Skip to content
CertGPS
Career path

From IT Support to Cybersecurity: Building on the Security Work You Already Do

How help desk and systems staff move into security: the NICE tasks they already perform, BLS data on the three jobs, and when to take Network+, Security+ and SSCP.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

From IT Support to Cybersecurity: Building on the Security Work You Already Do

Resetting passwords, patching servers and editing group policies all appear in NIST's task lists for support and administration jobs, and each one has a security purpose. Moving into a security job mostly means doing more of that work on purpose, keeping a record of it, and adding the certification that names it. For most help desk and systems staff, that's Security+ first, then SSCP once you can show a year in its domains.

The security work hidden in an IT job

The NICE Workforce Framework (NIST SP 800-181), the US government's catalog of cybersecurity work, puts Systems Administration (IO-WRL-005) and Technical Support (IO-WRL-007) in its Implementation and Operation category. Read their task lists and the overlap with security is plain. A systems administrator is expected to maintain baseline system security, administer user accounts, write group policies and access control lists, and keep servers updated. A support technician implements the organization's security policies and is expected to judge the operational impact of a security lapse.

What changes in a security role is the direction of attention. The Defensive Cybersecurity work role (PD-WRL-001) is about analysis: spotting anomalous network activity, detecting intrusions, isolating malware and resolving incidents. You move from keeping systems in the right state to noticing when they've left it and working out why. If you've handled a malware cleanup, or a locked-out account that turned out to be an attack, you've done the second kind of work already. The task is to do it often enough that you can describe it in an interview.

Three jobs in the Bureau of Labor Statistics data

The Bureau of Labor Statistics (BLS) Occupational Outlook Handbook covers all three steps of this move. Its figures, from the May 2025 wage data and the 2025–35 projections:

BLS occupationJobs, 2025Median pay, May 2025Projected change, 2025–35Typical entry-level education
Computer support specialists903,100$62,890−3%Some college or an associate's degree; a high school diploma plus IT certifications can qualify
Network and computer systems administrators323,600$99,130−4%Bachelor's degree
Information security analysts192,900$129,180+21%Bachelor's degree

The security occupation is the smallest of the three. BLS projects about 48,700 openings a year for support specialists and 13,400 for administrators, mostly to replace people who leave, against about 14,100 for security analysts. And BLS says outright that many security analysts have worked in an IT department, often as network and computer systems administrators. In this data, IT is the usual route into security.

Turn your current job into documented experience

Start inside your own employer. Ask to take the security-flavored tickets: the multifactor authentication rollout, vulnerability scan findings that need patching, phishing reports from users, firewall change requests. Ask the security team whether you can have read access to the SIEM (security information and event management system) and shadow a few alert reviews. An internal move has one advantage over an outside application: the security team has already seen your work.

Keep a running record as you go, with dates, hours and what you did. It pays off twice. You'll need it for interview stories, and ISC2 will ask for it. The SSCP requires one year of full-time experience in one or more of its seven domains, which include access controls, incident response and recovery, and network and communications security. ISC2 counts part-time work of 20 to 34 hours a week pro rata, with 2,080 hours equal to a year. A systems administrator who has spent a year provisioning accounts, patching and handling incidents may already qualify.

The certifications, in order

If networking still feels shaky, start with Network+ ($399). CompTIA recommends A+ and 9 to 12 months of network support work, and it maps Network+ to the DoD 8140 technical support specialist, network operations specialist and system administrator roles. Skip it if you already configure VLANs and read packet captures at work.

Security+ ($439) comes next. CompTIA writes it for about two years of hands-on security or systems administration, which matches a working administrator better than a beginner. Its largest domain, Security Operations, has scenario objectives on firewall changes, identity and access management, and investigating with log data, all things an administrator can practise on real systems. Decide on the version first: SY0-801 is expected to launch on or around November 17, 2026, and SY0-701 retires in English on June 11, 2027. Passing Security+ also renews Network+ without a fee, because Security+ sits above it in CompTIA's certification hierarchy.

SSCP ($249) is the one that rewards IT experience directly, since you need that year or an accepted degree to hold it. It's a two-hour adaptive exam of 100 to 125 items, and ISC2 lists it as approved under DoDM 8140.03. Upkeep costs $135 a year and 60 continuing professional education (CPE) credits per three-year cycle. Without the year or an accepted degree, you can pass and become an Associate of ISC2, with two years to earn the experience. Security+ and SSCP are both on ISC2's list of credentials that waive one year of the five that CISSP requires.

After that, the job you're aiming at decides. Moving into a SOC means CySA+ eventually, but CompTIA writes it for about four years of analyst work, so treat it as a second-job credential. If your employer runs Microsoft 365, SC-200 ($165) tests Defender XDR and Sentinel, and an administrator who already knows the tenant has a head start. Network engineers have their own route, covered in our network-to-security path.

What we'd do with one year

We'd spend it at the current employer. Take the security tickets, keep the log of hours, pass Security+ in the first half of the year and sit SSCP when the year of experience is documented. Then apply for the analyst post, inside or outside, with two certifications and a year of security work you can describe in detail. At CompTIA's $439 and ISC2's $249 list prices, that sequence costs $688 in exam fees, and you keep your salary throughout.

Readers without an IT job yet should start with our route from no experience. Readers already in a SOC can pick up the analyst career ladder.

Sources