There is a piece of cybersecurity career advice I fundamentally disagree with:

“If you’re new to cybersecurity, you need to start from the bottom.”

Sometimes that’s appropriate.

But not always.

A professional who has spent 10 years working in procurement doesn’t suddenly lose their understanding of third-party relationships because they’re moving into cybersecurity.

An auditor doesn’t lose their ability to challenge evidence.

A project manager doesn’t forget how to manage stakeholders.

A finance professional doesn’t lose their commercial judgement.

And an operations leader doesn’t stop understanding how organisations actually work.

Yet experienced professionals considering a cybersecurity career change are frequently encouraged to disregard much of what they have already built.

I think we need a better approach.

Being new to cybersecurity is not the same as being new to work.

At Lateral Connect, this principle sits at the heart of how we think about career transition.

Can you move into cybersecurity without starting over?

Yes, but that doesn’t mean you can skip developing cybersecurity capability.

That’s an important distinction.

A successful cybersecurity career transition requires you to understand three things:

What transfers?
What’s missing?
What you can prove.

The mistake is assuming the answer to all three is “take another certification.”

It isn’t.

1. Start with the career you’ve already built

Before choosing a cybersecurity certification, course or bootcamp, examine your existing professional experience.

Ask yourself:

What problems have I solved?

What risks have I managed?

What decisions have I influenced?

What stakeholders have I worked with?

What evidence have I reviewed?

What policies, processes or controls have I worked around?

What business outcomes have I been responsible for?

Those questions often reveal far more than your current job title.

Someone working in procurement, for example, may already understand supplier due diligence, contractual requirements, third-party relationships and commercial risk.

Those capabilities can be relevant to third-party cyber risk.

An auditor may already understand controls, evidence, assurance and remediation.

Those capabilities can translate into cyber GRC and security assurance.

The objective isn’t to pretend you already know cybersecurity.

It’s to recognise that your previous career may provide the foundation on which cybersecurity capability can be built.

2. Choose the destination before the training

“Cybersecurity” isn’t a career.

It’s an industry containing many different careers.

Governance.

Risk.

Compliance.

Security operations.

Cloud security.

Identity.

Threat intelligence.

Security awareness.

Incident response.

Application security.

Third-party risk.

And many more.

This is why I encourage professionals to work backwards.

Choose several roles you would genuinely consider applying for.

Study what employers repeatedly require.

Then divide those requirements into:

Already have | Transferable | Need to learn | Need to prove

Suddenly, your development plan becomes much more specific.

Instead of asking:

“Which cybersecurity certification should I get?”

You’re asking:

“What evidence do I need to become credible for this particular role?”

That’s a much better career question.

3. Understand the difference between knowledge and capability

Cybersecurity education matters.

Certifications matter.

Technical knowledge matters.

But employers ultimately need people who can apply what they know.

Current UK government research illustrates why this distinction matters. Around 143,000 people were estimated to work in UK cybersecurity, yet 49% of UK businesses reported a basic technical cyber skills gap and 30% reported gaps in advanced technical skills. Meanwhile, approximately 6,000 cyber graduates were estimated to be entering the labour market annually.

So increasing the number of people learning cybersecurity doesn’t automatically eliminate capability gaps.

We also have to think about application.

Can you assess a risk?

Can you analyse evidence?

Can you write something useful?

Can you work through an unfamiliar business scenario?

Can you communicate a cybersecurity issue to someone outside security?

Can you demonstrate what you have done?

Knowledge tells an employer what you’ve learned.

Evidence helps demonstrate what you can do.

That’s an important difference.

4. Build evidence before asking employers to believe you

One of the hardest parts of changing careers is the familiar problem:

“Employers want experience, but how do I get experience if nobody will hire me?”

We need to think more creatively about what constitutes evidence.

Practical projects.

Mentored assignments.

Case studies.

Simulated business scenarios.

Portfolio evidence.

Volunteering.

Workplace projects.

Labs.

Risk assessments.

Policies.

Presentations.

Research.

These won’t all be equivalent to commercial employment, and we shouldn’t pretend they are.

But they can help you move from:

“I understand this.”

to:

“Here’s evidence of how I’ve applied it.”

That transition matters.

It’s also one of the reasons practical development and mentoring form such an important part of our approach at Lateral Connect.

5. Don’t erase your professional identity

Perhaps the biggest mistake experienced career changers make is rewriting themselves as beginners.

They remove years of valuable achievements from their CV.

They lead entirely with new certifications.

They describe themselves only as an “aspiring cybersecurity professional.”

And inadvertently make themselves look less experienced than they are.

Don’t hide your previous career.

Translate it.

Your positioning should communicate both sides:

This is what I’ve already built professionally.

This is the cybersecurity capability I’m now developing.

And this is where the two intersect.

That is a much stronger career story.

Frequently Asked Questions

Do I need an IT background to work in cybersecurity?

Not for every cybersecurity career. Some roles require substantial technical depth, while others draw heavily on risk, governance, audit, communication, business and regulatory capabilities. The right pathway depends on the role you are targeting.

Is a cybersecurity certification enough to get hired?

A certification can demonstrate learning and support credibility, but it doesn’t guarantee employment. Employers may also assess practical experience, evidence, communication, business understanding and role-specific capability.

Should career changers apply for entry-level cybersecurity jobs?

Sometimes. But entry-level cybersecurity shouldn’t automatically mean entry-level professional. Your appropriate level depends on your transferable experience, cybersecurity capability and the requirements of the particular role.

Don’t start again, build forward

Cybersecurity needs new talent.

But new talent doesn’t always mean inexperienced talent.

Some of the people entering this profession have already spent a decade or more solving complex problems elsewhere.

We shouldn’t tell them those years don’t count.

Nor should we pretend transferable skills remove the need to learn cybersecurity.

The better approach sits between those extremes.

Translate what you’ve built.
Identify what’s missing.
Develop the capability.
Build the evidence.
Then position yourself accordingly.

That’s how we should approach career transition.

Not by starting over.

By building forward.

Ready to understand where you fit?

At Lateral Connect, we help professionals develop cybersecurity capability through practical learning, mentoring, real-world application and career development.

If you’re considering a move into cybersecurity but aren’t sure how your existing experience translates, book a Career Fit Call to explore your next step.

For employers, universities, colleges and workforce organisations, we also welcome conversations about partnerships that create stronger pathways between cybersecurity learning, practical capability and employment.

Book a Career Fit Call.
Contact Lateral Connect to discuss partnership opportunities.