At Blue Team Academy, we talk to IT professionals every week who are ready to move
into cybersecurity. They have the technical foundation, the drive, and the interest.
Then a single sentence stops the conversation:
“I want to move into cyber, but I can’t afford to quit my current job.”
It’s a rational fear. There’s a mortgage, a family, a standard of living built over
a decade of work. Going back to school full-time, taking an unpaid internship, or
accepting a $40k entry-level SOC role is a non-starter for anyone with real
obligations.
The truth is simpler than the fear makes it sound: the path from IT to
cybersecurity runs through your current job, not around it. Your existing
paycheck is what buys you the time to do it properly.
According to the U.S. Bureau of Labor Statistics, information security analyst roles
are projected to grow 29% from 2024 to 2034 — roughly ten times the average for all
occupations — with a median wage of $124,910. The demand is real. The question is
how you get there without financial martyrdom.
1. Turn your current IT role into unpaid security experience
You don’t need the title “Security Analyst” to start doing security work.
Cybersecurity is applied IT. If you’re a sysadmin, network engineer, or help desk
technician, you’re already touching the systems that need defending — you’re just
not framing your work that way.
Start reframing:
- Help desk: Stop closing phishing tickets at “password reset.” Trace how the
user got compromised. Document the lure, the delivery, the click path. - Sysadmin: Take ownership of patching cadence. Harden Active Directory. Enforce
least privilege on service accounts nobody has audited in three years. - Network engineer: Read your firewall logs like they’re telling you something
(they are). Segment flat networks. Baseline what “normal” traffic looks like
before you need to know.
Two things happen when you do this. You accumulate real defensive work you can
point to in interviews. And internally, you become the security-minded person on
the IT team — which matters more than any certification when a role opens up.
2. Apply a repeatable decision method to the work you’re already doing
The reason most IT pros stall on the transition isn’t skill. It’s the absence of a
framework that tells them how to think about a security problem. Without one,
every ticket is a one-off.
At Blue Team Academy, we teach the Threat & Control Method — a four-step
sequence that turns any IT task into a defensive-security decision:
- Inventory — Know what’s actually in the environment and what matters most.
Most incidents start with something nobody knew was there. - Threats — Understand what can realistically go wrong for this asset, in
this environment, given these adversaries. Not a generic threat list. - Controls — Choose the right defenses for the right risks, and produce a
security plan you can defend to a business owner. - Scale — Apply the same reasoning across new systems, cloud environments,
and technologies you haven’t seen yet.
That’s the shape. The prioritization criteria, the templates, and the worked
examples for each step live inside the course — because how you decide is what
separates a security-minded IT person from a security professional.
The point for now: you don’t need permission to start running your current tickets
through Inventory → Threats → Controls → Scale. You just need to start.
3. Build a sustainable study routine — not a burnout schedule
Transitioning while employed doesn’t require 40 hours a week of study. It requires
5 to 10 hours of consistent, focused effort, protected on your calendar the same
way you’d protect a meeting.
- Skill-building over cert-chasing. Certifications open doors, but they don’t
make you dangerous on day one. Prioritize labs, breach analysis, and hands-on
defense over cramming for a multiple-choice exam. The cert is a checkbox; the
skill is the offer. - Home lab. Spin up a couple of VMs, deploy a SIEM (Splunk Free or Elastic
work fine), generate some attack traffic, and defend it. Being able to say
“I built this, ingested these logs, wrote these detections, caught this
behavior” is worth more than any single line on a resume. - Breach study tied to your current role. Pick incidents that map to the
systems you already run. If you manage Windows infrastructure, study
NotPetya and the Kaseya supply-chain attack. If you run cloud, study Capital
One. Learning defense in the context of systems you already understand
compounds faster than generic study.
Don’t sacrifice sleep or family time to do this. Burnout is the most common reason
transitions fail — not lack of talent.
4. Aim for the internal lateral move first
The shortest path into cybersecurity is usually inside the company you already
work for. Your employer already trusts you. They know your work. And critically,
you already understand their network, their business logic, and their tolerance
for risk — context an external hire needs six months to build.
Once you’ve been running your work through the Threat & Control Method and can
show artifacts from it, book time with your CISO, security manager, or IT
director. Don’t pitch a job. Ask what the security team is short on. Then aim
your after-hours learning at that gap.
When a junior SOC analyst, IAM engineer, or vulnerability management role opens,
you’re not a candidate. You’re the obvious hire.
5. Show your work in public
When you can’t lean on a job title to prove security skill, you have to show it.
A small public portfolio does more than most people realize.
- Write up your home lab build and what you learned defending it.
- Publish scripts on GitHub that automate a defensive task — log parsing,
detection tuning, evidence collection. - Do a technical breakdown of a real breach and explain what controls would
have caught it earlier.
A hiring manager reading “Systems Administrator” on your resume, then finding a
GitHub full of detection engineering and a blog dissecting the last major
ransomware incident, isn’t looking at a career-changer. They’re looking at a
security professional whose current title hasn’t caught up yet.
The bottom line
Pivoting takes time, but it doesn’t require financial risk. Your IT background is
the asset — not the obstacle. Keep the paycheck, run your current work through a
real decision framework, study consistently, position yourself internally, and
show your work publicly. That’s the transition. It’s a marathon paced by someone
who already has a job.
Get the path in your inbox. Every week, our Keep IT Safe newsletter breaks
down real breaches, defensive techniques, and career moves for IT pros making the
jump to cybersecurity — written for people who already work in tech.
Subscribe to Keep IT Safe →
Ready to make the transition deliberate? Our program walks you through the
Threat & Control Method end to end, with templates, walkthroughs, and the
decision criteria we couldn’t fit in this post.
See how it works →
