Cyber security has many open roles and many applicants, yet employers still report skills gaps, because "cyber security" is not one job and most people aim at the wrong entry point. The field covers defence and operations, testing, engineering, architecture, governance, audit and leadership, and each needs different skills and a different first role. This guide maps the roles and the paths into them using the main skills frameworks (the NICE Framework, the European Cybersecurity Skills Framework, the UK Cyber Security Council's titles and CyBOK), explains entry routes and certifications in neutral terms, and shows how to build evidence of skill. It is written for students, IT staff moving into security, career changers, and the managers who hire and develop them. Identity, non-human identity and AI security are covered as specialisms in their own right.
Key takeaways
- Pick a role family, not "cyber". Operations, testing, engineering, governance and leadership need different skills; choose one target role and work back from its tasks.
- Use the frameworks as a map. NIST's NICE Framework (SP 800-181 Rev. 1), ENISA's ECSF (12 role profiles) and the UK Cyber Security Council's specialisms describe the tasks and knowledge for each role, so you can see your gaps.
- IT experience is the most common bridge. Service desk, system administration, networking, cloud and development roles teach the systems you will later defend; many first security roles are hybrid.
- Evidence beats claims. A small portfolio of write-ups, lab builds, detection rules or policy work, done legally, shows more than a list of course badges.
- Identity and AI security are growing specialisms. Many intrusions start with stolen or misused credentials, and organisations now run large numbers of machine identities and AI agents; skills here transfer across every role family.
How cyber security work is organised
Three frameworks describe the field in a structured way. They differ in origin and purpose, and you can use them together.
- NICE Framework (United States): NIST SP 800-181 Rev. 1 (November 2020) defines the structure: work is described as Task statements, paired with the Knowledge and Skill statements needed to perform them, grouped into Work Roles, Work Role Categories and Competency Areas. The content (the "components") is maintained separately from the publication; NIST lists components version 2.2.0 as current. CISA's NICCS describes components v1.0.0 (March 2024) as 7 Work Role Categories, 52 Work Roles, more than 2,200 TKS statements and 11 Competency Areas. Categories include Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation.
- European Cybersecurity Skills Framework (ECSF): ENISA's framework "summarises the cybersecurity-related roles into 12 profiles", each with titles, mission, tasks, skills, knowledge and competences. The profiles are Chief Information Security Officer; Cyber Incident Responder; Cyber Legal, Policy and Compliance Officer; Cyber Threat Intelligence Specialist; Cybersecurity Architect; Cybersecurity Auditor; Cybersecurity Educator; Cybersecurity Implementer; Cybersecurity Researcher; Cybersecurity Risk Manager; Digital Forensics Investigator; and Penetration Tester. ENISA states the framework is being revised, with a public consultation planned for the end of 2026.
- UK Cyber Security Council: established by Royal Charter as the recognised professional body, the Council awards four progressive professional titles (Associate, Practitioner, Principal and Chartered) within specialisms that include Cyber Security Governance and Risk Management, Security Testing, Audit and Assurance, and Incident Response. Registration requires evidence of competence and experience in the chosen specialism, assessed through licensed bodies, and NCSC uses these titles where its own schemes require professional recognition.
- CyBOK: the Cyber Security Body of Knowledge is a free reference covering 21 Knowledge Areas; version 1.2 (September 2026) revised the Secure Software Lifecycle and Software Security areas. Use it to fill knowledge gaps in theory, not as a job description.
| Framework | Owner | Unit of description | Best used for |
|---|---|---|---|
| NICE Framework (SP 800-181 Rev. 1) | NIST | Tasks, knowledge and skill statements; work roles; competency areas | Writing job descriptions, mapping training, US public sector roles |
| ECSF | ENISA | 12 role profiles with missions, tasks, skills and knowledge | European role design, curricula and recruitment |
| Professional titles and specialisms | UK Cyber Security Council | Specialism plus level (Associate to Chartered) | Professional recognition in the UK, NCSC scheme requirements |
| CyBOK | CyBOK project | 21 Knowledge Areas | Self-study, degree design, checking theoretical gaps |
Roles and what they involve
Job titles vary between employers, so read the tasks, not the title. The table groups common roles, maps each to its nearest ECSF profile and shows a typical way in. "Entry-friendly" means organisations commonly hire into the role with limited prior security experience; others usually need several years in a related role.
| Role | What you do | Nearest ECSF profile | Typical way in |
|---|---|---|---|
| SOC analyst | Triage alerts, investigate events in the SIEM and EDR, escalate incidents | Cyber Incident Responder | Entry-friendly; apprenticeships, graduates, service desk |
| Incident responder | Contain and recover from incidents, coordinate teams, write reports | Cyber Incident Responder | From SOC or system administration |
| Digital forensics analyst | Acquire and analyse disk, memory, cloud and mobile evidence with chain of custody | Digital Forensics Investigator | From SOC, IR or law enforcement |
| Malware analyst | Reverse engineer samples, extract indicators, write detections | Cybersecurity Researcher | From SOC or software development |
| Threat intelligence analyst | Track adversaries, map behaviour to ATT&CK, brief defenders and leaders | Cyber Threat Intelligence Specialist | From SOC, analysis or language backgrounds |
| Penetration tester | Test applications, networks and cloud under an agreed scope and report findings | Penetration Tester | From IT, development or a junior tester post |
| Security engineer | Build and run controls: EDR, email security, logging, hardening, automation | Cybersecurity Implementer | From system administration or networking |
| Cloud security engineer | Secure cloud accounts, workload identities, infrastructure as code and posture | Cybersecurity Implementer | From cloud engineering or DevOps |
| DevSecOps engineer | Put security tests, secrets handling and supply chain controls into pipelines | Cybersecurity Implementer | From software or platform engineering |
| IAM analyst or engineer | Run joiner, mover and leaver processes, SSO, MFA, privileged access and access reviews | Cybersecurity Implementer | Entry-friendly as analyst; from service desk or directory administration |
| GRC analyst | Maintain policies, risk registers, control testing and supplier assessments | Cybersecurity Risk Manager | Entry-friendly; from audit, compliance, project or legal roles |
| Security auditor | Assess controls against standards such as ISO/IEC 27001 and report independently | Cybersecurity Auditor | From IT audit or GRC |
| Security architect | Design secure systems and patterns, set standards, review designs | Cybersecurity Architect | After several years in engineering |
| Deputy CISO, CISO, field CISO | Run the programme, budget and board reporting; a field CISO advises a vendor's customers | Chief Information Security Officer | Senior leadership after technical or GRC careers |
| AI red teamer | Test AI models, applications and agents for prompt injection, data leakage and tool misuse | Penetration Tester or Cybersecurity Researcher | From penetration testing, ML engineering or application security |
| Bug bounty hunter | Find and report vulnerabilities through public or private programmes for rewards | Penetration Tester | Self-directed; usually alongside another job |
UK employer demand gives a sense of where roles are. The DSIT report Cyber security skills in the UK labour market 2026 (published 29 September 2026) found that Security Manager (27%), Security Analyst (26%) and Security Engineer (21%) made up the largest shares of core cyber job postings in 2025, and that the most requested skills after cyber security itself were auditing (22%) and governance (20%).
Entry routes
Apprenticeships
In England, apprenticeship standards set out the role and assessment. The Level 3 Cyber security technician standard (ST0865) has a typical duration of 18 months and describes "first line cyber security support"; typical job titles include junior SOC analyst, junior penetration tester, incident response technician and access control administrator. Degree apprenticeships exist too, and some are NCSC certified. The DSIT 2026 report records a 15% fall in enrolment on cyber-specific apprenticeships between 2023/24 and 2024/25, so places can be competitive.
Degrees
NCSC certifies degree apprenticeships (including Scottish Graduate Apprenticeships), bachelor's, integrated master's and master's degrees, at full or provisional status. Certification can apply to a specific pathway within a degree, and NCSC states: "If a degree doesn't appear here, it does NOT have NCSC Certification." Check the current NCSC list and the expiry date before you enrol. A computing, engineering or mathematics degree with security modules is also a sound base.
Moving from IT
This is the most direct route. A service desk analyst already handles account resets and MFA; a Windows or Linux administrator already manages patching, logs and privileges; a network engineer already reads firewall rules; a developer already writes code that a DevSecOps team secures. Ask for security work in your current role (patching reports, access reviews, logging projects), then apply internally.
Career changers from outside IT
Transferable experience matters more than many expect. Auditors, risk and compliance staff, lawyers and project managers move into GRC and audit; police and military staff move into investigation, forensics and intelligence; teachers move into security awareness and training. Expect to add technical foundations (networking, operating systems, cloud basics, identity) before or alongside the move.
Internships, graduate schemes and competitions
Internships and graduate schemes at large employers, government departments and consultancies give structured rotation across teams. Capture the flag competitions and student societies help you practise and meet employers.
Certifications by body and level
Certifications are a filter in many job adverts, but none replaces experience. Choose one that matches your target role and the level you can evidence. The table is neutral and not a ranking; check each body's current eligibility rules, experience requirements and renewal conditions before paying.
| Body | Examples | Level | Focus |
|---|---|---|---|
| CompTIA | Security+, CySA+, PenTest+, SecurityX | Foundation to advanced | Broad security, analysis, testing, enterprise architecture |
| ISC2 | CC, SSCP, CISSP, CCSP | Entry to experienced | Broad security management and operations; cloud security |
| ISACA | CISA, CISM, CRISC | Experienced | Audit, security management, risk |
| GIAC | Role-specific certifications (for example incident handling, forensics, cloud) | Intermediate to expert | Hands-on technical specialisms |
| CREST and The Cyber Scheme | Practitioner and registered tester exams | Intermediate to senior | Penetration testing and assurance in UK schemes |
| OffSec | OSCP and others | Intermediate to expert | Practical offensive security exams |
| Cloud providers | Security specialty or role-based security certifications | Intermediate | Security of a specific cloud platform |
| IDPro | CIDPRO | Intermediate | Identity and access management practice |
| UK Cyber Security Council | Associate, Practitioner, Principal, Chartered (titles, not exams) | Career stage | Professional registration by specialism |
Building a portfolio
A portfolio turns "interested in security" into evidence. Keep it public where possible, and never include employer data, client findings or anything covered by a non-disclosure agreement.
- Home lab: build a small domain with a domain controller, a Windows client and a Linux server in free or low-cost virtual machines, send logs to a free SIEM, then attack and detect your own lab. Document what you built and why.
- Detection work: write and test detection rules (for example Sigma rules for suspicious PowerShell or new service creation) and explain the ATT&CK technique each covers. See the Detection Engineering Guide.
- Write-ups: publish analysis of retired capture the flag challenges or public incidents, focusing on root cause and controls rather than tools.
- Code and automation: small scripts that parse logs, check cloud configuration or rotate a test secret show engineering skill. Never commit real keys or tokens to a public repository.
- GRC artefacts: a sample risk register, a policy mapped to ISO/IEC 27001:2022 Annex A, or a supplier assessment for a fictional company shows governance skill.
- Stay legal: test only systems you own or are explicitly authorised to test. In the UK, unauthorised access is an offence under the Computer Misuse Act 1990; bug bounty work is permitted only within the programme's published scope and rules.
Identity, NHI and AI security as specialisms
Identity is central to defence because many attackers simply log in with stolen credentials rather than break in. Many incidents on this site started with a stolen credential or token, such as the Snowflake breach, where infostealer credentials without MFA opened customer data warehouses.
- Workforce IAM: SSO, MFA, joiner-mover-leaver processes, access reviews and privileged access. A good first step for service desk and directory administrators. See IAM and IGA Basics and the Privileged Access Management Guide.
- Non-human identity (NHI): service accounts, API keys, OAuth apps, certificates and workload identities, which need inventory, ownership, least privilege and rotation. Suits engineers from cloud, DevOps and platform teams. See the Service Account Security Guide and the Secrets Management Guide.
- AI security: securing LLM applications and agents, testing for prompt injection, and governing what agents can access. Roles include AI red teamer, AI security engineer and AI governance lead. See the LLM Security Guide, the Agentic AI Security Guide and Red Teaming AI Agents for Identity Abuse.
Pay, demand and progression
Treat salary figures with care: they vary by country, sector, region, clearance and contract type. For the UK, the DSIT 2026 report found a mean advertised salary of £60,800 for a core cyber job posting in 2025, with a median of £58,050. The same report estimates 145,900 people in the UK cyber security workforce (December 2025), records 34,932 core cyber job postings in 2025, and estimates "a total supply requirement of approximately 10,200 per year" for 2026. It found that 57% of businesses had a basic technical skills gap, up from 49% the year before. Advertised salaries are not offers, and entry-level pay is well below these averages.
Progression usually follows one of two tracks:
- Technical track: analyst or engineer, then senior, lead and principal engineer or architect. Depth in one specialism, such as cloud, identity or detection, is what moves you up.
- Management track: team lead, security manager, head of a function, deputy CISO and CISO. Budget, risk communication and people management become the core skills; a field CISO role suits leaders who prefer advising many organisations.
Small organisations hire generalists who cover operations, IAM and compliance at once, which builds breadth fast but gives less mentoring. Large organisations, consultancies and managed security providers offer specialist teams, structured training and rotation, which suits early careers.
A 12-month plan for moving into security
- Months 0 to 1, choose and baseline: pick one target role, download its ECSF profile or NICE work role, and mark each task you can already do. This is your gap list.
- Months 1 to 3, foundations: networking, Windows and Linux administration, cloud basics and identity basics. If a certification suits the target role, prepare for one entry-level exam only.
- Months 3 to 6, hands-on: build the home lab, complete two documented projects relevant to the target role, and join a local security group or online community.
- Months 6 to 9, evidence at work: volunteer for security tasks in your current job (access reviews, logging, patch reporting, a risk register) and record outcomes.
- Months 9 to 12, apply: tailor applications to the tasks in each advert, show portfolio links, and apply internally as well as externally. If interviews stall, return to your gap list rather than adding unrelated certificates.
For employers, the same frameworks support hiring and development: map each security role to NICE work roles or ECSF profiles, write adverts around tasks rather than long certificate lists, and offer apprenticeships or internal moves from IT before hiring externally.
Measuring progress
Whether you are an individual or a team lead, a few measures show whether development is working:
- Task coverage: percentage of tasks in the target ECSF profile or NICE work role you can evidence.
- Portfolio output: number of documented projects or write-ups completed per quarter.
- Interview conversion: share of applications that lead to interviews; a low rate points to CV or targeting problems.
- Internal mobility (employers): share of security vacancies filled from inside the organisation.
- Time to productivity (employers): weeks until a new starter handles work unsupervised.
- Retention (employers): 12-month retention of security hires.
Common failure patterns
- Collecting certificates instead of skills: several entry-level badges with no hands-on evidence rarely beat one certificate plus a strong lab write-up.
- Aiming only at penetration testing: it is a popular target with limited junior openings; SOC, IAM and GRC roles often offer a faster first step.
- Skipping IT foundations: without networking, operating system and identity basics, alert triage and incident work are hard to learn.
- Unauthorised testing: scanning or probing systems without permission can end a career before it starts.
- Leaking secrets in public projects: committing cloud keys or tokens to a public portfolio repository exposes them to automated harvesting, the same way exposed .env files were harvested in the 230 Million AWS Cloud Environments campaign.
- Job titles over tasks: applying by title alone leads to mismatched roles; read the duties and map them to a framework profile.
Practitioner checklist
- Choose one target role and download its ECSF profile or NICE work role.
- List the tasks you can already evidence and the gaps you need to close.
- Close foundation gaps in networking, operating systems, cloud and identity first.
- Build a legal home lab and document at least two projects tied to the target role.
- Take on security tasks in your current job and record the outcomes.
- Pick certifications by role and level, after checking eligibility and renewal rules.
- Check NCSC certification and apprenticeship standards before committing to a course.
- Consider identity, NHI or AI security as a specialism that transfers across roles.
- Keep public repositories free of real secrets and employer data.
- Review your plan each quarter against your progress measures.
Standards and references
- NIST: SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework)
- NIST: NICE Framework Current Versions
- ENISA: European Cybersecurity Skills Framework (ECSF)
- NCSC: About the UK Cyber Security Council
- CyBOK: The Cyber Security Body of Knowledge
- NCSC: NCSC-certified degrees
- DSIT: Cyber security skills in the UK labour market 2026
- Skills England: Cyber security technician apprenticeship standard (ST0865)
Related NHI Mgmt Group resources: IAM and IGA Basics · Incident Response Guide · Threat Intelligence Guide · AI Governance Guide · NHI and IAM Glossary