How do I move from help desk to a security job?

You are already on the on-ramp — and this page says so explicitly. Access resets and account lockouts are identity and access management in practice; phishing reports are security event triage; endpoint investigations are embryonic incident response. The move is not about starting from zero: it is about formalizing what you already do, closing the tooling gap (SIEM, vulnerability scanners, log analysis), and shifting from a ticket-closing mindset to an investigative one. The cert sequence above is designed to close those gaps in order.

Does help desk experience count for Security+?

It counts toward it — with an honest quantifier attached. CompTIA's full recommended background, shown in the ladder above and cited, is Network+ plus roughly two years of security- or systems-administration-focused experience. Working help-desk staff typically cover part of that bar, not all of it: the daily administration work counts, the networking depth and the years may not be there yet. Read the vendor's own statement against your actual work history before scheduling.

Security+ or CySA+ first?

Security+ first — that is the order on this page and the reason is structural. Security+ covers the conceptual security baseline; CySA+ is the analyst rung, and its domains map to the day-to-day of a SOC seat. CySA+ assumes you have the Security+ foundation and have spent time working with actual security tooling. The ladder above shows both credentials in sequence, with the fit labels and fees cited to each vendor.

Do I need CISSP to work in a SOC?

No. CISSP is experience-gated by ISC2 — full certification requires substantial cumulative paid work experience in its domains, a vendor requirement shown in the ladder above cited to ISC2. It appears on this page so you can see the full track honestly. For someone already in IT support, CISSP is a real five-year plan, not a prerequisite for SOC work: Security+ and CySA+ are the relevant credentials for the analyst track. The Associate of ISC2 route is shown on the CISSP certification page for those who pass the exam before the experience.

How is security work different from support work?

The mindset shift is the core gap this page names directly: help-desk work is optimized for closing tickets; security analyst work is optimized for understanding what happened, even when nothing needs to be fixed immediately. In practice that means opening a SIEM, querying log events, correlating indicators across systems, and deciding whether an alert is a real incident or a false positive — work that rarely appears in a help-desk workflow. The tooling and the investigative orientation are what the cert sequence above is designed to build.

Pathway · Help desk → cybersecurity

Help desk to cybersecurity: the in-field upgrade path

You are already in IT support. The question is not whether you can move into security — it is that you are already doing security-adjacent work every day and may not fully recognize it. Access resets, phishing reports, and endpoint issues are the raw material of security operations. This page gives you the honest version: what your work already covers, where the real gaps are, and the cited sequence from Security+ to analyst-level and beyond.

You’re already on the on-ramp

The daily support work that counts as security-adjacent experience

Help-desk work and security work overlap more directly than most support professionals realize. Access resets and account lockouts are identity and access management in practice — the same discipline that underlies IAM concepts on the Security+ exam. Phishing reports from users are security event triage: when a user flags a suspicious email and you decide whether to escalate, you are already at the first link in the incident response chain. Endpoint issues — malware pop-ups, unexpected behavior, compromised machines — are endpoint security investigations in embryonic form. You are not starting from zero; you are starting from adjacent.

Security+ was designed with an IT-administration background in mind — CompTIA’s full recommended experience (Network+ plus about two years of security- or systems-administration work) renders in the ladder below, cited. Working help-desk staff typically cover a real part of that bar already, which is why this credential is the right first rung for you, and why career changers without an IT background need a different entry point first.

The honest gap is tooling depth and mindset. Most help-desk professionals have encountered security alerts — forwarded them, escalated them, closed the ticket once the issue was resolved. What you have likely not done is investigate the chain: open a SIEM, query log events, correlate indicators across systems, and decide whether an alert is a real incident or a false positive. Vulnerability scanners — running a scan, interpreting the output, prioritizing findings by exploitability — are also rarely part of the help-desk workflow. And the mindset shift is real: help-desk work is optimized for closing tickets; security analyst work is optimized for understanding what happened, even when nothing needs to be fixed. Those gaps are learnable, and the ladder below is designed to close them in order.

You are here

What your daily work maps to in the security domain

Per O*NET (U.S. Department of Labor), the work activities that align between IT support and cybersecurity include identifying and evaluating information, processing and documenting findings, communicating under operational pressure, and following documented escalation procedures. Your help-desk experience contributes to several of these directly — the ticket-driven documentation habit, the systems familiarity, and the escalation judgment all carry over. What O*NET identifies as distinctive to security work — and genuinely absent from most help-desk roles — is monitoring and analyzing system-level data specifically for security threats. That is the SIEM gap described above, and it is what the cert sequence below builds toward. The cited work-activity overlaps by background are here:

Work-activity overlaps by background →

The realistic target role

Cybersecurity Analyst

Occupation-level BLS median: $129,180 (SOC 15-1212) — a national occupation figure that skews senior; entry SOC-analyst and security operations center roles typically pay below the median, and this is not a certification salary or a promise. BLS projects +28.5% employment change for this occupation (2024–2034) — a forecast, not a guarantee.

The honest certification ladder

Three credentials, in the order that reflects your actual position

Fit labels derive from each vendor’s own published eligibility — entry-friendly, conditions-apply, or experience-gated — not from what would be easiest to sell you. Security+ is shown first because it is the right starting point for someone with IT support experience; career changers without IT background need a different entry credential before it. The “not yet” entry is shown on purpose.

CompTIA Security+ Reach — conditions apply · exam $439 · Difficulty 45/100 (Moderate)

Start here — and unlike career changers, you likely already meet the recommended background. CompTIA's recommended experience for this exam is IT administration with a security focus, which reads like a description of what working help-desk staff already do. Read the vendor's own words on the certification page against your actual experience before you decide how far along you already are.

Vendor-recommended before it: CompTIA Network+ (a recommendation, not a registration gate).

Vendor’s recommended background: CompTIA recommends Network+ plus about 2 years of security/systems-administration experience (a recommendation, not a requirement).

CompTIA CySA+ Reach — conditions apply · exam $439 · Difficulty 75/100 (Hard)

The analyst rung — its domains are the day-to-day of a SOC seat. After Security+ and time working with actual security tooling, not before.

Vendor-recommended before it: CompTIA Security+ (a recommendation, not a registration gate).

Vendor’s recommended background: Network+, Security+, or equivalent knowledge, with a minimum of 4 years of hands-on experience as an incident response analyst, security operations center (SOC) analyst, or equivalent experience (a vendor recommendation, not a requirement).

CISSP - Certified Information Systems Security Professional Not yet — experience-gated · exam $749 · Difficulty 80/100 (Expert)

Not yet — but for you this is a real five-year plan, not a someday. Your paid IT support work may already count toward experience in some domains; verify against ISC2's official experience criteria, not our summary of it. The Associate of ISC2 path is shown on the certification page.

Why not yet: full certification requires 5 years of relevant paid work experience — a vendor requirement, not our judgment. ISC2 Associate pathway: passing this ISC2 certification exam without required experience can lead to Associate of ISC2 status (up to six years for this exam path).

Fees and eligibility from each vendor’s official pages (cited and dated on the linked certification pages). Difficulty is the RoleMath structure-based score — the exam’s difficulty, never a pass rate or anything about you.

The money picture

Employer-funded is often the realistic path for working IT staff

In-field upgraders have an advantage career changers often lack: your employer may already have a training and certification budget, and organizations under compliance or audit pressure frequently fund Security+ specifically for support staff. Check your HR or L&D policy before paying out of pocket. Budget for maintenance costs too: both CompTIA and ISC2 certifications carry continuing education requirements that are part of the real long-term cost, not just the exam fee. For workforce-development funding options outside of employer budgets — and a full breakdown of what each exam costs including renewal fees — see:

Every funding lever, cited →What certifications really cost →

The study path

Free and official first

Every certification above has a free-study page built from the vendor’s official objectives and free resources — no paid prep is required to start, and we sell no training. For working IT support professionals, the readiness check is especially useful before building a study plan: your existing experience likely maps to more of the Security+ objectives than you expect, and knowing that avoids spending study time covering ground you have already covered on the job.

Free official study, by certification →Take the Security+ readiness check →

Common questions

Help desk to cybersecurity, answered honestly

How do I move from help desk to a security job?: You are already on the on-ramp — and this page says so explicitly. Access resets and account lockouts are identity and access management in practice; phishing reports are security event triage; endpoint investigations are embryonic incident response. The move is not about starting from zero: it is about formalizing what you already do, closing the tooling gap (SIEM, vulnerability scanners, log analysis), and shifting from a ticket-closing mindset to an investigative one. The cert sequence above is designed to close those gaps in order.
Does help desk experience count for Security+?: It counts toward it — with an honest quantifier attached. CompTIA's full recommended background, shown in the ladder above and cited, is Network+ plus roughly two years of security- or systems-administration-focused experience. Working help-desk staff typically cover part of that bar, not all of it: the daily administration work counts, the networking depth and the years may not be there yet. Read the vendor's own statement against your actual work history before scheduling.
Security+ or CySA+ first?: Security+ first — that is the order on this page and the reason is structural. Security+ covers the conceptual security baseline; CySA+ is the analyst rung, and its domains map to the day-to-day of a SOC seat. CySA+ assumes you have the Security+ foundation and have spent time working with actual security tooling. The ladder above shows both credentials in sequence, with the fit labels and fees cited to each vendor.
Do I need CISSP to work in a SOC?: No. CISSP is experience-gated by ISC2 — full certification requires substantial cumulative paid work experience in its domains, a vendor requirement shown in the ladder above cited to ISC2. It appears on this page so you can see the full track honestly. For someone already in IT support, CISSP is a real five-year plan, not a prerequisite for SOC work: Security+ and CySA+ are the relevant credentials for the analyst track. The Associate of ISC2 route is shown on the CISSP certification page for those who pass the exam before the experience.
How is security work different from support work?: The mindset shift is the core gap this page names directly: help-desk work is optimized for closing tickets; security analyst work is optimized for understanding what happened, even when nothing needs to be fixed immediately. In practice that means opening a SIEM, querying log events, correlating indicators across systems, and deciding whether an alert is a real incident or a false positive — work that rarely appears in a help-desk workflow. The tooling and the investigative orientation are what the cert sequence above is designed to build.

One low-commitment next step

Take the Security+ readiness check (free, no email required) — it compares what you know now against the official exam domains and will tell you honestly how much of your help-desk experience already maps to the objectives. Then personalize the full path against your timeline and whether your employer will fund it.

Build a cited plan Other pathways →