Is a Career in Cybersecurity Right for You?
A look at the monitoring, investigation and report-writing behind security work, plus the certifications and IT background most people build first.
Cybersecurity suits people who like picking apart how systems fail and who can stay calm while sorting a real intrusion from a false alarm. Day to day it looks less like hacking in the dark and more like working alert queues, patching weaknesses before someone else finds them, and explaining risk to people who do not work in IT. The U.S. Bureau of Labor Statistics (2025) lists the core duties of information security analysts as monitoring networks for breaches, maintaining firewalls and data encryption programs, checking for vulnerabilities, researching IT security trends and preparing reports.
If you enjoy that mix of pattern-spotting and clear writing, the fit is good. If you want work that always ends at 5pm with no chance of a callout, read the hours section before you commit.
What This Career Involves Day to Day
A typical shift starts with the alert queue. You open the SIEM dashboard and work through overnight detections: a flagged login from an unusual country, a laptop that ran an unrecognised script, forty failed authentication attempts against one mailbox. Most are noise. You check the authentication logs and the endpoint detection console, decide the country alert was a salesperson on a hotel VPN, and close it with a note explaining why.
By mid-morning you are on the vulnerability scanner output. A scan has found unpatched software on a dozen servers, so you rank them by exposure, raise tickets for the server team and agree a patch window. Someone in finance forwards a phishing email; you pull the headers, check the sending domain and block it at the mail gateway before anyone else clicks.
Afternoons tend to be testing and writing. You might use Wireshark to inspect captured traffic from a suspect host, review firewall rules nobody has touched in two years, or check that data encryption is configured correctly on a new file share. Then comes the monthly report for management: open risks, incidents handled, what you recommend spending on next. Preparing reports is part of the formal duty set (U.S. Bureau of Labor Statistics, 2025), not an afterthought.
Signs This Career Might Suit You
- You have set up a firewall rule or built a home lab because you wanted to see how it worked, not because a class told you to.
- You read an error log line by line instead of skimming, and you notice when one timestamp does not match the others.
- You can explain a technical problem to a non-technical colleague without making them feel stupid — a skill BLS (2025) lists alongside analytical ability.
- You enjoy puzzles hidden in ordinary-looking data, and you do not mind that most leads turn out to be nothing.
- You think about how a system could be abused, not just whether it works; BLS (2025) names creative skills for that reason.
- You follow breach write-ups or vendor advisories on your own time, and researching IT security trends is an actual duty (U.S. Bureau of Labor Statistics, 2025).
Signs This Career Might Not Be for You
- Interruption is constant. A ransomware alert can land at 4:45pm and keep you working late, and many teams run an on-call rotation that means answering the phone at 2am.
- Much of the work is repetitive triage. You will close dozens of alerts that turn out to be a user travelling or a misconfigured backup job, and people who need novelty every hour tend to leave monitoring roles within a year or two.
- You will tell colleagues no. Blocking a tool someone wants or forcing a patch window in a busy period means regular pushback, sometimes from people who outrank you.
- The documentation load is heavy. Incident write-ups, risk registers and monthly management reports take hours, and analysts who dislike writing find that is where most of their frustration comes from.
- Being wrong is visible. Missing a real intrusion inside a pile of false positives affects the whole organisation, and some people find that responsibility wearing rather than motivating.
Skills and Traits That Matter Most
| Skill/Trait | Why It Matters on the Job |
|---|---|
| Analytical skills | Deciding whether that overnight login from an unusual country is a travelling salesperson or an account takeover means correlating authentication logs and endpoint data before you escalate. |
| Detail orientation | Firewall rules and encryption settings fail on single characters, so reviewing rules nobody has touched in two years only works if you read each one properly. |
| Communication skills | The monthly management report has to turn twelve unpatched servers into a ranked list of business risks an executive will fund. |
| Creative skills | Spotting how an attacker might abuse a new file share or a legitimate admin tool means imagining misuse no alert rule covers yet. |
| Tolerance for routine | Most alerts in the queue close as noise; the discipline is checking the boring ones as carefully as the alarming ones. |
| Prioritisation under pressure | When a phishing campaign and a patch deadline collide, you decide what gets blocked now and what waits for the agreed window. |
BLS (2025) names analytical skills, communication skills, creative skills and detail orientation as important qualities for information security analysts.
Pay, Hours, and Outlook
| Topic | What to check |
|---|---|
| Median annual wage | The U.S. Bureau of Labor Statistics publishes a median annual wage for information security analysts in its 2025 occupational profile — look the current figure up there rather than trusting job-ad claims. |
| Typical hours | Most information security analysts work full time (U.S. Bureau of Labor Statistics, 2025); on-call and night-shift rotations depend on the employer. |
| Employment and growth | BLS (2025) publishes the number of these jobs in 2025, the projected growth rate and numeric change for 2025–35, and projected annual openings over the decade, most of which come from replacement needs. |
| Where the jobs are | BLS (2025) lists the largest employing industries; employers include consultancies, financial firms, hospitals, universities and government agencies, with the mix varying by state and metro area. |
The source for all of the above is the BLS Occupational Outlook Handbook, updated regularly; treat it as the baseline rather than salary-aggregator sites. Pay is usually an annual salary, sometimes with an on-call stipend or shift differential, and it varies by state, industry, employer size and whether a security clearance is required. For local figures, check your state labor market information agency. Advancement typically runs toward leading a team of analysts, or a chief security officer or other computer and information systems manager role (U.S. Bureau of Labor Statistics, 2025).
How People Usually Get Started
- Build the IT foundation. Many analysts have prior experience in a related IT role, often as a network and computer systems administrator (U.S. Bureau of Labor Statistics, 2025); one to three years on a help desk or in systems administration teaches you how accounts, networks and servers normally behave.
- Get the education employers expect. BLS (2025) publishes the typical entry-level education for the occupation; a bachelor's degree in computer science or information technology, about four years, is the common route, though some employers accept an associate degree plus experience and certification.
- Earn an entry-level security certification. Many employers prefer candidates with information security certification, and some certifications target entry-level workers (U.S. Bureau of Labor Statistics, 2025). CompTIA Security+ is earned by passing one exam with multiple-choice and performance-based questions on securing applications, networks and devices, threat analysis and response, and risk management; most candidates prepare for two to three months alongside a job.
- Move into a monitoring or junior analyst role. Security operations teams at managed service providers, banks, hospitals and government contractors hire at this level and train on their own tooling. Expect one to three years of alert queues, phishing triage and vulnerability scan follow-up.
- Add an experienced-level credential when you qualify. ISC2 requires CISSP candidates to hold a minimum amount of cumulative, full-time experience in at least two of the eight CISSP domains (ISC2, 2026), reducible with a qualifying degree or approved credential, plus endorsement and ongoing commitments.
- Choose a direction — incident response, cloud security, penetration testing or governance and risk — or move toward leading a team of analysts or a chief security officer role (U.S. Bureau of Labor Statistics, 2025).
Frequently asked questions
Do I need a degree to work in cybersecurity?
Not universally, but it is the common path. BLS (2025) publishes a typical entry-level education level for information security analysts, and many postings ask for a bachelor's degree in a computing field. Some employers substitute hands-on IT experience plus a certification such as CompTIA Security+, and requirements differ by employer, industry and state, so read the actual postings in your area first.
Can I start with no IT experience at all?
It is harder than most adverts suggest. BLS (2025) notes that many information security analysts have prior experience in a related IT role, often as a network and computer systems administrator. A realistic sequence is one to three years in help desk or systems administration, because triaging a suspicious login requires knowing what a normal login looks like.
Is the work stressful or physically demanding?
It is not physically demanding — you spend most of a shift at a desk across multiple monitors. The pressure comes from live incidents interrupting planned work, on-call rotations at some employers that mean answering calls overnight, and regular disagreement when you block a tool or insist on a patch window. People who dislike confrontation or unpredictable evenings struggle more than people who dislike technical complexity.
Which certification should I take first?
CompTIA Security+ is a common first step and is earned by passing a single exam with multiple-choice and performance-based questions on securing applications, networks and devices, threat analysis and response, and risk management. BLS (2025) notes some certifications target entry-level workers and others experienced ones. Save CISSP for later: ISC2 requires cumulative full-time experience in at least two of the eight CISSP domains, reducible with a qualifying degree or approved credential.
What does progression look like after a few years?
BLS (2025) notes analysts may advance to lead a team of analysts, or move into a chief security officer or other computer and information systems manager role. Others stay technical and specialise in incident response, cloud security or penetration testing. Which route exists depends on employer size — a small company may have one security person, while a bank has layered teams.
Sources
- U.S. Bureau of Labor Statistics — Information Security Analysts : Occupational Outlook Handbook (2025)
- CompTIA — How Do I Get My CompTIA Security+ Certification?
Written by
Felix writes a column on the inner life of work — burnout, ambition, the quiet math people do about whether a job is worth it. He prefers plain language to management jargon and says so often.
