Cyber Security Career Guide
Cyber security is not one career, it is a dozen. This guide maps the major roles, what each does, what it pays, and how to choose the one that fits you.
The two broad directions
Every security role sits on a spectrum from offensive to defensive. Offensive finds weaknesses; defensive stops attacks. Neither is better; they hire differently and pay differently at entry.
Offensive roles
| Role | What it does |
|---|---|
| Penetration tester | Attacks systems with permission |
| Red teamer | Simulates real adversaries |
| Bug bounty hunter | Finds bugs for rewards |
| AppSec engineer | Secures applications in development |
Defensive roles
| Role | What it does |
|---|---|
| SOC analyst | Monitors and responds to alerts |
| Detection engineer | Writes the detections |
| Incident responder | Handles active breaches |
| Threat hunter | Proactively finds intrusions |
Specialist roles
| Role | Demand |
|---|---|
| Cloud security engineer | High |
| AI security engineer | Rising fast |
| Digital forensics | Steady |
| Malware analyst | Steady |
How to choose
Two questions: do you want to attack or defend, and how fast do you need to be employed. Defensive is easier to enter with more openings. Offensive pays more at entry and is harder to break into.
Related
Frequently asked questions
Which cyber security role pays the most?
At senior level, cloud security and specialised offensive roles. At entry, offensive pays more than defensive.
Which role is easiest to get into?
SOC analyst, with the most openings and the lowest entry bar.
Can I switch roles later?
Yes, the fundamentals transfer. Many people start defensive and move offensive or vice versa.
Do I need a degree for a cyber security career?
No, though it helps HR screening at large firms. Skill and a portfolio matter more.
How do I choose a specialisation?
Try broad fundamentals first, then specialise into what you keep doing voluntarily.