Career paths

Four routes in. One foundation underneath.

Job titles vary by country and company. These are common shapes of the work, not a guarantee that any single certificate gets you hired.

Start with the foundation

Choose after the foundation, not before

Every path below uses the same base: how systems work, how networks talk, how permissions fail and how attackers think. Build that first. Then pick the day-to-day work you would actually enjoy.

SOC analyst

Blue team · Detection and response

Good fit if: You like investigation, patterns and calm decision-making under pressure.

A normal week

Triage alerts from endpoint, identity and email tools
Pivot through logs to decide whether activity is benign
Contain and escalate incidents, then write the timeline
Tune detections so the same noise does not return

Core skills

NetworkingWindows and LinuxLog readingSIEM basicsClear writing

Certifications to consider

CompTIA Security+
Blue Team Level 1
Microsoft SC-200

Reality check

Shift work is common in 24/7 SOCs. The job is more reading and judgement than Hollywood action.

First step: Finish the foundations track, then complete beginner rooms on a legal platform.

Start the foundation

Penetration tester

Red team · Authorised testing

Good fit if: You enjoy breaking things carefully, documenting precisely and explaining risk.

A normal week

Scope an engagement and agree rules with the client
Test web, network and cloud surfaces within the agreed boundary
Chain small findings into a realistic attack path
Write a report a busy engineer can act on

Core skills

Web securityNetworkingScriptingLinuxReport writing

Certifications to consider

eJPT
CompTIA PenTest+
OSCP (later, after real practice)

Reality check

Reporting is most of the job. Testing without written permission is a crime, not a shortcut.

First step: Master HTTP, Linux and one scripting language before buying an offensive course.

Start the foundation

IT support to systems administrator

Operations · The foundation of everything

Good fit if: You like making systems work reliably and helping people unblock themselves.

A normal week

Resolve account, device and access problems
Manage endpoints, patching and backups
Automate repetitive work with scripts
Document systems so the next person can operate them

Core skills

WindowsLinuxNetworkingPowerShell or BashCustomer communication

Certifications to consider

CompTIA A+
CompTIA Network+
MD-102
LPIC-1

Reality check

It is the most common entry point into IT and a strong route into security later. The pay starts lower; the foundation is broader.

First step: Build a small home lab and practise the tasks you would be paid to do.

Start the foundation

Governance, risk and compliance

GRC · Policy, audit and assurance

Good fit if: You like structure, writing, asking awkward questions and translating between teams.

A normal week

Maintain policies and control frameworks
Run risk assessments and vendor reviews
Prepare evidence for audits and certifications
Explain obligations to engineers without slowing them down

Core skills

RiskPolicy writingGDPRISO 27001Stakeholder communication

Certifications to consider

ISO 27001 Lead Implementer
CIPP/E
CISM (later)

Reality check

Less hands-on keyboard work, more reading and persuasion. Technical credibility makes you far more effective.

First step: Learn the CIA triad and threat modelling properly; they are the vocabulary of the field.

Start the foundation

A note on job titles

The same work can be called “security analyst”, “SOC analyst”, “cyber defence analyst” or “information security officer” depending on the employer. Read the job description, not the title. Look for the tools, the team and the outcomes you would own.

Career paths

Four routes in. One foundation underneath.

Job titles vary by country and company. These are common shapes of the work, not a guarantee that any single certificate gets you hired.

Start with the foundation

Choose after the foundation, not before

Every path below uses the same base: how systems work, how networks talk, how permissions fail and how attackers think. Build that first. Then pick the day-to-day work you would actually enjoy.

SOC analyst

Blue team · Detection and response

Good fit if: You like investigation, patterns and calm decision-making under pressure.

A normal week

Triage alerts from endpoint, identity and email tools
Pivot through logs to decide whether activity is benign
Contain and escalate incidents, then write the timeline
Tune detections so the same noise does not return

Core skills

NetworkingWindows and LinuxLog readingSIEM basicsClear writing

Certifications to consider

CompTIA Security+
Blue Team Level 1
Microsoft SC-200

Reality check

Shift work is common in 24/7 SOCs. The job is more reading and judgement than Hollywood action.

First step: Finish the foundations track, then complete beginner rooms on a legal platform.

Start the foundation

Penetration tester

Red team · Authorised testing

Good fit if: You enjoy breaking things carefully, documenting precisely and explaining risk.

A normal week

Scope an engagement and agree rules with the client
Test web, network and cloud surfaces within the agreed boundary
Chain small findings into a realistic attack path
Write a report a busy engineer can act on

Core skills

Web securityNetworkingScriptingLinuxReport writing

Certifications to consider

eJPT
CompTIA PenTest+
OSCP (later, after real practice)

Reality check

Reporting is most of the job. Testing without written permission is a crime, not a shortcut.

First step: Master HTTP, Linux and one scripting language before buying an offensive course.

Start the foundation

IT support to systems administrator

Operations · The foundation of everything

Good fit if: You like making systems work reliably and helping people unblock themselves.

A normal week

Resolve account, device and access problems
Manage endpoints, patching and backups
Automate repetitive work with scripts
Document systems so the next person can operate them

Core skills

WindowsLinuxNetworkingPowerShell or BashCustomer communication

Certifications to consider

CompTIA A+
CompTIA Network+
MD-102
LPIC-1

Reality check

It is the most common entry point into IT and a strong route into security later. The pay starts lower; the foundation is broader.

First step: Build a small home lab and practise the tasks you would be paid to do.

Start the foundation

Governance, risk and compliance

GRC · Policy, audit and assurance

Good fit if: You like structure, writing, asking awkward questions and translating between teams.

A normal week

Maintain policies and control frameworks
Run risk assessments and vendor reviews
Prepare evidence for audits and certifications
Explain obligations to engineers without slowing them down

Core skills

RiskPolicy writingGDPRISO 27001Stakeholder communication

Certifications to consider

ISO 27001 Lead Implementer
CIPP/E
CISM (later)

Reality check

Less hands-on keyboard work, more reading and persuasion. Technical credibility makes you far more effective.

First step: Learn the CIA triad and threat modelling properly; they are the vocabulary of the field.

Start the foundation

A note on job titles