IT professionals already do a large share of security work every day, but they often undersell it, chase entry certificates they do not need and apply for roles that ignore their strongest experience. This guide is for help desk analysts, system administrators, network engineers and cloud administrators who want to move into security. It maps each IT role to the security roles where its skills count most, shows which skills transfer directly and which gaps to close, recommends gap certifications rather than starter ones, and suggests portfolio projects you can build in your current job or a home lab. If you are changing career from outside IT, see the Career Change into Cyber Security Guide instead; this page assumes you already work in IT.
Key takeaways
- Move sideways, not back to the start. Each IT role has a natural security neighbour: help desk to SOC or IAM operations, sysadmin to security engineering or IAM, network engineer to network security, cloud admin to cloud security.
- Translate your work into security language. Patching is vulnerability remediation, account provisioning is identity lifecycle management, firewall changes are network security policy. Write your CV that way.
- Certify the gap, not the basics. An experienced sysadmin gains more from a role-specific certification such as Microsoft SC-300 or CompTIA CySA+ than from repeating fundamentals.
- Show evidence from your own estate. A hardening baseline you rolled out, a stale-account clean-up or a logging improvement in your current job beats any lab exercise.
- Identity is the shortest bridge. Most IT roles already touch accounts, groups, service accounts and access; IAM and machine identity roles value that experience directly.
What the role does
"Security" is not one destination. The roles below are the realistic first targets for people coming from IT, described by the work rather than the title. NIST's NICE Framework (Components v2.2.0 is the current version listed by NIST) describes work roles by task, knowledge and skill statements, and is the most useful neutral reference for matching what you do now to a security role. See the NICE Workforce Framework Guide.
| Target security role | What the work involves | Best IT starting point | Detailed guide |
|---|---|---|---|
| SOC analyst | Triage alerts, investigate endpoints and accounts, escalate incidents | Help desk, desktop support | SOC Analyst Career Guide |
| IAM engineer or analyst | Joiner, mover, leaver processes, MFA, SSO, access reviews, privileged access | Help desk, Windows or directory admin | IAM Engineer Career Guide |
| Security engineer | Build and run security tooling, hardening baselines, logging, automation | Sysadmin (Windows or Linux) | Security Engineer Career Guide |
| Network security engineer | Firewalls, segmentation, remote access, network detection | Network engineer | Network Security Engineer Career Guide |
| Cloud security engineer | Cloud IAM, guardrails, posture management, cloud logging and detection | Cloud or platform admin | Cloud Security Engineer Career Guide |
| Vulnerability analyst | Scanning, prioritisation, tracking remediation with system owners | Sysadmin, patching or endpoint team | Vulnerability Analyst Career Guide |
| NHI or machine identity engineer | Service accounts, API keys, certificates, secrets and workload identities | Sysadmin, DevOps, cloud admin | NHI and Machine Identity Engineer Career Guide |
Core skills and tools
The table separates what you already have from what you need to add. Be honest about the right-hand column: interviewers probe it.
| IT role | Skills that transfer directly | Gaps to close for security |
|---|---|---|
| Help desk and desktop support | Account resets and unlocks, MFA enrolment, endpoint troubleshooting, ticket discipline, spotting phishing reports, talking to stressed users | Log reading (Windows Security log, EDR alerts), attack techniques (MITRE ATT&CK basics), identity verification for resets, scripting basics |
| Windows or Linux sysadmin | Active Directory and Group Policy, patching, hardening, backups, PowerShell or Bash, service accounts, server logging | Threat modelling, detection logic, attacker paths through AD (Kerberos abuse, delegation), secure configuration benchmarks, secrets handling |
| Network engineer | Routing, switching, VLANs, firewall rules, VPN, DNS, packet captures, change control | Segmentation design for security, zero trust access, network detection (flow and DNS logs), firewall rule review for risk not just reachability |
| Cloud administrator | IAM roles and policies, infrastructure as code, tagging, cost and resource governance, cloud logging setup | Least privilege policy design, cloud threat detection, posture management, workload identity federation, incident response in cloud |
Common tools to learn: a SIEM query language (KQL or SPL), an EDR console, a vulnerability scanner, the Windows Security event log (for example event IDs 4624 logon, 4625 failed logon, 4720 account created, 4728 member added to a security-enabled global group), Sysmon, packet analysis with Wireshark, and the identity admin centre for your platform. See the Active Directory Security Monitoring and Event IDs Guide and the PowerShell Security Guide.
Where identity fits
Almost every IT role manages identities: user accounts, groups, admin rights and, increasingly, service accounts, API keys and cloud roles used by software. That experience is directly relevant to IAM, privileged access and machine identity roles, which are short of people who understand how systems actually authenticate. If you have ever owned a service account inventory, rotated a certificate or untangled who owns an API key, put it on your CV. See the Non-Human Identity (NHI) Guide.
Routes into the role
Help desk to SOC analyst or IAM operations
- Volunteer for the security queue: phishing reports, account lockout investigations, suspicious sign-in tickets.
- Learn to read the Windows Security log and your identity provider's sign-in logs; document three investigations you closed.
- Write or improve the identity verification procedure for password and MFA resets, a frequent social engineering target.
- Ask the SOC to shadow a shift; most internal moves start here.
Sysadmin to security engineer or IAM
- Apply a CIS Benchmark or vendor security baseline to a server group, measure before and after, and document exceptions.
- Inventory service accounts in your estate: owner, purpose, privileges, password age. Fix the worst five.
- Turn on and forward the logs your security team asks for; learn why they ask.
- Automate one security task (stale account report, local admin audit) in PowerShell or Python.
Network engineer to network security engineer
- Run a firewall rule review: unused rules, any-any rules, rules without an owner or ticket.
- Design a segmentation change for one sensitive zone and document the threat it reduces.
- Collect and analyse DNS or flow logs for anomalies, and share findings with the SOC.
- Learn zero trust network access models and how they replace flat VPN access.
Cloud admin to cloud security engineer
- Review IAM policies for wildcards and unused permissions; use your provider's access analysis tooling to right-size one account.
- Enable and centralise audit logging (for example AWS CloudTrail, Azure activity and sign-in logs, Google Cloud Audit Logs) and write two detections.
- Replace one long-lived access key with workload identity federation or a managed identity.
- Add policy-as-code guardrails to an infrastructure pipeline.
Portfolio projects: keep each one small, written up in a page with the problem, what you changed, how you tested it and the result. Never publish internal data, hostnames or screenshots from your employer; rebuild the idea in a home lab for public write-ups. See the Building a Cybersecurity Home Lab Guide and the Cyber Ranges, CTFs and Hands-On Training Guide.
Internal move or new employer: an internal move is usually faster because your current employer already trusts you with privileged access; the trade-off is that you may be asked to keep some IT duties for a while. Moving employer can bring a cleaner security title but you start without that trust. In small organisations the security role is often added to an IT job rather than created separately, which is a legitimate route; in large organisations look for formal rotation or apprenticeship schemes.
Watch for job scams: fake recruiters target IT and security job seekers with "technical tests" that install malware. See the Job and Task Scams Guide.
Certifications that help
Choose certifications that prove the gap you are closing. Experienced IT staff rarely need a pure entry-level course; a fundamentals certificate helps mainly when an advert or a government role lists it as a requirement. Check exam details on the issuer's own page before booking, because exam versions change.
| Route | Gap certification | What the issuer states (checked 8 November 2026) | NHIMG guide |
|---|---|---|---|
| Help desk to SOC | CompTIA CySA+ | Validates ability to detect, analyse and respond to threats; CompTIA recommends the new V4, with the English V3 exam retiring on 22 December 2026 | CompTIA CySA+ Guide |
| Help desk or sysadmin to IAM | Microsoft SC-300 (Identity and Access Administrator Associate) | 100-minute proctored exam covering user identities, authentication and access management, workload identities and identity governance; renew every 12 months with a free online assessment; English exam updated on 28 October 2026 | IAM Engineer Career Guide |
| Sysadmin to security engineer | ISC2 SSCP | Aimed at hands-on security operations practitioners; requires one year of work experience; positioned as a complement to Security+ | SSCP Certification Guide |
| Any route needing a baseline | CompTIA Security+ | Foundational security knowledge with no experience requirement (per ISC2's comparison) | CompTIA Security+ Guide |
| Network to network security | CCNA plus a security specialisation | See the CCNA guide for current exam facts | CCNA |
| Cloud admin to cloud security | AWS Certified Security Specialty, Google Professional Cloud Security Engineer, or CCSP for a vendor-neutral view | See each guide for current exam facts | AWS Certified Security Specialty Guide, CCSP Certification Guide |
This guide gives no salary figures: there is no official statistics series that isolates people moving from IT into security. For general certification planning, see the Cybersecurity Certifications Guide.
Progression
| First security role | Two to four years | Longer term |
|---|---|---|
| SOC analyst | Senior analyst, incident responder, threat hunter | Detection engineering, SOC management |
| IAM analyst or engineer | Senior IAM engineer, PAM engineer, identity governance lead | Identity architect, head of identity |
| Security engineer | Senior security engineer, security automation engineer | Security architect |
| Network security engineer | Senior network security or zero trust engineer | Network or security architect |
| Cloud security engineer | Senior cloud security, platform security lead | Cloud security architect |
Your IT background remains an advantage as you progress: architects and security leaders who have run production systems make more realistic decisions about change, outages and operational cost. See the Security Architect Career Guide and the Detection Engineer Career Guide.
Common failure patterns
- Starting from zero: spending a year on fundamentals you already know instead of closing one specific gap.
- Undersold CVs: listing "managed AD and patching" instead of "reduced privileged accounts by 40 per cent and cut critical patch time to 14 days". Use real numbers from your own work.
- Lab-only evidence: CTF badges with nothing from production, when hiring managers value changes you made to a real estate.
- Wrong target: aiming for penetration testing from help desk when SOC or IAM would value your experience now and still lead there later.
- Leaking employer data: publishing screenshots, configs or logs from work in a portfolio, which can end an application and breach your contract.
Practitioner checklist
- Pick one target role from the table and read its NICE work role task list.
- Rewrite your CV in security language with measured outcomes from your current job.
- Complete two security projects in your current role and write each up in one page.
- Learn one SIEM query language and the key Windows Security event IDs.
- Inventory and clean up service accounts or API keys you are responsible for.
- Choose one gap certification that matches your target role and check its current exam page.
- Ask your security team for shadowing, a secondment or a share of their queue.
- Verify every recruiter before running any test code or installing software.
Standards and references
- NIST: NICE Framework Current Versions
- Microsoft Learn: Identity and Access Administrator Associate (SC-300)
- ISC2: SSCP Systems Security Certified Practitioner
- CompTIA: CySA+ Cybersecurity Analyst
- Microsoft Learn: Event 4624 An account was successfully logged on
- CIS: CIS Benchmarks
Related NHI Mgmt Group resources: Career Change into Cyber Security Guide · Cybersecurity Careers Guide · SOC Analyst Career Guide · IAM Engineer Career Guide