Every pathway shows what it actually demands: coding intensity, on-call weight, promotion ceiling, entry saturation, AI resilience. Not just a salary band.
Written by James, a UK security architect.
If you read nothing else
Best money-per-year-of-pain in 2026. Hiring is broad, the ramp is well-mapped, and AWS/Azure skills move with you.
Not Cybersecurity, the entry queue is longer and the work is heavier.
Where senior cloud and DevOps people end up. Highest ceiling, async work, treated as an internal product.
Not Software Engineering, closer to systems thinking, less feature factory.
Worth it if you actually enjoy adversarial problems and shift work. Skip if you wanted security because it sounded important.
Not Offensive Security as a first job, that's a mid-career pivot, not an entry route.
Half the YouTube ecosystem points beginners here. The entry queue is the longest in tech, the shifts are real, and most SOC openings quietly want a year of IT operations behind you. It's still a good career. It's a bad opening move from a standing start.
Read the full take on Defensive / SOC, in contextUnfashionable, stable, and the skill that makes cloud and security engineers actually competent later. Pay isn't headline-grabbing, but the work outlasts every cloud rebrand and the pivot options are excellent.
Read the full take on Network Engineer, in contextStill a strong career. The entry market is genuinely harder than the industry admits, and the bootcamp-to-job promise rarely lands in three months. Pick it because you'd write code anyway, not because the salary numbers look good on LinkedIn.
Read the full take on Software Engineering, in contextIt's a great mid-career pivot from AppSec, dev or sysadmin. It's a poor first job. The junior pentest market is thin, OSCP without report-writing experience rarely converts, and most career-changers burn 18 months before a callback. Come back to this one later.
Read the full take on Offensive Security, in contextPractitioner opinion, late 2026. Not statements of worth. Your context will vary.
Defensive or offensive security work, from SOC analyst to red teamer.
How much of the work is reading logs, writing reports, and explaining risk to non-technical stakeholders.
Investigative thinkers · People who enjoy adversarial problems · Folks comfortable with on-call
Designing, deploying, and operating infrastructure on AWS, Azure, or GCP.
IAM. Networking fundamentals. Cost. The cert teaches services; production teaches consequences.
Sysadmins wanting upward mobility · Builders who like systems · Remote-first careers
Career durability. Networking expertise compounds for 20+ years and underpins cloud, security, and platform work.
Methodical troubleshooters · People who want deep, durable expertise · On-site / hybrid workers
Build the pipelines, platforms, and tooling other engineers depend on.
How much of the role is internal product management. Building tools other engineers actually want to use.
Engineers with both dev and ops instincts · Builders of internal products · Remote async workers
First-job lanes. Help desk, IT ops, junior cloud, junior networking, Tier-1 SOC.
How much hiring leans on the basics. Tickets closed, comfort with users, calm under pressure.
First paid technology role · People who learn by shipping tickets · Anyone validating they actually like infra
Pentest, red team, vulnerability research, adversary simulation as a craft.
Report writing. The deliverable is a document, not a shell.
People who enjoy adversarial problems · Builders comfortable with ambiguity · Strong note-takers
Always-on monitoring and response, the realistic entry lane into security.
Shift work. Nights, weekends, and the cognitive cost of context-switching across 40 alerts.
Investigative thinkers · People comfortable with shift work · Pattern matchers
Author durable detections; lead incident response when the alert is real.
How much of the job is engineering: writing detections, tuning, building pipelines, not just hunting.
Engineers who like data · People who write things down · Calm-under-pressure operators
Secure cloud-native infrastructure, IAM and workloads, usually entered from cloud, not from SOC.
You need to be a credible cloud engineer first. Security comes second.
Cloud engineers with security curiosity · IaC-fluent operators · Policy-minded builders
Translate security into business language; own audit, risk and compliance frameworks.
Influence without authority. The work is mostly persuasion, framing, and translation.
Strong communicators · People who like structure · Cross-functional thinkers
Engineer the identity layer. IAM, SSO, PAM, MFA, Zero Trust. Hands-on, in demand, often entered from IT or cloud.
Identity is now the perimeter. The work is high-leverage but politically dense.
AD/cloud engineers pivoting to security · Builders who like automation · Detail-driven operators
Build the internal platform other engineers ship on. Kubernetes, IaC, golden paths.
Product sense. The platform has internal customers, and they will route around you if you don't listen.
Engineers who treat infra as a product · Strong code reviewers · Async workers
Design trust boundaries, threat models and security-relevant systems at scale.
Senior generalists · Strong communicators · Pattern-level thinkers
Build the security guardrails, paved roads and tooling other engineers ship on, platform-coded security.
Engineers who code in production · Builders who treat security as a product · Async workers
Engineering posture on top of telemetry. SOAR, enrichment, LLM-assisted tooling. Emerging lane.
How quickly the tooling shifts. The half-life of specific skills is short; judgement compounds.
Engineers who like glue work · Detection engineers who code · Builders comfortable with ambiguity
Backend, frontend, full-stack. Ship product and own services. Portfolio matters more than certs.
Builders who like product · People who learn by shipping · Engineers who pair well
Data engineering, analytics, ML and applied AI. Hands-on portfolios outperform multi-cert stacks here.
Engineers who like data shape · People who enjoy long debugging loops · Builders who can write SQL fluently
The Microsoft-shop spine. Windows, AD, Exchange, M365, endpoint. The durable on-ramp to security, cloud and IAM.
Operators who like long-running systems · People who enjoy AD/identity depth · Future cloud or IAM engineers
Reality check. Ratings are directional. Compensation, on-call load, and remote availability vary heavily by employer, geography, and seniority. Treat them as hypotheses to validate, not facts.