What must a NOC 21220 reference letter include?

Company letterhead, signatory with title and contact, your title, start and end dates, weekly hours, annual salary and benefits, and a duties paragraph mirroring NOC 21220 — security architecture, risk assessments, incident response, penetration testing and advising on security policy.

How is NOC 21220 different from NOC 22222 (information systems testing technicians) or 22221 (user support)?

21220 is TEER 1 and requires design, architecture and advisory work — you build the security posture. 22221 and 22222 are TEER 2 support-tier roles: applying patches, running tickets, executing test scripts. If your letter reads like SOC-tier-1 or help-desk work, IRCC will reclassify to TEER 2.

Is a CISSP or OSCP required for NOC 21220?

No. IRCC scores duties, not credentials. Certifications strengthen the letter, but the duties paragraph is what determines the classification.

What if my role is mostly SOC monitoring?

Pure alert triage tends to reclassify to NOC 22222. If you also do detection engineering, threat hunting, incident-response leadership, or advising on controls and architecture, those are the sentences to lead with in your 21220 letter.

NOC 21220 reference letter — what IRCC actually requires

"Cybersecurity" in the job title isn't enough. IRCC compares the duty language to the NOC 21220 lead statement, and if the letter reads like SOC-tier-1 monitoring or IT-support work, it reclassifies down to TEER 2 — and the CRS category eligibility goes with it.

Knowing your NOC code is only half the equation. IRCC doesn't ask what your code is — they ask whether your reference letter duties prove it. Most refusals at the eligibility stage aren't wrong NOC codes, they're correct codes (like 21220 for cybersecurity specialists) with reference letters that don't back them up.

A NOC code that doesn't match your actual duties isn't just a paperwork issue — IRCC can treat it as misrepresentation, which carries consequences that go well beyond a single refused application.

Confirming your NOC code before you submit is a lot cheaper than correcting it after.

Educational information only, not legal advice. Consequences vary based on individual circumstances.

Real example: A Cybersecurity Analyst applicant claimed NOC 21220 but their reference letter described 'monitored SIEM alerts, escalated tickets and installed endpoint patches' — SOC-tier-1 and IT-support work that reclassifies to NOC 22222 or 22221, not the design, architecture and advisory duties NOC 21220 requires. Refused at the eligibility stage.

✓ 3,000+ NOC codes verified

Am I safe to submit? →Generate my reference letter →

What every NOC 21220 letter must contain

Company letterhead, signatory name/title, direct contact
Job title, dates, weekly hours (30+ for full-time)
Annual salary and benefits (specific amount)
Duties paragraph covering security architecture, risk, incident response and advisory work

Sample duties paragraph (NOC 21220 wording)

"In their role as Cybersecurity Specialist, [Name] designs and implements security architectures across cloud and on-premise environments, conducts threat modelling and risk assessments for new products, and advises engineering leadership on security controls and policy. They lead incident-response investigations, perform penetration tests and vulnerability assessments, and develop detection rules and playbooks used by the security operations team. They also evaluate emerging security technologies and produce recommendations for adoption."

What breaks a NOC 21220 letter

SOC-tier-1 wording. "Monitored alerts", "escalated tickets", "closed incidents from runbooks" → NOC 22222.
Help-desk verbs. "Installed", "patched", "reset passwords" → NOC 22221.
Pure compliance-audit duties. Reads more like NOC 11109 (auditors) than 21220.
No design or advisory verbs. If nothing says "designed", "architected", "advised" or "led response", 21220 is contestable.
Missing hours or salary. Automatic PFL trigger.

What IRCC actually checks

What surprises most applicants: IRCC officers compare your reference letter duty lines word-by-word against the official NOC duty list. Generic phrases like “managed projects” or “supported the team” fail this check every time.

IRCC refused 23% of Express Entry applicants at the eligibility stage. A $9.99 check is insurance against a $1,500+ mistake.

Is your letter really NOC 21220 — or SOC-tier-1 in disguise?

Score your reference-letter duties against NOC 21220 in 30 seconds. Under 70% and you're in reclassification territory.

Check My NOC Build the letter →

FAQ

What must a NOC 21220 reference letter include?: Company letterhead, signatory with title and contact, your title, start and end dates, weekly hours, annual salary and benefits, and a duties paragraph mirroring NOC 21220 — security architecture, risk assessments, incident response, penetration testing and advising on security policy.
How is NOC 21220 different from NOC 22222 (information systems testing technicians) or 22221 (user support)?: 21220 is TEER 1 and requires design, architecture and advisory work — you build the security posture. 22221 and 22222 are TEER 2 support-tier roles: applying patches, running tickets, executing test scripts. If your letter reads like SOC-tier-1 or help-desk work, IRCC will reclassify to TEER 2.
Is a CISSP or OSCP required for NOC 21220?: No. IRCC scores duties, not credentials. Certifications strengthen the letter, but the duties paragraph is what determines the classification.
What if my role is mostly SOC monitoring?: Pure alert triage tends to reclassify to NOC 22222. If you also do detection engineering, threat hunting, incident-response leadership, or advising on controls and architecture, those are the sentences to lead with in your 21220 letter.

Last updated: July 2026