learn / switching into cyber / sw3 · 1 of 1 · 8 min
The front door, the security doors and the side door — the real first jobs, and the ones that usually come later.
## The map
Very few people start with "security" in their first job title. Most take one or two steps to get there. Here's what the paths usually look like:
your current job
│
├─▶ IT help desk ─▶ sysadmin / network
│ │ │
│ ▼ │
├─▶ security analyst ◀─────┘
│ (security operations)
│
├─▶ compliance / audit ─▶ risk
│
└─▶ security in YOUR industry
(the side door)You don't have to take every step. But knowing the map helps you pick the shortest route from where you're standing.
## The front door: IT
IT support and help desk jobs are the most common way into the whole field. You reset passwords, set up laptops, fix email and talk to frustrated users.
Help desk is underrated as a security launchpad because you touch the exact things attackers go after: accounts, permissions, laptops and email. Use it on purpose:
- volunteer for anything security-flavored: phishing reports, new-hire access, offboarding
- learn the tools your security team uses and ask to shadow them
- write down every problem you solve. That becomes your portfolio and your interview stories.
Many people move from help desk to a security role at the same company within one to two years.
A retail store manager with no IT experience wants the most realistic first tech job. Which is it?
## The security doors
These are the most common first jobs with security in the title:
- Security operations center (SOC) analyst. You watch alerts, investigate the suspicious ones and escalate the real ones. It's the classic entry security role, often on shifts.
- Governance, risk and compliance (GRC) analyst. You help the company follow security rules and frameworks, gather evidence for audits and track risks. It's less technical to start and heavy on writing and organization.
- Vulnerability management analyst. You run scans, figure out which weaknesses matter most and chase teams to fix them.
- Identity and access management (IAM) analyst. You manage who can access what, handle new hires and departures, and review permissions.
- Security awareness and training. You build phishing drills and teach employees. It's a natural fit for teachers and trainers.
"You'll gather evidence for audits, track risks in a spreadsheet and write policies." Which role is this?
## The side door: your own industry
The quietest path is often the fastest. Become the security person where you already are.
Every hospital, school district, bank, factory and city government has security problems, and they'd love someone who understands both the work and the risk. Ask your IT or security team what they need help with. Join the committee that reviews policies. Offer to run the phishing awareness session. Take on projects with "access," "compliance" or "risk" in the name.
Internal moves work because the company already trusts you. That trust is the thing outside applicants have the hardest time proving.
## Doors that usually come later
Some of the most exciting jobs are rarely first jobs:
- penetration tester and red teamer
- malware analyst and reverse engineer
- threat hunter and detection engineer
- security architect
They're not off-limits. You'll get there faster by starting in a defensive or IT role and building up, rather than spending a year applying for jobs that want three years of experience. Capture-the-flag (CTF) competitions and homelab projects are how you build toward them on the side.
Put a common career-changer path in order, from first step to last.
- 1.IT help desk, volunteering for security tasks
- 2.Security operations center analyst
- 3.Current job, studying the basics on nights and weekends
- 4.Specialist role such as incident responder or detection engineer
## Write it down
Pick two target doors from this lesson: one you could realistically apply for within six months, and one stretch goal. Write each one at the top of a page. The next lessons build a plan backward from them.