Breaking In 02 — Your IT Years Are the Head Start

Part of the Breaking Into Security field guide.

The biggest myth about entering security is that you're starting over. You're not. Security teams are full of former sysadmins, developers, and support engineers — and they're generally better at the job for it, because security work is mostly understanding how systems actually run and fail, and that's what an IT career teaches.

What transfers directly

• Networking. If you can read a firewall rule, explain DNS, or trace why a packet didn't arrive, you're ahead of a stack of security résumés. Most attacks and most detections live in the network.
• Systems administration. Active Directory, Linux servers, patching, backups, permissions — this is the terrain attackers move through. Knowing how it's supposed to look is how you spot when it doesn't.
• Troubleshooting instinct. Security investigation is troubleshooting with an adversary. The loop you already run — symptom, hypothesis, evidence, next question — is the loop.
• Software experience. If you've built or maintained software, you can read code for vulnerabilities, automate the boring parts, and talk to developers as a peer. Security people who can code are a minority, and it shows in their options.
• Operating under process. Tickets, change control, on-call, documentation. Security runs on the same rails, and people who can work a process without being eaten by it are rarer than you'd hope.

The honest gap list is shorter: the attacker's perspective (how systems get abused, not just used), the tooling (SIEM, EDR, scanners), and the vocabulary. All learnable in months, not years — that's what part 03 is about.

The classic pivots

The common shapes, matching the role families from part 01:

• Sysadmin → security engineer. You've already done half the job — hardening, IAM, patching — just without the title.
• Support/helpdesk → SOC analyst. Same triage muscle, new alert queue.
• Developer → AppSec/DevSecOps. Scarce and sought: someone who can find the flaw and fix it and not enrage the dev team.
• Anyone in a regulated industry → GRC. You've lived under the frameworks; now you administer them.

The healthcare angle

If your background is medical software specifically: that's not baggage, that's a niche — and niches are how mid-career changers skip the entry-level pile.

Healthcare is one of the most attacked industries there is (ransomware crews love targets that can't tolerate downtime), it's regulated to the hilt, and its security teams are chronically understaffed. Meanwhile, security people who actually understand HL7 interfaces, EHR workflows, vendor-managed systems that can't be patched, and what a hospital network really looks like are rare. You'd be walking in with the domain knowledge their generalist hires spend years absorbing.

Worth knowing by name:

• HIPAA Security Rule — the regulatory floor for protecting patient data; every healthcare security conversation happens in its shadow.
• HITRUST CSF — the certification framework healthcare organizations and their vendors get audited against. GRC roles in healthcare live here.
• Medical device security — devices are computers with long lifespans and slow patch cycles, and the FDA now requires cybersecurity work in premarket submissions. A small, growing specialty where software + medical experience is exactly the profile.
• H-ISAC — the healthcare sector's threat-sharing community; its public output is a good window into what the industry is fighting.

The pitch writes itself: "security person who already speaks healthcare" is a stronger, shorter line than "career changer."

The easiest door is the one you're behind

Before applying anywhere, look sideways. The gentlest transition is doing security work at your current employer: volunteer for the audit prep nobody wants, take the vulnerability-remediation tickets, ask the security team (if there is one) what they'd hand off. Six months of that and your résumé says security experience, not security interest — and internal transfers skip the résumé pile entirely.

Next: 03 — First Moves — the concrete plan.