Build a career in cybersecurity.
Cybersecurity isn't one job — it's a constellation of specialties, each with its own tools, certifications, salary curve, and personality fit. This guide breaks down twelve real careers across offense, defense, governance, and engineering, so you can find the one that matches how you actually like to work.
- 12 detailed career profiles
- Salary ranges by experience tier
- Certifications that actually matter
- Tools, methods, and skill maps
The defenders. SOC analysts, incident responders, threat hunters — anyone whose job is to stop, detect, or contain attacks.
The authorized attackers. Pentesters and red teamers simulate adversaries to find weaknesses before real attackers do.
The bridge. Combines offensive and defensive expertise to improve detection by attacking and tuning together.
Why this field, why now.
A persistent global talent shortage, six-figure entry-level salaries in many markets, and one of the lowest unemployment rates of any technical profession. The runway is real.
Twelve cybersecurity careers.
Each profile covers what the role does day-to-day, salary range, key certifications, core tools, and current market demand. Use the filters to narrow by track.
SOC Analyst
First line of defense. Triages alerts in a Security Operations Center, investigates suspicious activity, and escalates real incidents. The most common entry point into the field.
Incident Responder
When a breach is confirmed, IR takes over. Contains active threats, performs forensics, identifies the attack chain, and writes the post-mortem. High-pressure, high-reward.
Threat Hunter
Proactively searches for adversaries that have evaded detection. Builds hypotheses from threat intel, queries telemetry, and turns findings into new detection rules.
Malware Analyst
Reverse-engineers malicious code to understand its behavior, capabilities, and origin. Deeply technical — assembly, debugging, sandboxes — but produces game-changing intelligence.
Penetration Tester
Authorized to break in. Conducts scoped engagements against networks, web apps, and infrastructure to find vulnerabilities — and writes reports clients can actually act on.
Red Team Operator
Long-running adversary emulation. Goes beyond pentesting to mimic specific threat actors, evade detection, and test the blue team's response capabilities end-to-end.
Bug Bounty Hunter
Independent researcher who finds vulnerabilities in public programs and earns per-find bounties. Wildly variable income, full schedule autonomy, only top performers earn well.
Cloud Security Engineer
Secures workloads across AWS, Azure, and GCP. Hardens IAM, builds guardrails in IaC, configures CSPM tools, and works with developers to ship safely. One of the hottest specialties.
Security Architect
Designs how security gets built into systems from the start. Threat models new products, defines reference architectures, and sets the standards engineering teams build against.
Application Security Engineer
Embedded with development teams to ship secure code. Reviews PRs, runs SAST/DAST/SCA, threat models features, and trains developers. Bridge between dev and security.
GRC Analyst
Governance, Risk, Compliance. Maps controls to frameworks, runs audits, manages vendor risk, and writes the policies that keep regulators satisfied. Less technical, more strategic.
CISO / Security Director
Owns security strategy at the executive level. Reports to the CEO or board, manages budget and headcount, balances risk against business outcomes. Less hacking, more leading.
Salary by role, US median.
Median base compensation for senior-level positions in the United States. International markets vary — UK and EU typically run 30–40% lower, while top-tier tech hubs (Bay Area, NYC) often run 20–30% higher.
Certifications worth your time.
Certifications won't get you hired alone, but the right ones open doors and prove baseline competence. Here are the credentials that consistently appear in job postings across all tiers.
Entry-level certs
Mid-level certs
Advanced certs
Tools of the trade.
The tools cybersecurity professionals reach for daily, organized by function. Most are free or have generous community editions — install them, learn them, list them on your resume.
- Splunk
- Microsoft Sentinel
- Elastic Security
- Wazuh
- Graylog
- CrowdStrike Falcon
- SentinelOne
- Microsoft Defender
- Velociraptor
- OSQuery
- Burp Suite
- Metasploit
- Cobalt Strike
- BloodHound
- Mimikatz
- Nmap
- Wireshark
- Masscan
- Zeek
- Suricata
- Autopsy
- Volatility
- FTK Imager
- KAPE
- Plaso
- Ghidra
- IDA Pro
- Binary Ninja
- x64dbg
- Radare2
- Wiz
- Prowler
- ScoutSuite
- CloudSploit
- Pacu
- Semgrep
- Snyk
- OWASP ZAP
- Trivy
- Checkmarx
How professionals actually work.
Five methodologies you'll encounter across virtually every cybersecurity role. Knowing them by name — and what they're for — makes you immediately legible to hiring managers.
Technical vs. soft skills.
A breakdown of the skills that matter across most cybersecurity roles, weighted by how much hiring managers actually care about them.
Five steps to your first role.
No degree required. No prior experience required. Follow these five steps in order — most people complete the path in 6 to 18 months alongside other commitments.
Not sure which track is right for you?
Take our 2-minute career fit quiz — get matched with the cybersecurity role that fits how you actually like to work.