Multiple Paths Can Lead to Cybersecurity Success

By Chris Dimitriadis, Chief Global Strategy Officer, ISACA

You have to start somewhere, as the old saying goes. What is increasingly true in this era is that effective cybersecurity professionals do not have to start in security to make their mark in the profession.

In fact, the majority of cybersecurity professionals do not begin on that career path. According to ISACA’s 2026 State of Cybersecurity report, 54% of global respondents say half or more of their cybersecurity staff started in a different field and transitioned to cybersecurity. There are numerous pathways for those whose careers started in other fields to become successful security professionals, even if it takes extra investment from their organization to prepare them for success. 

Aspiring cybersecurity professionals often express frustration that it can be difficult to break into the field, despite the well-documented and persistent shortage of cybersecurity professionals. This is because organizations tend to cling to unrealistic expectations when looking to fill cybersecurity positions. Hiring managers should not be deterred just because the candidate is coming from an adjacent or even entirely different field. In fact, the broader range of experiences carries potential benefits, such as bringing fresh perspectives to cybersecurity and understanding how security influences various business contexts. 

This isn’t to say that hiring professionals without cybersecurity backgrounds or expertise will lead to immediate success stories. The cybersecurity profession is highly challenging and the costs of cyber incidents can be devastating for businesses, so it is understandable why organizations can be reluctant to bring in practitioners without experience in the profession. However, the reality is even those who pursued cybersecurity degree programs in universities often enter the workforce with gaps that require additional professional development to excel in their roles. By supporting newcomers to the field in pursuing relevant credentialing and training, organizations can build effective security teams composed of professionals from diverse backgrounds.

Fortunately, there are many directions in which enterprises that are seeking cybersecurity talent can turn. Organizations looking to fill open roles can find promising applicants by prioritizing prospective employees who: 

• Are technology professionals who want to focus on one of the most needed domains: Network and system engineers, software developers and general IT professionals may be tempted to follow a cybersecurity path as they can become highly important within an organization that is trying to innovate through technology in a sustainable and safe manner. Those professionals have a good understanding of IT within the context of the specific organization and can quickly become highly valuable.
• Have demonstrated an interest in continuous learning. The pace of technological change is not likely to slow any time soon, and those changes will directly impact the roles and responsibilities of cybersecurity professionals. That means organizations should look for candidates who have shown an appetite for taking courses, training and certifications to keep pace with the latest challenges in their field, even if that has been outside of cybersecurity. 
• Are AI-savvy. Artificial intelligence already is having a major impact on cybersecurity roles and responsibilities, and AI’s influence is expected to become increasingly prevalent in the years to come. It makes sense to pursue professionals who understand key AI concepts and are interested in applying them in a security context. 

It’s also important to recognize that thriving as a cybersecurity professional requires much more than technical aptitude. Skills such as critical thinking, communication, and adaptability do not require an extensive technical background, but depending on the specific role, these attributes can be as important to the candidate’s success as in-depth knowledge of network security, malware analysis or SIEM tools. The ability to not only understand technical security concepts but also explain their impact in a way that resonates with enterprise leadership is a powerful combination for security professionals. The interviewing process can provide great insights into a candidate’s skills in some of these often-overlooked areas.

Bringing aboard the security talent organizations need can be a tall order, as practitioners with in-demand skill sets and cybersecurity backgrounds are in short supply, especially as artificial intelligence and evolving threats ramp up the degree of difficulty for security roles. But the business impacts of cyber incidents and losing customer trust are too critical for enterprises to give up on developing reliable security teams. Just because candidates don’t have direct experience in cybersecurity does not mean they should be discounted, especially at a time when there are not enough well-qualified professionals to go around. This is an era that calls for open-mindedness and flexibility from industry hiring managers. By prioritizing candidates who are technology-savvy and have demonstrated a commitment to continuous learning, organizations can build the security teams they need, provided they are willing to make the accompanying investments in training and professional development to set up their new hires for success.