Three years on a UK service provider NOC. CCNA done, CCNP ENCOR in progress. Targeting Network Engineer inside twelve months.
The route holds, but certs are the floor and clean change records are the gate.
Your CCNP looks good on paper. If your CV doesn't also show named ownership of production changes, it gets filtered. The interview question that exposes the gap is 'walk me through the last change you rolled back'. The work that moves you is getting your name on the author line of low-risk changes in your current NOC, not more lab hours.
What would change the call
If the next role gives you a structured ramp on change implementation with direct supervision, the timeline holds. If it lands you back in a watch-only seat, the twelve months disappear.
Career changer, six months in. No IT role yet. Security+ booked, AWS SAA next. Targeting Cloud Security Engineer in twelve months.
Not from here, not in twelve months. The plan compresses years the role won't compress.
Cloud Security hires people who have already been burned by a production IaC deployment. Operational scar tissue is the currency. TryHackMe rooms and a single EC2 instance don't build it, and stacking AWS SAA on top doesn't substitute for it. The honest version of this route puts you in a Junior Cloud Ops or DevOps support seat first, somewhere that runs Terraform in production, then the move comes from inside that seat.
What would change the call
If you can land an IaC-adjacent ops role inside six months, the call changes by month eighteen. Without that seat the cert stack is collateral on a route you can't walk.
Eight years infrastructure. Two ISO 27001 audits as the infra signatory. Targeting GRC Analyst in financial services, Bristol, nine months.
Doable, but not on this timeline and not in this market without an internal move.
Your audit exposure is real, but you've participated in controls, you haven't owned one end to end. The Bristol GRC market is thinner than London at the entry-to-mid level, and most seats expect prior dedicated GRC time. The thing that closes the gap isn't another cert, it's a control where your name is on the documentation, you brief the auditor, and you sign off the remediation.
What would change the call
An internal transfer to a dedicated GRC team inside six months makes the timeline real. A cold external move into a Bristol-only search at your salary floor does not.