Chapter 2 of 12 · Months before applying
Choosing a first direction
- Which area of security should I go into?
- What do these job titles actually do all day?
- What if I pick the wrong one?
Security has many kinds of work, and the job titles do not always explain them. The good news is that your first direction is not a life sentence. Many people move between areas, and early experience in any of them is useful in the others.
Some common starting points
| Area | What the work looks like | Suits people who |
|---|---|---|
| Security operations (SOC) | Watching alerts, investigating what happened, escalating real problems | Like puzzles and can stay calm under pressure |
| Governance, risk and compliance (GRC) | Policies, audits, risk registers, working with the business | Like writing, structure and talking to many teams |
| Application security | Reviewing code and designs, helping developers fix flaws | Enjoy programming and building things |
| Cloud security | Securing cloud accounts, permissions and configuration | Like infrastructure and automation |
| Penetration testing | Testing systems as an attacker, with permission, and writing reports | Are persistent and enjoy writing up findings |
| IT with a security focus | Managing accounts, devices and patching securely | Want a practical route in through IT support or admin |
How to choose
- Try a small hands-on task in two or three areas: triage some logs, read a policy, review some code.
- Notice which one you lost track of time in.
- Look at real job adverts in your area for that direction. Note the skills that keep appearing.
- Talk to one person who does the job, if you can. Ask what a normal week looks like.
The question you might not ask out loud
Everyone says pentesting is the exciting one. Should I aim for that?
Aim for what you enjoy doing week after week, not what looks exciting. Much of any security job is careful, repetitive work and writing. If you enjoy the everyday part of a role, the exciting parts are a bonus.
Rule of thumb:Your previous career is not wasted. Teachers explain things well, nurses triage under pressure, accountants understand controls and audits, support staff know how users really behave. Say so in your applications.
Write your chosen direction down, with one sentence on why. It will guide which cert to take, what to put in your homelab and how to describe yourself on your CV.
If two areas still feel equally interesting, pick the one with more entry-level openings near you or in remote roles you can reach. You can always learn the other one later, and real work experience in either makes the switch easier than starting from scratch.