Cyber Security Career Paths for People Coming from IT Support

If you’ve spent a few years on the helpdesk, you already know more about security than you might think. You’ve reset locked accounts at 8am on a Monday, spotted a phishing email before anyone else in the office, worked through a laptop build that wouldn’t join the domain, and calmed down the user who swore they didn’t click the link but whose password was clearly on a sticky note. That experience is a real starting point for a cyber security career, and it’s one of the most common routes into the field.

This guide covers what your experience already gives you, the roles you can realistically move into, the certifications worth considering, and a practical plan for making the switch.

What you already have

Helpdesk and support roles build skills that security teams need, even if they don’t look like security on your CV.

Identity and access management. Password resets, MFA issues, account lockouts, and joiner-mover-leaver processes are core security work. Many real-world breaches start with an account that should have been disabled, or a permission that should never have been granted. You’ve handled that day to day.

Endpoint knowledge. You understand Windows and macOS builds, patching cycles, device management, and what a normal laptop looks like when it’s behaving and when it isn’t. Security teams struggle to find people who understand the endpoint from the user’s side.

Triage under pressure. Your queue taught you how to prioritise, which tickets are urgent, and when to escalate rather than hold on to a problem. SOC work depends on exactly this skill.

Communication with non-technical people. You’ve explained to a director why their laptop needs a reboot, or why they can’t use their personal email for client files. Security roles often involve translating risk into plain language for people who don’t want to hear it, and that’s harder than it sounds.

Documentation habits. If you’ve written knowledge base articles or handover notes, you already understand the discipline that governance and incident reporting depend on.

The job isn’t to start from zero. It’s to reframe what you’ve been doing in security terms and then fill the gaps.

Where you could go next

SOC Analyst (Tier 1)
Security Operations Centre roles involve monitoring alerts from a SIEM, triaging suspicious activity, and escalating confirmed incidents to Tier 2. You’ll spend your time reading logs, checking whether a login from an unusual country is a traveller or an attacker, and deciding whether an alert is noise. It’s the most common first security role for people coming from support, and it teaches you how attacks look in real data. Expect shift patterns in some organisations, and a steep learning curve in the first six months.

Identity and Access Analyst
If you’ve administered Active Directory or Entra ID, this is one of the most natural moves. The work covers access reviews, conditional access policies, privileged access management, and identity governance. As more organisations move to cloud identity, demand for people who understand identity deeply is growing. This route also tends to be less shift-based than SOC work, which suits people who want predictable hours.

Vulnerability Management Analyst
You’ll scan environments, track vulnerabilities across the estate, prioritise them by risk, and work with infrastructure and application teams to get them fixed. Your experience with patching cycles and getting people to actually reboot their machines is directly relevant. The job is less about finding vulnerabilities and more about getting them closed, which is a skill many security teams lack.

Security Engineer
Security engineers build and maintain the tools: firewalls, endpoint detection and response platforms, email security gateways, SIEM rules, cloud security controls. This usually comes after a year or two in a more junior role, once you’ve developed the scripting and architecture knowledge to design controls rather than just operate them. If you enjoy automation with PowerShell or Python, this is where that interest pays off.

Governance, Risk and Compliance (GRC) Analyst
GRC roles involve working with security policies, audits, risk registers, and frameworks such as ISO 27001, Cyber Essentials, and sometimes SOC 2. You’ll run risk assessments, chase evidence from other teams, and help the business understand what its security posture actually is. This is a good fit if you like structure, documentation, and seeing how a business works as a whole, and it can be a strong route for people who want less hands-on technical work over time.

Cloud Security Analyst
Securing Azure, Microsoft 365, and other cloud environments is one of the fastest-growing areas in UK security hiring. If you’ve worked on Modern Workplace projects, migrations to Microsoft 365, or Intune rollouts, you already understand part of the problem. Learning how Defender for Cloud, Sentinel, and Entra ID protection fit together can move you into this area quickly.

Penetration Tester or Security Consultant
This is a longer-term route rather than a first step. Some people from support move into offensive security after building a strong technical base, usually through a lab-heavy learning path and a certification such as OSCP or a CREST-accredited route. It’s competitive and demanding, but it’s worth knowing it exists so you can plan towards it.

Certifications worth considering

Certifications won’t replace experience, but they help your CV clear the first filter, and they give you a structured way to learn the material. Pick them to match the role you want, not the one with the most noise around it.

CompTIA Security+
The most widely recognised foundation certification across UK employers. It covers threats, architecture, identity, risk, and operations at a level that suits someone starting out. Many job adverts list it as a requirement or a preference.

ISC2 Certified in Cybersecurity (CC)
A newer entry-level certification designed for people starting their security careers. It’s a good option if you want a vendor-neutral starting point and a lighter study load before committing to Security+.

CompTIA CySA+
A logical next step for SOC and security analyst roles. It focuses on threat detection, log analysis, and incident response, which are the day-to-day skills of a SOC analyst.

Microsoft SC-900 and SC-200
SC-900 covers the fundamentals of security, compliance, and identity in Microsoft environments. SC-200 is the more practical credential for people working with Microsoft Sentinel and Defender. These are particularly valuable if you’re in a Microsoft-heavy environment, which many UK employers are.

GIAC and CompTIA PenTest+
These are worth looking at once you’ve settled into a specialism. They go deeper into specific areas and carry weight in technical hiring, though they’re more expensive and assume a solid base.

A realistic sequence for many people is Security+ or the ISC2 CC first, then SC-200 or CySA+ depending on the role you’re targeting, and then something more specialised later.

A practical plan for making the switch

Changing careers rarely happens in one jump. Most people move over 12 to 18 months through a series of small, deliberate steps. Here’s one way to structure it.

Months 1 to 2: Map and assess
Write down everything you’ve done in your current role and translate it into security language. “Reset passwords” becomes “managed identity lifecycle and MFA enforcement.” “Ran the patch cycle” becomes “maintained endpoint patch compliance across the estate.” Recruiters and hiring managers search CVs for terms like these, so using them matters. Look at ten or fifteen job adverts for the role you want and note the words they repeat.

Months 2 to 4: Build foundations
Start studying for your first certification. Set a fixed study schedule, even if it’s only four or five hours a week, and book the exam early so you have a deadline. Alongside the certification, learn the basics of networking, Linux command line, and a scripting language such as PowerShell or Python.

Months 3 to 6: Build a lab and show your work
You don’t need expensive equipment. Free trials of Microsoft Sentinel, Splunk, or open-source tools like Wazuh let you practise log analysis and detection. Try working through a few scenarios: investigating a suspicious sign-in, analysing a phishing email, or reviewing a simulated malware alert. Write up what you did. A short blog post or a GitHub repository with notes shows employers that you can do the work, not just pass an exam.

Months 4 to 8: Get security-adjacent experience where you are
Ask your manager for work that touches security. Offer to help run phishing simulations, carry out access reviews, document the joiner-mover-leaver process, or work on a patching project. Even if your job title doesn’t change, the experience goes on your CV and gives you something concrete to talk about in interviews.

Months 6 to 12: Apply and interview
Start applying for SOC analyst, identity, or vulnerability roles. Expect to hear back from some employers and not from others. Interviews for junior security roles often include a technical scenario, such as walking through how you’d investigate an alert or what you’d check after a suspicious login. Practise talking through your reasoning out loud, because interviewers care about how you think as much as whether you know the answer.

Ongoing: Keep reading
Follow UK-focused security resources such as the NCSC’s guidance and threat reports, read public incident write-ups, and keep up with changes in the Microsoft security stack. Security moves quickly, and the people who progress are the ones who keep learning.

Common mistakes to avoid

Applying for the wrong level. Many people from support aim straight for senior roles and get frustrated. Entry-level SOC or identity analyst roles are the realistic first step, and they lead somewhere.

Certifying without practising. A certificate with no hands-on work behind it is weak evidence. Pair every study session with something you’ve actually built or investigated.

Leaving your support experience off your CV. Recruiters value it. Describe it in security terms, but don’t hide it.

Ignoring shift patterns. Some SOC roles run 24/7 rotas. Check the shift pattern before you accept an offer, not after.

Waiting until you feel ready. Most people who make the move feel underqualified when they apply. Employers are generally hiring for potential and a strong foundation, not for someone who has already done the job.

Is this the right move for you?

Cyber security is demanding. It involves on-call work, shift patterns in some SOCs, and constant learning as threats and tools change. Some days you’ll spend hours chasing an alert that turns out to be nothing. Other days you’ll be the person who spots something serious and stops it.

It’s also varied, well regarded, and offers real room to specialise over time, whether that’s in identity, cloud, engineering, governance, or offensive work. Salaries for security roles in the UK generally sit above comparable IT support and infrastructure roles once you’re established, though the early years are often more modest.

If you’re already curious about how attacks happen and how to stop them, that curiosity is the most important qualification you can bring. The technical skills can be learned. The instinct to ask “what would an attacker do with this?” is harder to teach.

If you’re thinking about a move into security and want to talk through the options in the market, get in touch with the Shape IT Recruitment team. We work with cyber security and Microsoft-focused employers and we’re happy to give you an honest view of what hiring managers are looking for right now