The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Information Security Analyst (Entry Level)
2-3 yearsSkills to master
- Evidence collection, basic control documentation, understanding of security policies, incident support.
You're ready to move on when
- Consistently delivers accurate evidence on time.
- Can clearly explain basic security concepts.
- Proactively identifies minor issues and suggests solutions.
- Demonstrates strong organisational skills.
- 2
IT Auditor / Junior Compliance Officer
2-4 yearsSkills to master
- Audit methodologies, risk assessment basics, regulatory awareness, report writing, stakeholder interaction.
You're ready to move on when
- Can follow an audit programme and identify non-conformities.
- Understands the importance of audit trails and documentation.
- Comfortable interacting with different teams to gather information.
- 3
IT Support / Operations Specialist with Security Focus
3-5 yearsSkills to master
- Technical security controls implementation, system administration, incident response, network security basics.
You're ready to move on when
- Has hands-on experience with security configurations (e.g., firewalls, access controls).
- Understands the practical challenges of implementing security.
- Shows an interest in security governance and compliance frameworks.