Source basis: This guide reflects UK cyber-security career information available in June 2026. The Government’s latest labour-market study, updated in February 2026, reported an average of 2,698 core cyber-security vacancies per month in 2024 and a median advertised salary of £55,000 across those roles. It also showed that entry-level recruitment remains competitive, so learners should combine qualifications with practical evidence and related experience. (GOV.UK) The dedicated UK cyber-security sector employed an estimated 69,600 full-time-equivalent workers in 2026. (GOV.UK) The roadmap below also follows the UK Cyber Security Council’s 15-specialism career framework, NCSC Assured Training and certified-degree routes, and current Skills England apprenticeship standards. (UK Cyber Security Council) Entry-level certification examples are based on current official information from ISC2 and Microsoft. (ISC2)

How to Get Into Cyber Security UK: Step-by-Step Roadmap

To get into cyber security in the UK, start by building a solid understanding of computers, networks, operating systems and user accounts. Next, choose a suitable cyber career path, complete focused training and produce practical evidence of what you can do. You can then target apprenticeships, junior cyber roles or related IT positions that provide a route into security.

A university degree can help, but it is not compulsory for every cyber security job. Apprenticeships, professional courses, entry-level certifications, self-directed learning and experience in IT support can all lead into the field. What matters most is showing employers that you understand the fundamentals, can apply them responsibly and are willing to keep learning.

The UK market offers opportunities across security operations, risk, cloud security, engineering, incident response, application security and other specialisms. However, it is competitive, particularly at entry level. A short cyber security course on its own will not normally make someone job-ready. The strongest candidates combine training with projects, transferable skills and a realistic application strategy.

This step-by-step roadmap explains how to get into cyber security UK roles, which skills to learn, how to compare cyber security training and qualifications, and how to pursue your first position.

Is Cyber Security a Good Career in the UK?

Cyber security can be a strong career choice for people who enjoy technology, investigation, structured problem-solving and continuous learning. Almost every sector now relies on digital systems, including finance, healthcare, education, retail, energy, transport and government.

That reliance creates a continuing need for people who can protect networks, accounts, cloud services, applications and information. Cyber professionals may monitor suspicious activity, manage vulnerabilities, design controls, investigate incidents or advise organisations on risk.

At the same time, applicants should avoid assuming that every vacancy is easy to enter. Many employers prefer candidates with previous IT or security experience, even for roles described as junior. The practical solution is to build relevant evidence and remain open to stepping-stone roles such as service desk, network support, cloud administration or compliance.

Step 1: Understand the Main Cyber Career Paths

Cyber security is not one job. Before choosing a course or certification, learn what the main specialisms involve and decide which direction fits your interests.

Security Operations and SOC Analysis

Security operations teams monitor systems for warning signs and investigate alerts. A Security Operations Centre, commonly called a SOC, may operate during normal business hours or continuously.

Typical work includes analysing logs, checking suspicious sign-ins, investigating phishing reports and escalating confirmed incidents. This route can suit people who enjoy investigation, patterns and time-sensitive decision-making.

Possible starting titles include:

• Junior SOC analyst
• Security operations analyst
• Cyber security analyst
• Cyber defence analyst
• Security monitoring analyst

Governance, Risk and Compliance

Governance, risk and compliance roles focus on policies, audits, risk assessments, supplier reviews and organisational controls. The area is often abbreviated to GRC.

Someone in this area may assess whether security controls are working, help prepare for audits, review third-party suppliers or develop policies governing how information should be handled.

Security Engineering

Security engineers design, configure and maintain protective technology. They may work with firewalls, endpoint-security platforms, identity systems, cloud controls and security automation.

The role often suits people who enjoy building and troubleshooting systems. Previous experience in networking, technical support or systems administration can provide a useful foundation.

Cloud Security

Cloud-security professionals protect online infrastructure, business applications, data storage and cloud identities. Their work may involve permissions, multi-factor authentication, encryption, logging, virtual networks and secure configuration.

Cloud security is not limited to protecting servers. It also covers who can access information, how accounts are managed and whether storage or sharing settings expose data unnecessarily.

Application Security

Application-security specialists help developers build and maintain secure software. They may review designs, assess access controls, identify insecure coding practices and support security testing.

This pathway usually requires some understanding of software development. It can suit developers who want to move into security or learners who enjoy understanding how applications work.

Incident Response and Digital Forensics

Incident responders help organisations contain, investigate and recover from cyber incidents. Digital-forensics specialists identify, preserve and examine electronic evidence.

These roles require careful procedures, clear documentation and the ability to work under pressure. They are not always beginner positions, but SOC or IT support experience can provide a useful foundation.

Threat Intelligence

Threat-intelligence professionals assess information about threat groups, attack techniques, malicious infrastructure and emerging vulnerabilities. Their purpose is to help an organisation understand which threats are relevant and what action should be prioritised.

The work requires research, critical evaluation and an ability to explain what the information means for a particular organisation.

Security Awareness and Education

Security-awareness professionals teach employees how to recognise scams, protect accounts and handle information safely. They combine cyber knowledge with communication, training design and behavioural understanding.

This can be a suitable route for people with backgrounds in teaching, training, communications or workplace learning.

Step 2: Choose a Realistic Starting Route

Your first choice does not need to define your entire career. It simply gives your learning direction.

Ask yourself:

• Do I enjoy investigating unusual activity?
• Do I prefer building and configuring systems?
• Am I interested in software development?
• Do I enjoy policies, audits and documentation?
• Am I comfortable explaining technical ideas to others?
• Do I already have experience that transfers into one area?

Then examine genuine cyber security jobs UK employers are advertising. Focus on the responsibilities and essential requirements rather than the title alone.

Create a simple skills-gap table with three columns:

Employer requirement	Current evidence	Next action
Networking fundamentals	Introductory study only	Complete practical networking exercises
Log analysis	No project yet	Analyse sample authentication logs
Microsoft cloud knowledge	Regular user	Study identity and security fundamentals
Incident reporting	Transferable writing experience	Write a fictional incident report

This turns a vague career goal into a practical development plan.

Step 3: Build Essential IT Foundations

Cyber security protects technology, so you need to understand how that technology normally works. Skipping the basics often leads to memorising security tools without understanding their output.

Operating Systems

Become comfortable with both Windows and Linux. You do not need to become an expert administrator immediately, but you should understand:

• Users and groups
• File permissions
• Processes and services
• Software installation and updates
• System logs
• Standard and administrator accounts
• Basic command-line navigation
• Secure configuration

Windows knowledge is valuable in many workplaces, while Linux appears frequently in servers, cloud platforms, development environments and security tools.

Networking

Networking is one of the most important foundations for cyber security. Learn:

• IP addresses and subnets
• Routers and switches
• Ports and protocols
• DNS and DHCP
• Firewalls
• Wireless security
• Virtual private networks
• Network segmentation
• Basic web and email traffic

You should eventually be able to explain how a device connects to a website and where security controls can inspect or restrict the connection.

You do not need to design a large corporate network as a beginner. However, you should understand why a firewall blocks certain traffic, why guest devices may be separated from internal systems and how suspicious connections might appear in network records.

how to get into cyber security UK and Accounts and Identity

Many cyber incidents involve stolen, misused or poorly managed accounts. Learn the difference between authentication and authorisation, and understand:

• Multi-factor authentication
• Role-based access
• Least privilege
• Privileged accounts
• Password managers
• Single sign-on
• Account creation and removal
• Session management

Authentication confirms who a user is. Authorisation determines what that user is allowed to do.

This distinction is important because successfully logging into an account should not automatically provide access to every file, system or administrative function.

Cloud Fundamentals

Modern organisations use cloud services for email, storage, communication and applications. Learn how identities, permissions, storage, logging and backups work in a cloud environment.

Do not assume the provider is responsible for every aspect of security. Customers still need to manage accounts, settings, data sharing and access controls.

A strong beginner foundation should include an understanding of shared responsibility, cloud administrator accounts and the risks created by excessive permissions.

Step 4: Learn Core Cyber Security Skills

Once your IT foundations are developing, begin learning the skills used across several cyber roles.

Security Principles

Understand confidentiality, integrity and availability. These principles help professionals decide what they are protecting and what could go wrong.

Confidentiality means preventing unauthorised access to information. Integrity means keeping information accurate and preventing inappropriate changes. Availability means ensuring authorised people can use systems and information when needed.

Also learn:

• Defence in depth
• Least privilege
• Secure configuration
• Encryption
• Risk management
• Cyber resilience
• Business continuity

These principles appear across technical, analytical and governance-focused cyber roles.

Common Threats

Learn how common incidents occur, including phishing, credential theft, ransomware, malicious software, insecure cloud settings, unpatched systems and accidental information disclosure.

Focus on prevention, detection and response. You do not need harmful or unauthorised attack instructions to understand the defensive concepts.

For each threat, consider three questions:

1. How might the organisation notice it?
2. Which controls could reduce the likelihood?
3. What should happen after it is discovered?

This approach develops practical understanding rather than simple memorisation.

Log Analysis

Logs record actions performed by systems, applications and users. Practise identifying:

• Repeated failed sign-ins
• Successful access after several failures
• Logins from unusual locations
• New administrator accounts
• Permission changes
• Unexpected software activity
• Large or unusual data transfers

A useful analyst does not merely find one unusual event. They build a timeline, consider alternative explanations and identify what evidence is still missing.

For example, a login from a different country may indicate account theft, but it could also be caused by legitimate travel or a business network. The analyst needs additional evidence before reaching a conclusion.

Incident Response

Learn the main stages of incident response: preparation, identification, containment, removal, recovery and review.

A junior professional should also know when to escalate. Acting too slowly can increase damage, but making major changes without authority may interrupt essential services or affect evidence.

Useful beginner exercises include writing response plans for a compromised email account, a lost laptop or an exposed cloud-storage folder.

Vulnerability Management

Vulnerability management involves identifying weaknesses, assessing their importance and tracking corrective action.

Learn to consider:

• Whether the affected system is internet-facing
• Whether exploitation is known
• The value of the system or information
• Existing protective controls
• The likely business impact
• Whether a safe update or workaround exists

A vulnerability report may contain hundreds of findings. Security professionals need to decide which ones require urgent action rather than treating every item as equally serious.

Communication and Documentation

Strong writing is a core cyber security skill. Reports should explain what happened, which evidence was reviewed, what risk remains and what action is recommended.

You also need to adjust your language to the audience. A technical colleague may need detailed evidence, while a manager may need a concise explanation of impact, options and priorities.

Clear documentation also helps another analyst continue an investigation without repeating work.

Step 5: Choose the Right Cyber Security Training

Cyber security training can provide structure, but course quality and purpose vary considerably.

Before paying, check:

• Who the course is designed for
• Whether it assumes prior IT knowledge
• The amount of practical work
• The assessment method
• The subjects covered
• The instructor’s experience
• Whether the material is current
• The total cost
• Whether employment claims are realistic

Be cautious of providers promising a guaranteed high-paying job after a few weeks. A course can support your development, but employers still assess practical ability, judgement and experience.

Self-Directed Learning

Self-study is flexible and affordable. It works best when you follow a clear sequence rather than jumping between random topics.

A sensible order is:

1. IT and operating-system basics
2. Networking
3. Security principles
4. Accounts and cloud services
5. Log analysis
6. Vulnerability management
7. Incident response
8. Practical projects
9. A relevant certification
10. Job applications

Keep notes and turn parts of your learning into documented projects. This creates useful evidence for applications.

NCSC Assured Training

NCSC Assured Training provides a UK benchmark for the quality of cyber-security course content and delivery. It can help learners compare professional training options.

Assurance does not guarantee that a learner will secure employment. Check the level of the course, its practical content and whether it supports your chosen career path.

College and Higher Technical Routes

Further-education colleges and training providers may offer computing, networking and cyber-security programmes. Higher Technical Qualifications and related computing courses can provide an alternative to a traditional university degree.

Look for programmes that include practical assessment, employer projects, placements or opportunities to work with realistic systems.

University Degrees

A degree in cyber security, computer science, digital forensics, software engineering or networking can provide broad technical development.

The NCSC certifies selected undergraduate, postgraduate and degree-apprenticeship programmes. Certification can help applicants identify courses assessed against recognised cyber-security criteria.

When comparing degrees, consider the actual modules, placement opportunities, facilities, industry connections and graduate support. A course title alone does not reveal how practical or relevant the programme will be.

Bootcamps

A bootcamp can provide concentrated training, particularly for career changers. Quality varies widely.

Check whether the programme assumes previous IT experience, how much guided practical work is included and what kinds of jobs previous learners actually secured. Avoid relying entirely on advertising testimonials.

Step 6: Consider UK Cyber Security Apprenticeships

Apprenticeships combine paid employment with formal training, making them one of the most practical routes into cyber security.

Current pathways include technician-level programmes, Level 4 cyber-security technologist routes and degree-level cyber-security apprenticeships. The exact vacancies and entry criteria depend on the employer and location.

An apprentice may support tasks such as:

• Processing security requests
• Monitoring potential threats
• Applying technical controls
• Managing confidential information
• Supporting risk assessments
• Investigating incidents
• Documenting findings

Apprenticeships are competitive. A strong application should show that you understand the role, have begun learning the fundamentals and can provide examples of problem-solving, teamwork and responsibility.

Search regularly because recruitment windows vary. Consider employers in government, finance, consulting, telecommunications, defence, technology and other sectors.

Do not wait until a vacancy opens before beginning your preparation. Basic networking knowledge, practical projects and a clear explanation of why you want the role can strengthen your application.

Step 7: Use Cyber Security Certifications Strategically

Cyber security certifications can give your learning structure and provide evidence that you passed an assessment. They do not replace practical experience.

Entry-Level Options

The ISC2 Certified in Cybersecurity credential is designed for entry-level learners and does not require previous professional experience. It covers security principles, access controls, network security, security operations, incident response and continuity concepts.

Microsoft’s Security, Compliance and Identity Fundamentals credential is a beginner option for people interested in Microsoft cloud-based security, identity and compliance concepts.

CompTIA Security+ is another broad foundation commonly associated with early-career cyber knowledge, although complete beginners may find it easier after studying basic IT and networking.

Certification programmes and exam content can change. Always confirm the current syllabus, cost and requirements with the official provider before booking an examination.

Platform-Specific Certifications

Cloud and vendor certifications may help when they match the technologies used in your target jobs. However, do not collect certificates without applying the knowledge.

A stronger combination is:

• One relevant certification
• A practical lab or project
• A written explanation of what you configured or investigated
• Evidence that you understand the limitations

For example, someone studying cloud identity could create a fictional access-control plan, document different user roles and explain how multi-factor authentication would be applied.

Advanced Qualifications

Advanced certifications often assume professional experience. They make more sense after you have worked in the field and chosen a specialism.

Do not delay entry-level applications because you believe you need a senior credential first. A well-chosen beginner qualification and a strong portfolio are usually more relevant at the start of a career.

Step 8: Build Practical Experience and a Portfolio

A portfolio can help you demonstrate cyber security skills when you have limited professional experience.

Use only systems, accounts and training environments that you own or have explicit permission to use.

Project 1: Analyse Sample Login Records

Review harmless sample authentication logs. Identify failed sign-ins, unusual timings and changes in account behaviour.

Write a report explaining:

• What you observed
• The timeline
• Possible explanations
• Further evidence required
• Recommended action

Project 2: Create a Small-Business Network Plan

Design a fictional network containing staff laptops, cloud services, guest Wi-Fi and sensitive systems.

Explain where segmentation, firewalls, secure remote access and monitoring should be used.

Project 3: Write an Incident-Response Playbook

Choose a scenario such as a compromised email account, lost laptop or exposed cloud folder.

Describe who should be informed, how the problem should be contained and how recovery should be checked.

Project 4: Produce an Access-Control Matrix

Create fictional departments and decide which systems each role needs. Explain how your decisions follow least privilege.

Project 5: Complete a Risk Assessment

Identify a fictional organisation’s important assets, threats, weaknesses, existing controls and priority improvements.

Do not simply list every imaginable danger. Focus on risks that are credible for the chosen organisation and explain why particular controls should take priority.

Project 6: Automate a Defensive Task

Use a simple script to process harmless data, such as counting failed login attempts in a sample file. Document the logic, errors and limitations.

For each portfolio item, include the scenario, method, result, recommendations and lessons learned. Three detailed projects are more persuasive than twenty unexplained screenshots.

Step 9: Target the Right Cyber Security Jobs UK Employers Offer

Your first role may be directly in cyber security, or it may be a stepping stone.

Suitable job titles to search include:

• Junior SOC analyst
• Cyber security analyst
• Security operations analyst
• Cyber security technician
• Information security assistant
• Junior risk analyst
• Identity and access administrator
• Vulnerability-management assistant
• IT security coordinator
• Service-desk analyst
• Network-support technician
• Cloud-support technician

Read the responsibilities carefully. A service-desk role that includes account management, endpoint support and incident escalation may offer more relevant experience than a poorly structured job with “cyber” in the title.

IT Support as a Route into Cyber

IT support is one of the strongest entry routes. It develops experience with users, devices, permissions, software, email and troubleshooting.

Those skills transfer into security operations, endpoint security and identity management. Many professionals move into cyber after learning how business technology operates in practice.

Support work also helps develop patience and communication skills. Analysts frequently need to ask users what happened and explain the next steps without creating unnecessary confusion.

Risk and Compliance as a Route

People from legal, finance, audit or administrative backgrounds may enter through information-security risk, assurance or compliance.

They should develop enough technical knowledge to understand controls and ask useful questions, while using their existing strengths in documentation and organisational processes.

Step 10: Create a UK-Focused CV and Application

A strong beginner CV should show evidence rather than simply list tools.

Include:

• A focused professional profile
• Relevant technical skills
• Practical projects
• Training and certifications
• Employment history
• Transferable achievements
• Education

Instead of writing:

“Knowledge of security monitoring.”

Write:

“Analysed sample authentication records, identified repeated failed access attempts and produced a documented incident timeline.”

Instead of:

“Excellent communication.”

Write:

“Explained technical account and software issues to non-technical users and documented resolutions for colleagues.”

Tailor each application. A SOC vacancy should emphasise monitoring and incident analysis. A GRC position should highlight risk, documentation and stakeholder communication. A cloud-focused position should highlight identity, permissions and logging.

Do not claim professional expertise after completing one guided exercise. Accurate language creates trust and makes interviews easier.

Where appropriate, include links to a clean portfolio or project repository. Make sure nothing you publish contains passwords, confidential information or data belonging to another person or organisation.

Step 11: Prepare for Cyber Security Interviews

Interviews often assess reasoning as well as memorised knowledge.

You may be asked:

• How would you investigate an unusual login?
• What is the difference between authentication and authorisation?
• Why is multi-factor authentication useful?
• How would you handle a phishing report?
• How would you prioritise several vulnerabilities?
• What information belongs in an incident report?
• Why is network segmentation useful?
• How would you explain a risk to a manager?

When you do not know the complete answer, explain what you would check, what evidence you would seek and when you would escalate.

Prepare examples showing teamwork, problem-solving, ethical judgement, communication and attention to detail. These examples can come from education, retail, administration, volunteering or another profession.

For experience-based questions, the STAR structure can help:

• Situation: What was happening?
• Task: What responsibility did you have?
• Action: What did you do?
• Result: What happened, and what did you learn?

Roadmaps for Different Starting Points

School or College Leaver

Consider a cyber-security technician or technologist apprenticeship, a computing course with practical content or a relevant university route.

Alongside formal study, build a small portfolio and develop networking, Windows and Linux fundamentals.

Do not overlook customer service, communication and teamwork. These skills matter when supporting users or working within a security team.

University Student or Graduate

Use projects, societies, placements, internships and graduate schemes to build experience. A non-cyber degree does not automatically prevent entry if you can demonstrate relevant skills.

Graduates in law, psychology, mathematics, engineering or business may find suitable routes into risk, awareness, intelligence or technical security after focused training.

Career Changer

Map your transferable skills before choosing training. Project management, audit, teaching, customer service, compliance and software development can all transfer into different cyber specialisms.

Avoid starting from zero unnecessarily. Build on what you already do well and add the technical knowledge required for the target role.

For example, an auditor may already understand evidence, risk and controls. A teacher may bring communication and learning-design skills. A software developer may be well placed to move towards application security.

Existing IT Professional

IT support, network, cloud and system-administration professionals often already possess valuable foundations.

Add security monitoring, risk, incident response and one role-relevant certification. Seek internal security responsibilities or projects where possible.

An internal move may be easier because the employer already knows your reliability and technical abilities.

A Practical 12-Month Cyber Career Path

The time required varies, but this structure provides a realistic starting framework.

Months 1–3: Build the Foundations

Study operating systems, networking, accounts and basic cloud concepts. Practise command-line navigation, user management and log review.

Create a simple network diagram and begin keeping records of your practical work.

Months 4–6: Add Security Skills

Learn common threats, incident response, vulnerability management and security monitoring. Complete your first two portfolio projects.

Begin reviewing entry-level job descriptions so your learning stays connected to employer requirements.

Months 7–9: Choose a Specialism

Review job descriptions and identify repeated requirements. Complete focused cyber security training or begin preparing for one relevant certification.

Build at least one project that closely matches the role you intend to pursue.

Months 10–12: Apply and Improve

Finish your portfolio, tailor your CV and practise interview questions. Apply for apprenticeships, junior cyber roles and related IT positions.

Continue learning from job descriptions and interview feedback. If direct cyber roles remain difficult to secure, include IT support, networking and cloud-support positions in your search.

This is a framework rather than a guarantee. Some people progress faster because they already have technical experience. Others need more time or benefit from an intermediate role.

Common Mistakes to Avoid

Chasing Every Cyber Specialism

Trying to learn penetration testing, cloud, forensics, GRC and malware analysis at the same time usually creates shallow knowledge. Build broad fundamentals, then choose an initial direction.

Collecting Certificates Without Projects

A certificate proves that you passed an assessment. It does not automatically show how you handle a practical situation. Pair qualifications with documented work.

Skipping Networking and Operating Systems

Security tools produce information about systems and connections. Without the fundamentals, their output is difficult to interpret.

Applying Only to Famous Employers

Large graduate schemes attract intense competition. Include smaller consultancies, managed service providers, local organisations and related IT roles in your search.

Ignoring Non-Technical Skills

Cyber professionals write reports, manage priorities and work with other teams. Communication and judgement can matter as much as a particular tool.

Practising Without Permission

Only use authorised training environments and systems you own. Responsible behaviour and respect for legal boundaries are essential to a cyber career.

Frequently Asked Questions

Can I Get Into Cyber Security in the UK Without a Degree?

Yes. Apprenticeships, professional courses, certifications, self-study and related IT experience can all provide routes into the field. Some employers still request degree-level education, so requirements vary.

Which Cyber Security Course Should I Take?

Choose a course that matches your current knowledge and target role. Check the prerequisites, practical work, assessment method and quality assurance before paying.

A learner with no IT background may need a broader computing or networking course before moving into specialist security training.

Which Cyber Security Certifications Are Best for Beginners?

Entry-level learners may consider ISC2 Certified in Cybersecurity, Microsoft Security, Compliance and Identity Fundamentals or CompTIA Security+. The best choice depends on the jobs and technologies you are targeting.

One suitable certificate supported by practical evidence is often more useful than several unrelated qualifications.

Are There Entry-Level Cyber Security Jobs UK Applicants Can Pursue?

Yes, although competition can be strong. Search for junior SOC analyst, cyber security technician, information-security assistant, junior risk analyst and identity-administration roles. Related IT support positions can also provide a valuable route.

Do I Need Coding Skills?

Not for every role. Basic scripting is helpful in security operations and engineering, while application security requires stronger programming. Governance, risk and awareness roles generally involve less coding.

Is a Security Analyst UK Role Suitable for Beginners?

Some analyst roles are entry-level, while others request previous IT or security experience. Read the duties and essential criteria instead of relying only on the job title.

How Long Does It Take to Enter Cyber Security?

There is no fixed period. A learner with IT experience may transition within months, while a complete beginner may need a year or longer to build the required skills and evidence.

Progress depends on the target role, study time, existing experience and availability of suitable jobs.

Is an Apprenticeship Better Than a University Degree?

Neither route is universally better. An apprenticeship provides paid work experience, while a degree may offer broader academic study and access to placements. The best choice depends on your learning style, circumstances and career goals.

Conclusion

Learning how to get into cyber security UK roles begins with a realistic plan. Build your knowledge of operating systems, networks, accounts and cloud services before moving into security monitoring, incident response and vulnerability management.

Next, choose a cyber career path that matches your interests. Compare cyber security training carefully, use certifications strategically and create practical evidence through authorised projects. Apprenticeships, degrees, professional courses and related IT roles can all provide valid entry routes.

Do not judge progress only by the number of certificates collected. Employers need people who can investigate carefully, communicate clearly and behave responsibly around sensitive systems.

Your first role may be a junior SOC position, a cyber-security apprenticeship or an IT support job that builds relevant experience. Once you have entered the field, you can move towards security analysis, engineering, cloud security, incident response, threat intelligence or another specialism that suits your strengths.