Do you qualify?
Cybersecurity engineering is classified under ISCO-08 group 2529 (Database and network professionals NEC), which explicitly covers ICT security specialists, penetration testers, and digital forensics engineers — all within sub-major group 25, a shortage occupation in Germany. You need:
- A job offer in Germany for at least 6 months
- A gross annual salary of at least €45,934.20 (2026 shortage threshold)
- A recognised degree, or 3 years of cybersecurity engineering experience at university level in the last 7 years
Cybersecurity is not a regulated profession in Germany, so no separate licence to practise is required.
Degree recognition for Moroccan qualifications
Morocco has invested significantly in dedicated cybersecurity engineering programmes:
- ENSIAS (Rabat): filière Sécurité des Systèmes d'Information (SSI) — one of Morocco's most established cyber programmes within a 5-year Grande École track
- INPT (Rabat): filière "Ingénieur Cyber sécurité et Confiance Numérique"
- ENSA Oujda: Sécurité Informatique et Cybersécurité filière
- EMI and ENSA Tanger/Fès: Génie Informatique with security modules
All award the Diplôme d'Ingénieur d'État (5 years, ISCED 7). Check your institution and your specific programme at anabin.kmk.org before applying — H+ at institution level is necessary but your programme must also be listed individually as "entspricht" or "gleichwertig".
A newer BSc Cybersecurity programme (3 years, ISCED 6) from a public Moroccan university may qualify for Route 1 in principle, but dedicated cybersecurity bachelor's degrees are relatively recent in Morocco. Verify the degree-type entry in anabin — if the programme is not individually listed, get a ZAB Statement of Comparability.
OFPPT Technicien Spécialisé en Sécurité Informatique: Below ISCED 6 — does not qualify for Route 1. § 18g(2) is the only path, and requires 3 years of senior security engineering experience (threat modelling, security architecture, IR leadership) — not SOC analyst work alone.
Salary threshold (2026)
| Category | Gross annual minimum |
|---|---|
| Cybersecurity engineer (shortage, ISCO-08 group 25) | €45,934.20 |
| General Blue Card threshold | €50,700 |
| IT exception without degree (§ 18g(2)) | €45,934.20 |
Two routes to the Blue Card
Route 1 — degree: Diplôme d'Ingénieur from an H+ institution with the SSI, cyber, or Génie Informatique programme listed in anabin.
Route 2 — IT exception (§ 18g(2)): 3 of the last 7 years of cybersecurity engineering at university level. Experience letters must describe defensive architecture, threat modelling, security design reviews, and incident response leadership — not only L1/L2 SOC analyst ticket work. Certifications (OSCP, CISSP, CEH, GIAC) support the dossier but do not replace it.
Worked example: Omar's Blue Card application
Omar Tazi, 31, cybersecurity engineer, Rabat to Frankfurt
Diplôme d'Ingénieur from ENSIAS (filière SSI, 2017). Verifies ENSIAS and the SSI filière in anabin before applying. Apostille from Moroccan MFA on degree and transcript. Registered address in Rabat — applies at the German Embassy Rabat.
Seven years of experience: 2 years as a security analyst at a Moroccan ISP, then 5 years as a cybersecurity engineer at a Casablanca bank — responsible for threat intelligence platform design, penetration test programme ownership, SIEM deployment (Splunk), and zero-trust architecture rollout. Holds OSCP and CEH (supporting evidence).
Job offer: Security Engineer at a Frankfurt financial technology company, €63,000 gross/year. Outcome: qualifies under Route 1. Settlement permit at 21 months with German B1.
Document checklist
Route 1:
- Passport (at least 2 empty pages)
- Degree certificate with Moroccan MFA apostille
- Academic transcript with Moroccan MFA apostille
- anabin printout or ZAB Statement of Comparability
- Erklärung zum Beschäftigungsverhältnis
- Health insurance confirmation
Route 2:
- Experience letters (specific: threat modelling, pen testing, SIEM/SOAR platforms, security architecture decisions, IR leadership, CVE research) and payslips. Include certifications (OSCP, CISSP, GIAC) as attachments — supporting evidence, not qualifying credentials.
Which German mission handles your application
Embassy Rabat and Consulate General Casablanca both handle employment visas. Jurisdiction follows your registered address. Confirm before booking via digital.diplo.de.
After approval: settlement permit timeline
- 21 months Blue Card + German B1 → settlement permit (§ 18c(2) AufenthG)
- 27 months Blue Card + German A1 → settlement permit
Common mistakes
Applying with an OFPPT Technicien Spécialisé en Sécurité Informatique. OFPPT diplomas are below ISCED 6. Route 1 is not available. § 18g(2) requires 3 years of engineering-scope work — senior SOC analyst or security architect experience, not entry-level monitoring.
Submitting experience letters that describe only reactive work. Monitoring dashboards, triaging alerts, and closing tickets are SOC analyst work, not security engineering at university level. Describe architecture decisions and design ownership.
Relying on certifications as the primary credential. OSCP, CISSP, and CEH are widely respected but are not degree equivalents for Route 1 and do not substitute for the 3-of-7-years employment record under § 18g(2).
When you need a lawyer
Consider one if your cyber programme is newly introduced and not yet individually listed in anabin, if your experience has been primarily reactive (SOC) without architecture ownership, or if you hold an OFPPT diploma and are unsure whether your experience meets the § 18g(2) threshold.
We are not a law firm and this page does not constitute legal advice.
Frequently asked questions
Is cybersecurity engineering a regulated profession in Germany? No. You do not need a German licence to practise. The Blue Card covers the right to work in any private-sector cybersecurity role.
Does OSCP or CISSP help my application? Yes, as supporting evidence that you operate at the required technical level. They do not substitute for a degree (Route 1) or for the 3-of-7-years employment requirement (§ 18g(2)).
My ENSIAS SSI programme graduated me in 2024 — will it be listed in anabin? Recent cohorts of established programmes are usually covered by the institution and programme entries that exist. However, verify at anabin.kmk.org that your specific filière appears in the comments for ENSIAS — do not assume it is listed without checking.
Sources
- § 18g AufenthG, Bundesministerium der Justiz
- EU Blue Card: Make it in Germany
- anabin database, KMK / ZAB
- German Embassy Rabat · German CG Casablanca
Not legal advice. Verify current requirements with the relevant German mission before applying.
See also
Request a lawyer consultation
Leave your details and we will connect you with a vetted immigration lawyer when available. GermanyTalent is not a law firm — this site provides general information only, not legal advice.