Career change to cyber security: a realistic UK plan for adults

A career change into cyber security is realistic in the UK, including in your 30s, 40s and beyond. Expect it to take somewhere between six and eighteen months of steady effort, and expect your first role to be a stepping stone rather than the job you've got in your head. The people who make it pick a route that uses their existing experience instead of starting from scratch.

That last point matters more than which course you buy.

Is there still demand for career changers?

Yes, though the market is more selective than the headlines suggest. The government's 2026 cyber skills report estimated the UK needs around 4,400 new people in 2026 to meet growth, and roughly 10,200 in total once you include people leaving or moving roles. The same report found 57% of UK businesses had a basic technical cyber skills gap, up from 49% the year before.

So there's demand. But only 16% of core cyber job ads in 2025 were aimed at people with under a year's experience. Translation: employers want people who've done something, and your job is to give them that evidence.

If you want the bigger picture on pay and prospects first, read our view on whether cyber security is a good career.

Is 40 too late to move into cyber security?

No. I'd go further: being older can help, as long as you use it.

Security teams deal with incidents, audits, regulators, angry users and senior managers who want plain answers. If you've spent fifteen years handling any of that, you already have half the job. What you lack is the technical layer, and that can be learned.

The real constraints at 40 are practical ones. You may have a mortgage, children or caring duties. You may not be able to drop to an entry salary for a year. That's why the route you choose matters more than your age.

Which route fits your background?

Don't start with "what course should I do?" Start with "what have I already done that a security team needs?"

From audit, finance, compliance or legal. Look hard at GRC (governance, risk and compliance) roles. They involve policies, risk registers, ISO 27001 audits and supplier checks. DSIT found ISO/IEC 27001, auditing and governance among the most requested skills in core cyber ads. You may get in without a long technical detour.

From customer service, retail or call centres. First-line IT support or service desk is your door. You already know how to handle frustrated people and log things properly. Add technical skills and you're a strong candidate.

From the police, armed forces or investigations. Incident response and SOC work suit people who are used to evidence, timelines and procedure. Lean on that in your CV.

From teaching or training. Security awareness, phishing simulation and training roles exist inside larger organisations. They're a less obvious way in, but they're real.

From IT already. You're closest. Volunteer for security tasks in your current role and aim for an internal move.

How quick can you learn cyber security for a career change?

Honestly, it depends on hours per week, not on the course's marketing. As a rough guide from what tends to work:

1. Two to three months on fundamentals: networking, Windows and Linux basics, how common attacks work.
2. Two to four months preparing for CompTIA Security+. CompTIA recommends two years of hands-on experience for it, so give yourself time.
3. Ongoing: a home lab and practice platforms, so you can talk about real things you've done.

One timing note. CompTIA is launching a new Security+ exam (SY0-801) on 17 November 2026, with a maximum of 90 questions in 90 minutes and a pass mark of 750 on a 100 to 900 scale. If you're starting from scratch now, study for the new version.

That adds up to six to nine months before you're applying with confidence, longer if you're fitting it around a full-time job and family. Anyone promising a security job in six weeks from zero is selling something.

Our how to get into cyber security guide breaks the learning stage down further.

Will you have to take a pay cut?

Maybe, at first. Here's the rough shape of UK pay as you move through the early stages.

If you're earning £40,000 now, starting in IT support is a real hit. The way round it is to aim for the route that matches your background (GRC, for example) or to build enough hands-on evidence to skip straight to a junior analyst role. Both are easier with proof of practical work.

How do you prove yourself without a security job on your CV?

This is where most career changers stall. They study, pass an exam, apply for twenty jobs and hear nothing back. The problem usually isn't the certificate. It's that the CV gives a hiring manager nothing concrete to ask about.

Build one or two pieces of work you can talk through in detail. For example, set up a small lab with a Windows machine and a Linux server, send their logs to a free SIEM, run a harmless simulated attack and write up what the alerts showed and what you'd do next. That single write-up gives you a ten-minute interview answer.

Then rewrite your CV so your old job and your new skills sit side by side. Lead with a short summary that says what you're moving into and why. Put the lab project near the top, above your education. Keep the old roles, but rewrite each bullet to show the security-relevant part: handling sensitive data, following procedures, spotting fraud, managing incidents.

What should you avoid?

Avoid expensive bootcamps that don't explain exactly where graduates end up and how many. Avoid quitting your job before you've tested whether you enjoy the work. And avoid hiding your previous career. Your past is your advantage. A CV that says "ten years managing complaints in a regulated business" next to "Security+ and a home SIEM project" is more interesting than one pretending you were born in a SOC.

Try a free beginner room on TryHackMe or a week of Security+ study before committing money. If you're still keen after a fortnight, that's a good sign.

How Experiencely can help

Career changers usually have the motivation and the transferable skills. What they're missing is recent, relevant work. Our cyber security programme pairs training and five CompTIA certifications (A+, Network+, Security+, CySA+, PenTest+), exam vouchers included, with a live security project. You're placed within 48 hours, work about an hour a day for three months, and it's fully remote, so it fits around a current job. The cost is £2,495. If you're not hired within 60 days of finishing, you get your money back (conditions apply).

Frequently asked questions

Sources

Figures are taken from the sources below. Salary ranges are indicative and individual offers vary. Last checked 9 November 2026.

1. DSIT: Cyber security skills in the UK labour market 2026
2. Prospects: Cyber security analyst job profile
3. IT Jobs Watch: 1st Line Support jobs, UK
4. CompTIA Security+ (V8) certification