction in the first year), equivalent to a full specialisation module. The first year establishes the shared fundamentals (GDPR, risk management, awareness, OWASP basics), whilst the second year shapes the content heavily around your chosen option. You can explore the full breakdown on our BTS SIO 1 Cybersecurity learning path, aligned session by session with the curriculum framework.
SISR vs SLAM: two routes to cyber, two different landscapes
A classic question at the end of the first year: 'I want to work in cybersecurity, which option should I choose?' The real answer: both lead to cyber, but not to the same cyber. Security is a cross-disciplinary field that divides into offensive and defensive infrastructure security on one side, and application security on the other.
| Criterion | SISR - Infrastructure security | SLAM - Application security |
|---|---|---|
| Playground | Networks, servers, Active Directory, Wi-Fi, VPN | Web applications, APIs, code, databases |
| Threats covered | Network intrusion, lateral movement, denial of service, rogue AP | SQL injections, XSS, authentication vulnerabilities, OWASP Top 10 |
| Typical tools | Firewalls, IDS/IPS (Suricata, Snort), SIEM, Wireshark, Nmap | Burp Suite, code analysers, secrets management, OWASP ZAP |
| Key cyber skills | Segmentation, monitoring, alert detection, system hardening | Secure development, access control, input validation, session management |
| Target cyber roles | SOC analyst, secure systems administrator, network security technician | Security developer (junior DevSecOps), junior web pentester, AppSec analyst |
| On Lockbay Academy | Year 2 SISR learning path | Year 2 SLAM learning path |
In SISR, your second year focuses on secure network architecture, firewalling and access control, Wi-Fi security, monitoring and alert detection, IDS/IPS and VPNs, right through to incident management and evidence collection. This is the natural profile if you are aiming for a role in a SOC (Security Operations Centre) or in security-oriented systems administration.
In SLAM, cybersecurity focuses on authentication and access control, application auditing against the OWASP Top 10, application monitoring, and incident response. You learn to think like an attacker to write better defensive code: a mindset that is highly sought after with the rise of DevSecOps.
The right approach when deciding: ask yourself whether you prefer to build and defend infrastructure or write and audit code. Switching between the two is always possible later on, but your option will shape your two years of work placements and projects.
E5 and E7: how cyber is assessed in the exam
Cybersecurity features directly in two professional exams of the BTS SIO:
- E5 - Support and Provision of IT Services: you present your portfolio and professional achievements. Even though the exam focuses on Block 1, including a security dimension in your projects (server hardening, setting up tested backups, rights management) adds strong value to your submission in front of the examination board.
- E7: IT services cybersecurity (E6 before the 2025 session): the exam for the cybersecurity block introduced with the 2020 curriculum framework. A 4-hour written exam based on a corporate case study, combining legal questions (GDPR, digital evidence, liability) and technical questions tailored to your option (log analysis, firewall configuration and intrusion detection in SISR; application vulnerabilities and code security in SLAM).
What the examiner expects in E7 is not rote learning: it is your ability to analyse a real-world situation, identify risks, suggest proportionate measures, and justify your choices by referencing the right frameworks (GDPR, ANSSI recommendations, OWASP best practices). Students who practise on concrete cases (business scenarios, simulated incidents, sample exam questions) consistently stand out. That is the philosophy behind our past exam papers with model answers for the cybersecurity exam (E7 since the 2025 session) and the sessions in the BTS SIO library.
How to stand out: labs, recognised exams, tech monitoring
The qualification opens the door, but in the cybersecurity market, what sets two BTS SIO candidates apart is demonstrable practical experience. Three concrete levers:
1. Lab practice
Nothing beats hands-on keyboard time. Set up a homelab (a Kali VM, a vulnerable target VM, a pfSense firewall), practise on challenge platforms (Root-Me, TryHackMe, Hack The Box), and document everything. On Lockbay Academy, labs launch in the browser with nothing to install: one environment per student, automatically stopped after 2 hours (6 hours for Extreme-level labs). Every completed, documented lab becomes a project you can talk about in an interview.
2. Recognised exams at your level
There is no need to aim for the OSCP straight out of your BTS. Realistic exams at your level exist and reassure recruiters: SecNumacadémie (ANSSI's free MOOC, to be completed in Year 1), the official Pix test with a solid level in the security domain, CompTIA Security+ if you want an international standard, or vendor badges (Cisco CyberOps Associate, Fortinet NSE). One or two well-chosen exams are enough to give credibility to a junior CV.
3. Structured tech monitoring
Tech monitoring is already an assessed skill in the BTS: you might as well take it seriously. Follow CERT-FR and ANSSI publications, a few specialised newsletters, and above all, share your findings: a short blog, published notes, or a monitoring feed you can present to the examination board. A student who can explain a recent CVE in their own words scores points both in oral exams and in job interviews.
Teacher's tip: start your cyber portfolio in the first semester. Every practical, every lab and every analysed incident becomes evidence for E5, an example for E7 and a talking point in interviews. The best portfolios we review are not the most technically brilliant: they are the best documented.
Career opportunities and salaries: what to expect after your BTS
With the shortage of cyber talent in France (tens of thousands of unfilled roles according to industry studies), a BTS SIO with a genuine focus on security opens tangible doors:
Fundamentals + GDPR
Cyber specialisation
Demonstrable portfolio
or junior DevSecOps
- Level 1 SOC analyst (primarily SISR): alert monitoring, incident triage, initial qualification. This is the most accessible entry point after a BTS, especially with IT service providers (ESNs) and security service providers. Junior salary: €26,000 to €32,000 gross/year.
- Security-oriented systems and network administrator (SISR): infrastructure management with a strong focus on hardening, backups, and monitoring. Junior salary: €26,000 to €33,000 gross/year, with rapid progression towards security engineer positions after a few years or further study.
- Junior pentester / junior security consultant (SISR or SLAM): more selective straight out of a BTS (often achieved after a cyber vocational bachelor's degree or a Bachelor's), but accessible if you have a solid portfolio of challenges and labs. Junior salary: €30,000 to €38,000 gross/year.
- Security-aware developer / junior DevSecOps (SLAM): a developer capable of auditing and securing their code, an increasingly sought-after profile. Junior salary: €28,000 to €35,000 gross/year.
These salary ranges apply to a first job in France outside Île-de-France; add an easy 10 to 15% for the Paris region. And do not forget further study: a cybersecurity vocational bachelor's degree, a Bachelor's degree, or even direct entry into an engineering school. The BTS SIO cyber option is an excellent springboard, and an apprenticeship in the second year or during a degree lets you enter the profession while getting paid.
Where to start?
If you are in your first year, focus on the fundamentals: GDPR, risk management, cyber hygiene, OWASP basics, and start SecNumacadémie in parallel. If you are entering your second year, choose your option based on the field that appeals to you, then work through the labs: regular practice is what turns a course into a skill.
Lockbay Academy offers a library of sessions built around the curriculum framework: first-year fundamentals, the SISR infrastructure security specialisation (network architecture, firewall, Wi-Fi, IDS/IPS, monitoring), and the SLAM application security specialisation (authentication, OWASP audits, incident response), with practical labs, assessment workshops, and past exam papers with solutions to practise for the E7 exam. Over to you.