The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Senior Security Analyst/Engineer (Internal Promotion)
3-5 years as a SeniorSkills to master
- Leading complex security projects end-to-end, mentoring junior team members effectively, demonstrating strong influence with cross-functional teams, and taking ownership of critical security workstreams.
You're ready to move on when
- Successfully led 3+ major security projects with measurable impact.
- Consistently sought out by peers for technical advice and problem-solving.
- Proactively identified and addressed significant security risks without direct instruction.
- Demonstrated ability to present complex technical concepts clearly to non-technical audiences.
- 2
Security Consultant (External)
5-8 years of consulting experienceSkills to master
- Client-facing communication, understanding diverse technical environments quickly, designing security solutions for various business contexts, and managing project delivery.
You're ready to move on when
- Experience working with multiple clients across different industries.
- Strong ability to quickly understand new technical stacks and business requirements.
- Proven track record of delivering security projects on time and within budget for clients.
- Excellent presentation and stakeholder management skills in a consulting context.
- 3
DevSecOps Lead (Internal/External)
4-7 years in DevSecOpsSkills to master
- Integrating security into CI/CD pipelines, automating security testing, implementing 'shift-left' security practices, and working closely with development teams.
You're ready to move on when
- Deep understanding of modern software development practices and tooling.
- Experience automating security controls and testing within a DevOps pipeline.
- Proven ability to embed security into the development lifecycle, not just bolt it on.
- Strong collaboration skills with software engineering teams.