How to Switch to a Career in Cybersecurity From IT Support

How Your Background Transfers

Two support roles transfer especially cleanly, and they transfer differently.

User support specialist / tier-1 help desk. The Bureau of Labor Statistics (2025) notes that user support specialists typically need some college coursework, and that candidates may qualify with a high school diploma plus relevant IT certifications — so you are already on the credential ladder employers recognise. The tasks that count on a security CV are specific: resetting and disabling accounts in Active Directory or Entra ID, applying group policy, handling user-reported phishing emails, pushing patches through an endpoint management console, and documenting each action in a ticketing system. That last habit matters more than people expect — security operations work is ticket-driven, evidence-driven and time-stamped, and you have been doing that for years.

Network support specialist. The Bureau of Labor Statistics (2025) reports these roles typically need an associate's degree. The transferable work is firewall and VPN troubleshooting, reading packet captures, understanding DNS and DHCP behaviour, and knowing what normal traffic looks like on your network. CompTIA (undated) recommends at least one year of total IT experience including 9-12 months of hands-on network support or administration before sitting the Network+ (N10-009) exam — if you have been doing this job, you likely already meet that bar, which removes a step other career changers have to pay for.

Credentials you may already hold also carry over. The Bureau of Labor Statistics (2025) notes employers may prefer to hire information security analysts who hold professional certification. Certifications relevant to the occupation include Network+, Security+, Cybersecurity Analyst (CySA+), CompTIA's Advanced Cybersecurity Practitioner, Certified Ethical Hacker (CEH), CISSP and GIAC Information Security Fundamentals (King University Online, undated). If you already hold Network+, you are one exam into that list.

What does not transfer automatically: being the person who fixes things is not the same as being the person who decides what risk is acceptable. You will need evidence that you can investigate rather than only resolve.

Your Transition Timeline

Realistic total: 12 to 30 months from first study session to a role with security in the title. The short end applies if your current employer has a security team and you can transfer internally; the long end applies if you are also completing a degree or changing employers in a market with few junior openings.

• Months 1-3 — milestone: baseline networking credential. If you do not already hold CompTIA Network+ (N10-009), book it. CompTIA (undated) recommends about one year of total IT experience, including 9-12 months hands-on in network support, before attempting it. Cost: the current retail voucher price published by CompTIA plus any study materials — check CompTIA's site, as prices change. Time: 6-10 hours a week of study.
• Months 4-9 — milestone: Security+ passed and a documented home lab. Security+ is the common gate for junior security roles and appears on the list of certifications relevant to information security analysts (King University Online, undated). Budget for the voucher: mid-2025 sources quoted $425, and CertWizard listed a higher price as of September 2026 — check the current figure before you commit. Build a lab alongside it: a SIEM instance ingesting logs from two virtual machines, plus written incident notes.
• Months 7-12 — milestone: security tasks inside your current job. Volunteer for phishing triage, access reviews, patch compliance reporting or vulnerability scan follow-up. Cost: no money, roughly 3-5 hours a week. This is what turns "IT support" into the "work experience in a related occupation" the Bureau of Labor Statistics (2025) says is commonly needed for information security analyst roles.
• Months 10-18 — milestone: an analyst-level credential or a degree decision. CySA+ is the usual next step if you are targeting security operations. If you are aiming at employers that insist on a degree — the Bureau of Labor Statistics (2025) reports a bachelor's is typically the entry-level education — relevant programmes include Computer Science and Computer Systems Networking and Telecommunications (CareerOneStop, undated). Tuition varies enormously by institution and state; price two or three specific programmes before deciding.
• Months 12-30 — milestone: first security-titled role. Internal transfers usually land at the early end. External moves take longer because you are competing against candidates with existing security job titles.

Step-by-Step: Making the Switch

1. Audit your current duties against job postings. Pull ten junior security analyst adverts, list every requirement, and mark the ones you already do. Time: 2 hours. This tells you which exam to book first and which tasks to chase at work.
2. Book one exam with a fixed date. Open-ended study drifts. Pay for the voucher — check the certifying body's current published price, since the $425 figure quoted for Security+ in mid-2025 had risen by September 2026 (CertWizard, September 2026) — and schedule it 10-14 weeks out.
3. Build a lab you can describe in two minutes. Virtual machines, log forwarding into a SIEM, and a written record of three investigations you ran. Cost: free tiers and a machine with enough RAM. Time: 20-30 hours.
4. Ask your manager for security work in writing. Request phishing triage, quarterly access reviews or vulnerability scan remediation tracking. Time: one 20-minute conversation, then ongoing hours.
5. Meet the security team you already work beside. Attend their stand-up, ask to shadow one incident, and join a local security meeting or chapter event once a month. Time: 3-4 hours a month.
6. Rewrite your CV around investigation, not resolution. Replace "resolved 40 tickets a week" with what you checked, what you escalated and what tooling you used.
7. Prepare one sentence that explains the switch. Interviewers ask why you are moving; a vague answer reads as drift. Use the structure below.

When an interviewer asks why you are leaving support

"I've spent four years on the service desk, and the part of the job I kept volunteering for was phishing triage and access reviews. I passed Security+ in March, I run a home lab where I forward Windows event logs into a SIEM, and I'm looking for a role where that investigative work is the job rather than the overflow."

When they ask what you're missing

"I haven't owned a major incident end to end — I've supported them. That's the gap I'd want a first six months of mentoring to close, and it's why I'm applying to a team rather than a solo security post."

Before You Resign: Readiness Checklist

Do not hand in notice until you can tick every box.

• You have a signed offer, or a written internal transfer confirmation, for a role with security duties in the job description.
• You have passed at least one certification relevant to information security analyst work — Security+, CySA+, Network+, CEH, CISSP or GIAC Information Security Fundamentals (King University Online, undated) — and hold the certificate.
• You have six months of living expenses saved, calculated from your actual monthly outgoings.
• You have completed and documented at least three lab investigations, with written notes you can hand to an interviewer.
• You have performed security tasks in your current role — phishing triage, access reviews, patch or vulnerability remediation — and your line manager can confirm it as a reference.
• You have checked the current voucher price for your next exam on the certifying body's own site and budgeted for one retake.
• You have confirmed whether your target employers require a bachelor's degree, since the Bureau of Labor Statistics (2025) reports it is typically the entry-level education for information security analysts while some workers enter with a high school diploma plus industry training and certifications.
• You have applied to at least fifteen roles and attended at least two interviews, so your timeline is based on responses rather than assumptions.