Infosec Journey

Are you planning to transition into the security domain? This applies whether you are a scrum master, program manager, developer, tester, cloud administrator, or database administrator. The good news is that moving into security doesn’t have to be a complex leap. The security field offers a wide range of options. Your existing skills already make you a natural fit for certain areas. Compliance, for example, often values process-oriented backgrounds.

Based on my experience, here are some quick insights on opportunities you can explore:

Mindset and Core Skills

As with any profession, common sense, curiosity, and a willingness to learn are essential. In security, these are must-have qualities. The ability to question, analyze, and adapt is crucial as threats and technologies evolve.

1. Governance, Risk, and Compliance (GRC)

Risk management is one of the most accessible entry points into security. While the process itself is straightforward, it’s often poorly implemented in organizations. If you’ve worked in enterprise environments, you can already understand application vulnerabilities. Mapping them to organizational processes means you’re already halfway there. 

Risk management tools like Archer need a learning curve. Many companies still use custom apps or spreadsheets. This makes the transition easier. Consider certifications like CRISC (Certified in Risk and Information Systems Control) from ISACA to boost your credibility.

2. Security Operations: SIEM and SOC

Security Information and Event Management (SIEM) roles are a great fit if you have an analytics background. Security Operations Center (SOC) roles also align well with this background. Most organizations ingest logs from various tools and applications—your job is to interpret these logs from a security perspective. For example, multiple failed login attempts in a short time show a brute-force attack.

Familiarity with SIEM and SOAR (Security Orchestration, Automation, and Response) tools is helpful, and hands-on practice will accelerate your transition. The key is learning to filter and analyze logs for security-relevant events.

3. Security Testing and Vulnerability Management

Testers—manual or automated—can transition smoothly into security testing. Modern penetration testing tools are user-friendly, but interpreting results requires deeper security knowledge, which comes with experience and continuous learning. Manual penetration testing demands a strong understanding of http request-response cycles.

The OWASP Top 10 is an essential reference that highlights the most critical security risks for web applications. It serves as an industry benchmark for security testing and vulnerability management efforts. OWASP is the most widely recognized framework. Yet, there are other frameworks as well. These include the NIST Cybersecurity Framework and OSSTMM. They offer structured approaches to security assessments. These frameworks help organizations tackle a broader range of threats.

Vulnerability management is another core area. The job often involves running scans and generating reports using standard tools. Over time, you’ll develop a deeper understanding of vulnerabilities. You will learn how to communicate their impact. This is particularly important when handling runtime scans for containers or cloud environments.

4. Cloud and Endpoint Security

Cloud administrators can move into Cloud Security Posture Management (CSPM), though a learning curve is expected. Understanding cloud security frameworks like the Compliance framework, NIST, and CIS is more important than memorizing every detail. Focus on what each policy is designed to remediate. DevOps skills—like automation, infrastructure as code, CI/CD, and collaboration—directly support cloud security practices. They make it easier to integrate security controls into a cloud environment. This background also helps you adopt DevSecOps approaches, where security is embedded throughout the development and deployment lifecycle

Endpoint protection is a critical area requiring dedicated time. You need to detect attacks and prevent them. Additionally, you must be capable of isolate compromised systems quickly. Frameworks like MITRE are foundational here.

5. Identity and Access Management (IAM)

Identity management is highly organization-specific. Some companies have streamlined, medium-complex processes. Others have developed complex, heavily customized systems that need significant resources to manage. Recently, SaaS-based identity management solutions have become popular, offering easier adoption and simplified management compared to traditional on-premises systems. Yet, legacy on-prem identity platforms, while conceptually straightforward, can become difficult to manage due to organizational customizations.

A closely related area is access reviews or certification campaigns. These processes guarantee that users have only the access they need. They are relatively simple to adapt to. Nonetheless, they need commitment to finish on schedule.

Access management focuses on authentication and Single Sign-On (SSO) solutions, which do need experience. Integrations can range from straightforward (like SAML) to complex, depending on how applications are connected. You are already familiar with protocols like OpenID Connect or OAuth if you come from a development background. Many libraries implement these standards. Most access management products abstract the technical details. Once you understand the core concepts, switching between solutions is not a difficult task.

6. Network Security

Implementing perimeter controls like IPS (Intrusion Prevention Systems) can be a logical next step. Using WAF (Web Application Firewalls) is also beneficial for those with networking experience. These roles need careful configuration, as mistakes can have significant impacts.

Database administrators can explore Database Activity Monitoring, especially in regulated environments like PCI.

Handling audits and assessments (SOC 2, PCI, customer requirements) requires not only broad security knowledge but also practical experience.

Final Thoughts:

Security is a field where curiosity will serve you well. Process discipline and a readiness to learn are also crucial. The transition can need some upskilling. Yet, your existing skills can offer a strong foundation for a successful security career. This knowledge is in analytics, testing, administration, or management.

Are these the only areas in security? No—there are many other specializations within the security domain not covered here. But, this overview gives you a solid starting point. While the individual areas are simplified in this discussion, the specific configurations can vary. Requirements within each product or tool differ. The good news is that with the right prerequisites and mindset, adapting to these differences is entirely achievable.

For your reference, consider exploring industry-recognized certifications like CISM, CISSP, CCSP, CRISC, and CISA. These qualifications cover a broad range of security topics—from technical and operational skills to governance, risk, audit, and cloud security—and can help guide your learning path or confirm your skill as you progress in your security career