Service Desk to Security.

How support experience can contribute to security work, and where investigation, engineering and governance ask for different evidence.

Verdict

Support experience can provide useful evidence of investigation, access handling and communication. Security roles then diverge: SOC work examines alerts, detection engineering builds and tests logic, and governance evaluates controls and risk. The useful comparison is the responsibility and supervision in a vacancy. There is no compulsory SOC detour or universal certification that makes every security role accessible.

Who this is for

·Support staff who enjoy investigating ambiguous incidents.
·People comparing SOC, identity, governance and engineering responsibilities.
·Career changers considering supervised security roles or apprenticeships.

Who this isn't for

·Readers looking for a guaranteed sequence of job titles.
·People seeking a detailed penetration-testing syllabus.
·Applicants looking for a universal certification shopping list.

Different security jobs use different evidence

An access request handled carefully can support an identity example. A recurring incident investigated beyond the immediate fix can support an operations example. Neither establishes that someone has designed a detection pipeline or led an independent audit.

A SOC can be a useful setting for learning investigation and escalation. Support, infrastructure, software, audit and supervised entry programmes can also lead towards security work. The suitable route depends on which responsibilities the person has already demonstrated.

What the UK evidence actually says

DSIT’s 2025 skills study analysed 2024 postings: 17% of core cyber advertisements asked for less than one year of experience and 63% asked for two to six years. These figures describe advertised requirements in that sample; they do not measure an individual’s hiring probability or establish that everyone needs prior support work.

Certifications support a particular purpose

Security+ can structure broad security learning and may meet a named vacancy requirement. Practical training can help someone rehearse investigation, but a course completion and independently performed work are different forms of evidence. The certification pages separate those purposes and link current prices.

CISSP covers technical and managerial domains, including security architecture and engineering. ISC2 normally requires five years of relevant experience across at least two domains, with a permitted one-year waiver for qualifying education or credentials. Passing the examination before meeting the experience requirements is distinct from becoming CISSP-certified. It is not a universal first-step requirement.

The failure mode: choosing a title without checking the rota

Some SOC roles operate shifts; others have different coverage arrangements. The useful questions concern actual nights, staffing, escalation, protected learning time and the work beyond triage. A title alone cannot answer them.

Moving from operations into detection or governance changes the work. It does not come with a predictable pay cut, pay rise or eighteen-month deadline. A bounded example of the new responsibility is more useful than waiting for an arbitrary anniversary.

Named observation

Cert Stacking

In this route, Cert Stacking means adding another examination while the missing evidence is still an investigation, a defensible escalation or a tested detection. Additional study can be useful when it addresses that specific gap.

The honest part

This guide does not measure certification shortlisting uplift, SOC attrition or a typical time to promotion. Requirements differ by employer and between the UK and US. The cited UK posting study is historical context, not a live vacancy feed.

Sources and scope · reviewed 24 September 2026

Getting into cybersecurity

Quick answers, then the full reasoning

Is there really a cyber skills shortage?: Yes, and entry is still hard. The 2026 government report shows both at once: steady demand for experienced people and employers calling junior hiring saturated. The 2026 market, read properly
What does a SOC analyst route actually look like?: Shift work, triage and a lot of noise before you get trusted with the interesting incidents. The realistic SOC analyst path
Is Security+ worth it in the UK?: It helps you pass a CV filter. It won't stand in for operational experience. Security+: overrated or useful?
How do people end up as security architects?: Usually years of operational ownership first. Nobody starts there. The realistic route to security architect

Related roles and certifications

Not sure which applies to you? Start with the Guided Route.

Next step

Pick the role you think you're aiming at and see what the route actually looks like from where you are. Honest, hop by hop, with the parts that tend to break.

Explore a route for your starting point