Breaking In 01 — The Lay of the Land

Part of the Breaking Into Security field guide.

"Cybersecurity" on a job board covers wildly different work. The fastest way to make sense of it is four families. Most people build a career inside one of them, with side trips.

Defense (the blue team)

The people watching for attacks and responding when they happen. This is where most of the jobs are, and the most common entry point.

• SOC analyst — the front line. You work in a Security Operations Center, triaging alerts: is this login from Latvia an attack or a VP on vacation? Tier 1 is the field's classic first job. It can be grindy, but you'll see more real attack traffic in six months than most people see in years.
• Incident response / DFIR — when something has happened, these folks figure out what, how far it spread, and how to evict the attacker. Digital forensics (the "DF" in DFIR) is the evidence side. Usually a step up from SOC work.
• Detection engineering — instead of triaging alerts, you write the logic that generates them. Half security knowledge, half software craft. A great fit for people with a dev background.
• Threat intelligence — tracking attacker groups, tooling, and campaigns so the defense knows what's coming. More research and writing than hands-on-keyboard.

Offense (the red team)

The people paid to break in so the defense can fix the holes.

• Penetration tester — scoped, authorized attacks against a client's systems, ending in a report. The report matters as much as the hack; good writing is half the job.
• Red team — longer, sneakier engagements that test whether the blue team detects a realistic adversary, not just whether a vulnerability exists.
• Bug bounty — freelance vulnerability hunting on platforms like HackerOne. Real skill-builder, brutal as a primary income.

Offense gets the movie glamour, but it's the smallest family by headcount and the hardest to enter directly. Most good pentesters did defense or engineering first — you break things better when you know how they're built and run.

Security engineering

The people building the guardrails, and the family most undersold to career-changers — it's the natural landing spot if you come from IT or development.

• Infrastructure / cloud security — hardening networks, servers, and cloud accounts; IAM (who can touch what) is a whole specialty on its own, and chronically in demand.
• Application / product security — reviewing code and designs, threat modeling, running the tooling that catches vulnerabilities before release. The natural home for developers.
• DevSecOps — wiring security into CI/CD so the secure path is the easy path. If you've ever maintained a build pipeline, you're closer than you think.

Governance, risk, and compliance (GRC)

The people making sure security is provable — policies, risk assessments, audits, and frameworks (SOC 2, ISO 27001, HIPAA, PCI). Less technical day-to-day, heavier on writing, judgment, and working across teams.

Easy to dismiss if you want hands-on-keyboard work; don't. GRC hires more career-changers than any other family, pays well, and anyone who can translate between auditors and engineers is permanently valuable. In regulated industries — healthcare very much included — GRC often is the security team's center of gravity.

Which door is yours?

Rough matching, if you're coming from IT:

• Helpdesk / support background → SOC analyst
• Sysadmin / infrastructure background → security engineering (infra, cloud, IAM)
• Developer background → AppSec, DevSecOps, detection engineering
• Process, documentation, or regulated-industry background → GRC
• Want offense? → fine, but plan it as move two, not move one

Next: 02 — Your IT Years Are the Head Start, on what actually transfers.