Cyber security is a fun, exciting, and fulfilling career that will reward and challenge you equally. However, for those looking to jump into this hot and evolving field, it can be difficult to know where to start. That’s where our cyber security career path comes in!
The cyber security career path is a roadmap to your dream cyber security job. It will help you understand what knowledge, skills, and certificates are required to achieve your professional goals and have a prosperous career. If you want to be a cyber security consultant, malware analyst, penetration tester, SOC analyst, or any other cyber security role, the cyber security career path has you covered.
Let’s jump in and explore the five stages of this comprehensive roadmap to achieving your cyber security career success.
Knowledge, Skills, and Certifications
The cyber security career path will take you from an entry-level newbie to a domain-level expert. Before looking at the five stages that will take you there, it’s important to understand what is required to navigate the cyber security career path.
To land a job in cyber and progress in the cyber security career path, you need knowledge, skills, and certificates:
- Knowledge: Your understanding of IT systems and concepts. Knowledge allows you to understand how things work, acquire skills, and use technologies.
- Skills: Your practical ability to perform an IT or cyber security role. This includes troubleshooting, analyzing log files, setting up a network, testing systems, and investigating incidents. You can learn more in Top Cyber Security Skills You Need for an Exciting Career.
- Certificates: These prove your knowledge and skills in certain IT domains and show to an employer you are ready for a job. An entry-level cyber security certificate shows you are ready to enter the field, a cloud security certificate shows you have the skills to work with cloud technologies, a pentesting certificate demonstrates your ability to perform penetration testing, and a security management certificate shows you are ready to be a manager.
You use knowledge, skills, and certificates to advance through the cyber security career path and progress towards your professional goals. Some of the skills and certifications you acquire will apply everywhere, such as Security+, whereas as you move up the career path, others are specific to your career goals. For example, if you want to become a penetration tester, the OSCP certification is a good one to get.
Now you know what moves you through the cyber security career path, let’s see how it works with its five-stage model.
The Stages of a Cyber Security Career Path
The cyber security career path has been broken down into five stages that will take you from entry-level to domain expert. Each stage comprises skills, knowledge, and certificates you must acquire to move on to the next stage and progress in your career.
As you progress, the skills and knowledge you acquire will accumulate and build upon one another. For instance, the basic IT and networking skills you acquire at Stages 1 and 2 are required to learn the skills and knowledge you must gain at Stage 3 to find a general cyber security role.
The five stages of the cyber security career path are:
- Stage 1: Essential IT Knowledge - This is where everyone entering the IT field starts. You need to learn the basics of a computer system, how it works, and how to effectively use it.
- Stage 2: Networking - Once you know how systems work, you can learn how systems are connected to share information and how to build enterprise networks.
- Stage 3: General Cyber Security - Building on the foundational knowledge you have acquired, this stage is where you learn how systems, networks, and data are secured by learning a broad range of cyber security-specific skills.
- Stage 4: Advanced General or Speciality Skills - Once you know the basics, you can progress onto learning cyber security skills and knowledge that allows you to become either an advanced cyber security generalist or a cyber security specialist.
- Stage 5: Expert in Cyber Security - After many years in the field, you may have enough skills, knowledge, and experience to progress onto Stage 5 and find a career in governance or as a specialist expert.
Cyber security begins at Stage 3 of the career path. At this stage, you have a strong foundation in general IT and networking, and you can now use this foundation to learn cyber security-specific skills and start your cyber security career. Read Top 10 Careers in Cyber Security (and Which Is Right for You?) to learn about your potential careers.
Let’s now take a deep dive into the roles offered at each stage of the cyber security career path. We will start with the cyber security feeder roles available at Stages 1 and 2, then move on to cyber security-specific roles at Stages 3 through 5.
Feeder Roles
The first two stages of the cyber security career path are Essential IT and Networking. In these two preliminary stages, you learn the basics of IT, how to perform troubleshooting, and how to become a power user. You also learn how to connect systems to share information, how Windows Active Directory works, and how to set up enterprise networks. These two stages provide you with the strong fundamentals required for a career in cyber security.
To land a feeder role, give The Best IT Certifications for Beginners a read. It will provide you insight into what employers are looking for and the best certificates to demonstrate you have these skills.
At Stages 1 and 2, you will work in a feeder role, leading you to a cyber security position at Stage 3. Let’s look at some of these common feeder roles.
Feeder Roles:
- Graduate: Recent undergraduate or postgraduate in a technical field.
- IT Support: Reviews, troubleshoots, and fixes organizational technology issues.
- Networking Engineer: Designs, develops, and manages enterprise networks.
- Systems Administrator: Builds, configures, and maintains computer operations for a company.
- Financial and Risk Analyst: Identifies and evaluates potential threats to a business's assets, earning potential, and success.
- Software Developer: Designs and builds computer programs to meet a client's needs.
Why Are They Important?
If you’ve been trying to get a cyber security role lately, you will have quickly seen that every company says they want experience for an entry-level position. How are you supposed to get this experience? Feeder roles. They allow you to gain experience in IT/networking and build up your transferable knowledge, skills, and experience so that when you apply for a cyber security role, you can demonstrate your capabilities.
How Do Feeder Roles Assist You?
Cyber security affects every IT role, from a support engineer to a system administrator to a software developer. Everyone needs to know a little about security to keep themselves and customers safe. This means that any feeder role you choose will provide you exposure to some cyber security stuff. You will get the opportunity to familiarize yourself with security technologies, frameworks, and concepts, which you can list on your CV and talk about in job interviews.
Are They Always Necessary?
A feeder role is not always necessary to land a position in cyber security. Sometimes, you may get the opportunity to jump straight into the field. However, the entry-level job market for cyber security is very competitive. Having a feeder role on your resume that demonstrates you have the fundamental skills and knowledge required to succeed in an entry-level cyber security role can set you apart from the competition.
Does a Feeder Role Dictate Your Future Career?
No. It doesn’t matter which feeder role you start your cyber security career with. They all lead to a general cyber security role at Stage 3 of the cyber security career path. This is because they are all tertiary roles that are cyber security adjacent. They provide you with some exposure to cyber security, but most importantly, ensure you have strong fundamentals in IT and networking.
Stage 3: General Cyber Security Careers
Once you develop a strong foundation in IT/networking and gain some experience in a feeder role, you are ready to progress to Stage 3 of the cyber security career path. At this stage, you are ready to take on an entry-level cyber security role!
These roles are “general” cyber security positions and cover various cyber security domains, such as audit, offensive, operations, privacy, and sales. Each role covers a broad range of cyber security skills and knowledge but at a shallow level.
General cyber security roles allow you to grow as a cyber security professional by exposing you to more security technologies, frameworks, and concepts at a high level. Let’s look at some of these roles in detail.
General Cyber Security Roles:
- Vulnerability Tester: Identifies potential security holes within an organization’s technical infrastructure and security controls.
- Cyber Security Administrator: Installs, deploys, administers, and troubleshoots an organization's security solutions.
- Cyber Security Analyst: Protects an organization from cyber threats by monitoring networks and systems, analyzing log files, and triaging alerts. Also, helps design and implement secure network and system architecture.
- Junior Penetration Tester: Designs, implements, and executes testing of a client’s systems to uncover security vulnerabilities or failures in technical security controls. This activity is overseen by a senior penetration tester.
- Security Auditor: Determines whether security controls and system configurations meet organizational policies, standards, and governmental regulations.
- SOC Analyst: Monitors an organization's security solutions, analyzes and intercepts log data, responds to security incidents, and collaborates with others to develop and implement security strategies and policies.
Skills Expected for Stage 3 Roles
At Stage 3 of the cyber security career path, you are expected to have a strong foundation in essential IT knowledge (Stage 1) and networking (Stage 2) skills. However, to land a Stage 3 role, you will also need some cyber security-specific skills, such as risk management, cryptography, identity access management, knowledge of how to secure systems, and incident response, to name a few.
The roles you apply for at this stage will usually require basic security certification, such as Security+, or minimal experience where you can demonstrate you have some of the cyber security-specific skills the role requires. You are not expected to be a master at any one of these skills, only to have a broad range of general knowledge.
At all stages of the cyber security career path, you need to work hard to continuously develop your skills. That said, Stage 3 is perhaps the most important stage for continuous learning and development as it is here where you will begin to acquire the cyber security-specific skills that set you apart from the competition and qualify you for new and exciting roles. It is vital you spend your time at this stage developing your skillset!
What Role Is Right For Me?
There is a wide range of roles to choose from at this stage, and it can be difficult to know if your chosen role is right for you. It is important to remember there are no “good” and “bad” choices at this stage. You are just trying to get into the industry, so grab what you can!
Once you land a general cyber security role, you can build up your skills, knowledge, and experience to apply for the role you really want. It is much easier to transition between cyber security positions once you are in the industry and have a few years of experience than jumping straight into your dream role.
Stage 4: Advanced Cyber Security Careers
With a strong foundation and some general cyber security skills under your belt, you are ready to buckle down and specialize. Advanced cyber security careers found at Stage 4 of the cyber security career path require you to choose an area of cyber security to focus on. This could be penetration testing, threat hunting, malware analysis, DevSecOps, or even a GDPR position. These careers are what most people think of when they first start their cyber security journey.
At this stage, you need to choose which specialist career you want to focus on so you can begin developing the skillset required to perform this role. But before you do that, the first choice you need to make is whether you want to progress your cyber security career into a generalist or a specialist position.
What Are Generalist and Specialist Positions?
Advanced generalist cyber security positions are typically management roles requiring in-depth knowledge about cyber security frameworks and standards, industry-specific regulations and compliance requirements, and strong communication and leadership skills. Meanwhile, specialist positions require you to niche down and become an expert in one or two areas of cyber security to the point where a generalist will come to you for your authoritative knowledge and specific skillset.
Choosing between a generalist or specialist position will depend on many factors, including your work style, social skills, technical abilities, and future career aspirations. You likely made the choice when you first started the cyber security career path, as these roles are what most people entering cyber security envision themselves doing. Yet this may have changed along the way as you discovered how cyber security really works. To help you make an informed decision, let’s look at each and the roles they offer.
Advanced Generalist Careers
Advanced generalist careers focus on non-technical and managerial knowledge and skills, such as risk assessments, regulatory frameworks, and privacy laws. You need to have strong social skills to succeed in these positions and a wide range of knowledge on many cyber security topics. These positions set you up to become a key decision-maker in an organization later in your career as you progress onto the C-suite. An advanced generalist will pursue certifications such as the CISSP, CIPT, or CISA to qualify for these positions.
Advanced Generalist Roles:
- Cyber Security Specialist: Ensures client systems, networks, data, and infrastructure are protected by technical safeguards and policies.
- Cyber Security Architect: Plans, designs, tests, and maintains the cyber security architecture of an organization.
- Cyber Security Consultant: Examines and assesses an organization’s current security posture and offers advice on improving it. They can be a freelancer, contractor, independent consultant, or an associate of a consulting firm.
Specialist Careers
A specialist will focus on becoming an expert in one or two areas of cyber security. You will need to master the technical skills and have a firm understanding of complex computing topics to be successful in a specialist position.
These positions require you to develop a skill set that allows you to perform a specific function in an organization very well, such as penetration testing, threat hunting, digital forensics, or malware analysis. An advanced generalist will come to you for advice on your area of expertise.
Advanced Cyber Security Specialist Roles:
- Cyber Security Researcher: Conducts research in cyber security and incorporates the results into solutions that improve the security of computer systems and networks.
- Cloud Security Engineer: Designs, builds, configures, and maintains a secure cloud environment for an organization’s cloud-native applications.
- Malware Analyst: Analyzes and examines malicious software to write detections that protect an organization against it.
- Cyber Crime Analyst: Investigates crime that has taken place in the digital realm and usually involves performing digital forensics on systems. The work can be performed for a government agency or within the private sector.
- Data Protection Officer and Privacy Analyst: Ensures an organization applies data protection laws to all individuals’ personal data when gathering, processing, and storing said data.
- Incident and Intrusion Analyst: Called in after a cyber security incident or breach to minimize damage and stop further threat escalation.
- Security Software Developer and DevSecOps: Ensures code is developed securely in delivery, maintenance, updates, and when disposed of.
- Penetration Tester: Tests the security of a client’s systems or network by attempting to hack into it. Read How to Become a Penetration Tester: The Ultimate Guide for a comprehensive guide.
Stage 5: Expert Cyber Security Careers
The final stage of the cyber security career path is Stage 5. This is where you qualify as an expert after years of experience in the industry performing either an advanced generalist or specialist role. An expert is on the cutting edge of their niche, they hold advanced certifications or qualifications, and others seek them out for advice.
Not everyone reaches this stage of the cyber security career path. Often people will jump between Stage 4 positions to suit their personal needs and career aspirations. However, if you spend long enough at a specific Stage 4 role and prioritize developing your skills over an extended period, you may be able to reach this stage.
Everyone should aspire to reach Stage 5 of the cyber security career path and become an expert, even if that’s not possible. The ultimate goal of the career path is that you always continue learning and improving your skills and knowledge so you stay relevant in the industry and have a fulfilling career.
Expert cyber security careers can be split into two types of roles; expert governance and specialist expert.
Expert Governance Roles:
- Chief Privacy Officer: Manages risks related to information privacy laws and regulations.
- Cyber Security Lawyer: Specializes in the legal issues related to protecting information and data from cyber threats. Can perform litigation work against a company that breaks the law or advisory work for a company to help guide them.
- Chief Information Security Officer (CISO): Manages an organization’s cyber security strategy and ensures all digital systems, services, and assets are adequately protected. It is among the highest organizational positions a cyber security professional can attain.
- Cyber Security Manager: Oversees their organization’s information security requirements, protocols, and procedures.
Specialist Expert Roles:
- Cryptographer: Designs and develops complex security systems using ciphers and algorithms to encrypt and protect sensitive data.
- Security Engineer: Designs, develops, implements, and tests security solutions that support the cyber security posture of an organization.
- Cyber Threat Hunter: Proactively protects an organization by searching for and identifying potential cyber threats within an organization's networks and systems.
- Enterprise Security Architect: Creates an enterprise’s cyber security architecture and ensures the business strategy and cyber security are aligned.
The below image aids in visualizing how different cyber security careers connect to each other, and at what stage each sits. While the vastness of the cyber security career landscape makes it impossible to list and organize every cyber security career, we are presenting some of the most popular and requested.
Conclusion
The cyber security career path is a roadmap you can use to navigate the cyber security industry, direct your career, and land your dream job. Its five stages take you from learning the IT fundamentals to being an expert in one of many cyber security fields. This article detailed the skills and knowledge required at each of the career path’s stages and the roles these qualify you for.
If you need help using the career path, try our accelerator program. This program guides you through using the career path by connecting you with mentors, providing you with a career toolkit, and tailoring a custom study roadmap to land you a cyber security job. It teaches you how to gain experience using projects that show prospective employers you have what it takes to fill your ideal cyber security position. There’s even a certificate to add to your resume!
If you are just looking to elevate your cyber security skills and progress your career through courses, we have you covered there as well:
Frequently Asked Questions
Level Up in Cyber Security: Join Our Membership Today!
