Should You Switch to Cybersecurity? Signs It's a Good Fit
A practical look at the monitoring, firewall work and incident write-ups that fill a security analyst's week, plus the tradeoffs before you retrain.
By Priya NatarajanOct 28, 2026 · 9 min read
Cybersecurity suits you if you like methodical investigation, written documentation and systems upkeep more than variety for its own sake. The U.S. Bureau of Labor Statistics projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than average, with about 14,100 openings a year over the decade — many from people transferring out of the occupation (U.S. Bureau of Labor Statistics, 2025).
Demand does not make entry easy. BLS lists a bachelor's degree plus fewer than five years of experience in a related occupation as the typical entry point, and notes many employers prefer candidates who already hold an information security certification (U.S. Bureau of Labor Statistics, 2025).
What the Job Actually Involves Day to Day
Most days rotate through the same handful of tasks rather than a new problem each morning.
- Monitoring and investigating. BLS describes monitoring the organization's networks for security breaches and investigating when one occurs as a core duty (U.S. Bureau of Labor Statistics, 2025). In practice: working alert queues in a SIEM, chasing false positives, closing tickets with notes on what you checked.
- Firewalls and encryption. You use and maintain firewalls and data encryption software, and encrypt data transmissions to conceal confidential information (U.S. Bureau of Labor Statistics, 2025; O*NET OnLine, U.S. Department of Labor). Expect rule reviews, change requests and disputes about which ports stay open.
- Vulnerability checks and simulated attacks. CareerOneStop describes analysts simulating attacks to find system vulnerabilities (CareerOneStop, U.S. Department of Labor). The output is a findings list someone then has to argue into a patch schedule.
- Virus and access upkeep. ONET lists monitoring reports of computer viruses to decide when to update virus protection, and modifying computer security files to incorporate new software or change access status (ONET OnLine). Routine, repetitive, unglamorous.
- Writing. Reports on breaches and attempted attacks, security standards, and recommendations to management (U.S. Bureau of Labor Statistics, 2025). The written record is the deliverable.
- User conversations. Conferring with users on data access needs and programming changes, and reviewing violations of security procedures with the people who committed them (O*NET OnLine). Some of those are awkward.
- Disaster recovery. Analysts are heavily involved in creating the organization's disaster recovery plan (U.S. Bureau of Labor Statistics, 2025) — tabletop exercises, runbooks, annual updates.
On meetings versus solo work: most of a normal day is solo console and document work, broken by a short daily stand-up and a weekly change or risk meeting. The mix shifts with the employer. A round-the-clock security operations centre on shift rotation is nearly all queue work plus a handover briefing; a government or regulated-industry ISSO role — one of the titles ONET reports for this occupation, alongside IT Security Analyst and Information Security Officer (ONET OnLine) — leans far more to meetings and paperwork. Incident weeks break the pattern entirely.
Signs This Career Fits You
Check these against things you have actually done, not how you would describe yourself.
- You have followed a problem through logs, exports or transaction records until you found the exact cause, and enjoyed the narrowing-down more than the fix.
- You write things down unprompted — runbooks, handover notes, a post-mortem nobody asked for. Breach reports and security standards are written products (U.S. Bureau of Labor Statistics, 2025).
- You have told a colleague no, politely and firmly, when a request broke a rule. Discussing security violations with violators is a listed task (O*NET OnLine).
- You tolerate repetitive upkeep. Updating virus protection and changing access status happens weekly, not quarterly (O*NET OnLine).
- You have changed a system you did not build — configured a router, set up MFA for a small team — without needing to understand everything first.
- You read vendor advisories or release notes voluntarily. Researching information security trends is part of the role (U.S. Bureau of Labor Statistics, 2025).
- You have done on-call before and found it manageable.
Signs It Might Not Be a Fit
- You do not want on-call or shift rotations. Monitoring networks and investigating breaches when they occur (U.S. Bureau of Labor Statistics, 2025) does not stop at 5pm, and operations-centre roles run nights and weekends.
- You want to avoid formal study. BLS lists a bachelor's degree as typical entry-level education and notes many employers prefer an information security certification (U.S. Bureau of Labor Statistics, 2025). Senior credentials take longer: CISSP requires five years of cumulative, full-time experience (ISC2).
- You dislike documentation. Much of the output is reports on breaches and attempted attacks, security standards and disaster recovery plans (U.S. Bureau of Labor Statistics, 2025).
- You want fast visible wins. Firewall rules, encryption and patch cycles are preventive, and success looks like nothing happening.
- You would rather not be the person blocking other people's work. Conferring with users on access needs and discussing procedure violations (O*NET OnLine) puts you in regular friction with colleagues.
- You are starting from zero technical exposure and want to be working in the field almost immediately. CompTIA recommends at least two years of IT administration experience with a security focus before Security+, even though the exam has no formal prerequisites (cybersecurityguide.org).
Skills You Already Have vs. Skills You'll Need to Build
| Skill you likely already have | Gap skill, and how to close it |
|---|---|
| Writing incident or complaint write-ups for managers | Structured breach reporting. Write five incident reports from publicly disclosed breaches, an evening each, and have a working analyst critique one |
| Help desk or desktop support troubleshooting | Firewall and encryption configuration (U.S. Bureau of Latbor Statistics, 2025). Build a home lab with an open-source firewall and a VPN tunnel using free virtualisation software — a few weekends |
| Audit, compliance or quality work | Security frameworks vocabulary. Read the current CISSP Exam Outline's eight domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, Software Development Security (ISC2) — a weekend of reading |
| Running drills, trainings or project coordination | Disaster recovery planning, which analysts are heavily involved in (U.S. Bureau of Labor Statistics, 2025). Draft and run a one-hour tabletop exercise for your current team — a couple of days of prep |
| Spreadsheet formulas, macros or any scripting | Log querying in a SIEM. Use a free community edition, ingest your own router logs, build three saved searches — a month of evenings |
| Networking basics from any IT role | CompTIA Security+ (SY0-701): voucher $425 in North America as of July 2025, exam up to 90 questions in up to 90 minutes (destcert.com, 2025), certification valid three years with several renewal options (cybersecurityguide.org). Network+ is recommended first, not required |
| No IT background at all | Formal training. CareerOneStop's Local Training Finder lists over 10,000 programs tied to this occupation, including certificate programs running 12 weeks to under a year built around the Certified Ethical Hacker exam (CareerOneStop, U.S. Department of Labor). Prices differ by state and institution — check the Finder for your ZIP code |
How to Test the Waters Before You Commit
- Read the occupation profile and write down your objections. Use the BLS Occupational Outlook Handbook entry for information security analysts and the O*NET OnLine task list. Cost: free, one evening. Outcome: a written list of the specific duties you would dread.
- Run two informational interviews with working analysts. Ask what their last three tickets were and how often they were paged after hours. Cost: free, about an hour each plus the time to arrange them. Outcome: two sets of notes naming real tasks and on-call frequency.
- Ask your employer for a shadow session with whoever handles IT security. Sitting next to the person managing firewall rules and access requests counts. Cost: a lunch hour or half a day of leave. Outcome: a confirmed calendar invite and a page of observations.
- Build one small lab and finish it. Stand up a virtual machine, enable full-disk encryption, configure a firewall rule set, then write a one-page README explaining what you did. Cost: nothing, using free virtualisation software; a few weekends. Outcome: a documented project you can show.
- Self-test against the Security+ SY0-701 exam objectives before paying. Score yourself domain by domain before spending the $425 voucher fee (destcert.com, July 2025). Cost: free, an afternoon. Outcome: a per-domain score showing how much study you need.
- Take on security-adjacent work where you already are. Ask to own phishing-report triage or the annual access recertification, or offer a small nonprofit an MFA rollout and a written access review. Cost: a few evenings a month. Outcome: a completed document and a reference who watched you produce it.
Frequently asked questions
Do I need a degree to get into cybersecurity?
BLS lists a bachelor's degree as the typical entry-level education for information security analysts, with fewer than five years of experience in a related occupation and no on-the-job training (U.S. Bureau of Labor Statistics, 2025). Many employers also prefer an information security certification; some certifications target entry-level workers, others experienced ones.
How long does it take to switch to cybersecurity from another job?
Plan in stages. Certificate programs listed in CareerOneStop's Local Training Finder for this occupation run from 12 weeks to under a year (CareerOneStop, U.S. Department of Labor). CISSP sits much later: ISC2 requires five years of cumulative, full-time experience across two or more of its eight domains.
Is CompTIA Security+ enough to get a cybersecurity job?
Often not on its own. The exam has no formal prerequisites, but CompTIA recommends at least two years of IT administration experience with a security focus, and Network+ first (cybersecurityguide.org). Pair it with evidence: a documented home lab, phishing triage at work, or a volunteer access review.
How much do cybersecurity analysts get paid?
Pay is usually a salary, sometimes with on-call or shift differentials, and differs by state, industry and clearance requirements. Check the BLS Occupational Outlook Handbook entry for information security analysts and CareerOneStop's occupation profile, which publish current national and state-level wage data you can filter by location.
Is cybersecurity still a good career to move into?
BLS projects 21 percent employment growth for information security analysts from 2025 to 2035, much faster than average, with about 14,100 openings each year over the decade, many as workers transfer occupations or leave the labor force (U.S. Bureau of Labor Statistics, 2025). CareerOneStop rates new job opportunities as "very likely."
Sources
- U.S. Bureau of Labor Statistics — Information Security Analysts : Occupational Outlook Handbook (2025)
- O*NET OnLine (U.S. Department of Labor) — Information Security Analysts at My Next Move
Your coach for this guide
Priya shapes the publication's coverage of job transitions, writing often about the messy middle between leaving one role and starting another. She's drawn to the quiet negotiations people have with themselves before a resignation letter gets written.
