30Jul 2026

What jobs are there in cyber security: UK career guide

Empty UK security operations centre workspace

Cyber security roles in the UK fall into six core families: security operations/SOC, engineering and architecture, testing and assurance, intelligence and forensics, governance and risk, and secure development. The UK Cyber Security Council maps these across 15 specialisms, and GOV.UK guidance estimates a shortfall of around 10,000 professionals entering the UK workforce each year. That gap is your opportunity.

One distinction worth grasping early: core cyber roles are those where security is the primary function (Security Analyst, Penetration Tester, Cyber Security Architect). Cyber-enabled roles such as IT Support or Network Engineer require cyber skills but are not formally classified as cyber jobs. The difference matters when you are writing a CV or a job advert.

Quick next steps:

  • Jobseekers: identify your target family below, pick one foundational certification, and search niche UK boards for SOC analyst or junior security roles.
  • Employers: align your job specifications to the UK Cyber Security Council specialisms and post on Securityjobsboard to reach sector-specific candidates.

Table of Contents

What jobs are there in cyber security: the core role families

The 2025 skills findings report recorded 32,370 core cyber role postings in 2024, with 63% requiring mid-level experience of 2–6 years. Entry demand has fallen, so candidates who arrive with transferable skills from physical security or policing have a genuine edge if they frame those skills correctly.

1. Security operations centre (SOC) analyst

SOC analysts monitor networks and systems in real time, triaging alerts and escalating genuine threats. It is the most common entry point for career changers, including those moving from physical security or policing, because the investigative mindset transfers directly.

Forensic tools on UK incident response specialist's desk

Representative titles: SOC Analyst, Cyber Security Analyst, Network Intrusion Analyst, Incident Response Centre Analyst.

2. Incident response specialist

Incident responders contain and investigate active breaches. They work under pressure, preserve evidence, and produce post-incident reports. Chain-of-custody discipline from physical security roles maps well here.

Representative titles: Cyber Incident Responder, Forensics and Incident Response Analyst, Cyber Incident Manager.

3. Penetration tester / red team operator

Penetration testers are paid to break into systems before attackers do. The role demands deep technical knowledge and creativity. Most employers expect at least two years of security experience before hiring into this family.

Representative titles: Penetration Tester, Ethical Hacker, Cyber Penetration Test Specialist, Red Team Operator.

4. Security engineer and architect

Engineers build and maintain secure infrastructure; architects design it from the ground up. Both roles blend hands-on technical work with strategic thinking. Demand for vulnerability skills in this family rose 5% from 2023 to 2024.

Representative titles: Cyber Security Engineer, Security Architect, Cyber Security Design Engineer, Infrastructure Support Engineer.

5. Secure software developer

Secure developers embed security into code from the first line rather than bolting it on afterwards. They work closely with DevOps teams and are increasingly sought in financial services and government.

Representative titles: Software Development Engineer (Security), Application Security Engineer, DevSecOps Engineer.

6. Threat intelligence analyst

Threat intelligence analysts research adversaries, track emerging attack methods, and brief internal teams and clients. The role suits candidates with research or analytical backgrounds, including former police intelligence officers.

Representative titles: Cyber Threat Intelligence Analyst, Intelligence Analyst, Threat Analyst, Cyber Risk Modeller.

7. Digital forensics investigator

Digital forensics is one of the most persistent skills gaps in the UK market. Investigators recover and analyse data from devices, often supporting law enforcement or legal proceedings.

Representative titles: Digital Forensic Investigator, Digital Forensics and Incident Response Specialist, Police Digital Investigator.

8. Governance, risk and compliance (GRC) manager

GRC professionals manage policy, audit, and regulatory compliance. ISO/IEC 27001 is among the most requested standards in core cyber job postings. This family is the most accessible for candidates without a technical background.

Representative titles: Cyber Risk Analyst, GRC Officer, Information Security Manager, IT Risk and Compliance Manager.

9. Identity and access management (IAM) specialist

IAM specialists control who can access what across an organisation’s systems. Demand has grown steadily as cloud adoption accelerates.

Representative titles: IAM Analyst, IAM Engineer, Digital Identity Security Consultant, Cyber Manager — Identity and Access Management.

How the UK Cyber Security Council’s 15 specialisms map to real job titles

The UK Cyber Security Council career framework is intentionally flexible. Many real roles blend two or more specialisms, so treat this table as a planning tool, not a rigid rulebook.

Council specialism Typical UK job titles Key skills to list
Secure Operations SOC Analyst, Cyber Security Analyst, IS Operations and Security Manager SIEM, incident triage, network monitoring
Incident Response Cyber Incident Responder, Forensics and IR Analyst Evidence handling, malware analysis, post-incident reporting
Security Testing Penetration Tester, Ethical Hacker, Security Consultant OWASP, Burp Suite, scripting
Secure System Architecture and Design Security Architect, Cloud Security Architect Zero-trust design, threat modelling
Vulnerability Management Vulnerability Management Analyst, Senior Threat and Vulnerability Analyst CVE triage, patch management, risk scoring
Cyber Security Governance and Risk Management Cyber Risk Analyst, GRC Officer, IT Risk and Compliance Manager ISO/IEC 27001, risk frameworks, audit
Cyber Security Audit and Assurance Information Security Auditor, Cyber Assurance Manager Compliance testing, control assessment
Cyber Threat Intelligence Threat Intelligence Analyst, Cyber Risk Modeller OSINT, threat actor profiling
Digital Forensics Digital Forensic Investigator, Police Digital Investigator Chain of custody, forensic tooling
Identity and Access Management IAM Analyst, IAM Engineer Active Directory, OAuth, privileged access
Cyber Security Management CISO, Head of Cyber Security, Cyber Security Manager Leadership, budget, board reporting
Secure System Development Application Security Engineer, DevSecOps Engineer Secure SDLC, SAST/DAST tools
Data Protection and Privacy Data Protection Officer, Data Protection Analyst UK GDPR, privacy impact assessments
Network Monitoring and Intrusion Detection Network Intrusion Analyst, NOC Security Analyst IDS/IPS, packet analysis
Cryptography and Communications Security Cryptography Analyst, Secure Communications Engineer PKI, encryption standards

Governance, risk, and cyber security management are consistently the most requested specialisms among UK employers, particularly in consulting, financial services, and government.

Where UK demand is strongest and what remote working looks like

Finance, telecommunications, aerospace and defence are the sectors driving the largest and most stable demand for core cyber professionals. Named employers in 2024 data included BAE Systems, BT, Vodafone, HSBC, JP Morgan Chase, and the Ministry of Defence.

  • Finance and professional services: high volume of GRC, IAM, and threat intelligence roles; often hybrid with London weighting.
  • Aerospace and defence: strong demand for security engineers and architects; many roles require SC or DV clearance and are strictly on-site.
  • Telecommunications: network monitoring, intrusion detection, and secure operations dominate; some remote options exist.
  • Central government and critical national infrastructure: steady mid-level demand; clearance requirements are common and can extend hiring timelines.

Remote and hybrid working is more prevalent in GRC, threat intelligence, and secure development than in SOC or incident response, where on-site or shift-based patterns remain standard. For a detailed look at remote cyber roles, the patterns vary considerably by specialism.

Skills, qualifications and UK career pathways

Entry routes into cyber security are broader than most candidates realise. The Government Cyber Security Academy specifically recruits motivated entrants from non-traditional backgrounds, prioritising problem-solving ability over prior certifications.

Study and entry options:

  • Degree-level apprenticeships (Cyber Security Technologist standard via Skills England) combine work and study with no tuition cost.
  • Full-time degrees in cyber security or computer science remain the most common route; 83% of job postings in 2024 requested a bachelor’s degree or higher.
  • Bootcamps and short courses (SANS, BCS, NCSC-certified providers) suit career changers who need speed.
  • Government programmes, including the Government Cyber Security Academy, suit candidates with strong analytical backgrounds.

Certifications that carry weight in the UK:

Level Certification Best suited to
Entry CompTIA Security+ First role, SOC analyst
Mid CREST CRT, CEH Penetration testing, security engineering
Senior CISSP, CISM Architecture, management, GRC
Governance ISO/IEC 27001 Lead Implementer GRC, audit, compliance

AI skills are becoming relevant: 53% of cyber businesses already use AI tools, and 65% expect the need for AI skills among employees to increase over the next 12 months.

Pro Tip: If you are coming from physical security or policing, you already have incident reporting discipline, situational awareness, and chain-of-custody experience. Pair those with CompTIA Security+ and a home lab, and you are a credible SOC analyst candidate within six months.

How to break into cyber security from physical security or policing

  1. Map your existing skills. Incident reporting becomes incident response; patrol observation becomes network monitoring; chain-of-custody handling maps directly to digital forensics.
  2. Build a home lab. Set up a virtual environment using free tools such as VirtualBox and TryHackMe to practise real scenarios. Employers notice candidates who can demonstrate practical work.
  3. Gain a foundation certification. CompTIA Security+ is the standard starting point; it takes most candidates 8–12 weeks of part-time study.
  4. Apply to SOC analyst and junior GRC roles. These are the most accessible entry points and the ones where transferable skills are most valued.
  5. Use niche UK job boards. General boards surface thousands of irrelevant results. Sector-specific platforms such as Securityjobsboard list roles written for security professionals, which means less noise and faster matching. For a comparison of where to search, see the best job sites for cyber security.
  6. Target apprenticeships. The Cyber Security Technologist apprenticeship standard (Skills England OCC1021) covers three pathways: Cyber Defend and Respond, Cyber Risk Analyst, and Cyber Security Engineer. All three are realistic entry routes for candidates with physical security backgrounds.
  7. Tailor your CV language. Replace “patrolling premises” with “monitoring access control systems and responding to security incidents.” The substance is the same; the framing speaks to a cyber hiring manager.

Career progression and typical UK salary bands

A realistic progression timeline looks like this: 0–2 years in an entry-level SOC or junior GRC role, 2–6 years at mid-level (senior analyst, security engineer, risk manager), and 6 or more years at senior, architect, or leadership level.

Salary callout: The 2025 skills report puts the median salary for core cyber roles at £55,000 (2024 data), with significant variance by sector and seniority. Defence and finance roles typically sit above that median; public sector roles often below it.

Career stage Typical experience Approximate salary range
Entry (SOC analyst, junior GRC) 0–2 years £25,000–£35,000
Mid (senior analyst, security engineer) 2–6 years £40,000–£65,000
Senior (architect, CISO, lead consultant) 6+ years £70,000+

A significant portion of postings require mid-level experience, indicating that entry-level roles should be explicitly advertised and training investments expected. Candidates who see “2 years minimum” on a junior advert simply move on.

Key takeaways

The single most useful thing a UK jobseeker or employer can do right now is map their target role to the UK Cyber Security Council’s 15 specialisms, then act on that mapping with a concrete next step.

Point Details
Six core job families Operations/SOC, engineering, testing, intelligence/forensics, governance/risk, and secure development cover the full range of cyber roles.
Median salary £55,000 The 2024 median for core UK cyber roles; entry roles start around £25,000–£35,000 and senior roles are £70,000 or higher.
63% of roles need mid-level experience Most postings require 2–6 years; entry demand is falling, so transferable skills and practical portfolios matter more than ever.
Physical security skills transfer Incident reporting, chain of custody, and situational awareness map directly to SOC analyst and digital forensics roles.
Securityjobsboard for UK listings Securityjobsboard lists sector-specific cyber and security roles, free for jobseekers, with BSIA affiliation for employer credibility.

The UK cyber market is not what the headlines suggest

The 33% drop in core cyber job postings from 2023 to 2024 sounds alarming. It is not the whole story. What the data actually shows is a market that has stopped hiring indiscriminately and started hiring precisely. Employers are looking for people who can do specific things well, not generalists with a certificate and a vague interest in security.

That shift is good news for candidates coming from physical security, policing, or the armed forces. You have something most fresh graduates do not: real operational experience under pressure. The mistake most career changers make is trying to hide that background and present themselves as a pure technologist. The smarter move is to lead with it. A SOC analyst who has managed a physical security incident, written a post-event report, and briefed a senior officer is already doing 60% of the job. Add the technical layer on top and you become a genuinely unusual candidate in a market that is tired of identical CVs.

For employers, the lesson is equally direct. Aligning job adverts to the UK Cyber Security Council specialisms is not bureaucratic box-ticking; it is the fastest way to attract candidates who understand what the role actually involves. Vague adverts attract vague applicants. Specific adverts, tied to named specialisms and honest about experience requirements, attract people who already know what they are signing up for.

Useful UK sources and next reading

  • UK Cyber Security Council career framework — 15 specialisms, role descriptions, and career pathway planning tool.
  • Cyber security skills in the UK labour market 2025 (GOV.UK) — annual findings on vacancies, salaries, and skills gaps.
  • Government Cyber Security Academy — entry programmes for non-traditional candidates into government cyber roles.
  • BSIA (British Security Industry Association) — industry standards and guidance relevant to employers in the physical and cyber security overlap.
  • Securityjobsboard — jobseekers — search active UK cyber and security vacancies, create a profile, and set job alerts free of charge.
  • Securityjobsboard — employers — post roles, browse CVs, and reach candidates already working in the UK security sector.
  • Types of jobs in security: 2026 career guide — broader context on how physical and cyber security roles relate.

Suggested next steps: check current apprenticeship vacancies on the Skills England occupational maps, register on Securityjobsboard to receive alerts for roles matching your target specialism, or use the UK Cyber Security Council framework to rewrite your job advert around specific skills rather than generic titles.

Securityjobsboard: where UK security professionals find cyber roles

Securityjobsboard

Securityjobsboard is built specifically for the UK security sector, which means every role listed is relevant to someone with a security background. There is no sifting through retail or hospitality jobs to find the one cyber posting buried on page four. Jobseekers can register, upload a CV, and set alerts for their target specialism entirely free of charge. Employers get a direct line to candidates who already understand the sector, with flexible posting options and a CV database to search proactively.

The BSIA affiliation matters here. It signals to both sides of the market that the platform operates to recognised industry standards, not just as a generic aggregator. If you are a physical security professional looking to move into a SOC analyst or GRC role, register on Securityjobsboard today and set an alert for your target specialism. If you are hiring, post your role and reach candidates who already speak the language of the sector.

FAQ

What are the main jobs in cyber security in the UK?

The main roles are SOC analyst, incident responder, penetration tester, security engineer, security architect, threat intelligence analyst, digital forensics investigator, GRC manager, and IAM specialist. The UK Cyber Security Council organises these across 15 specialisms.

What qualifications do you need to work in cyber security?

Most UK employers request a bachelor’s degree or higher, but apprenticeships and bootcamps are recognised entry routes. CompTIA Security+ suits entry-level candidates; CISSP and CISM are standard at senior level. The Government Cyber Security Academy accepts candidates without prior technical certifications.

Can I move into cyber security from a physical security background?

Yes. Incident reporting, chain-of-custody discipline, and situational awareness from physical security roles map directly to SOC analyst and digital forensics positions. Pairing that experience with a foundation certification such as CompTIA Security+ is a credible and fast route in.

What is the typical salary for a cyber security job in the UK?

The median salary for core cyber roles was £55,000 in 2024. Entry-level roles typically range from £25,000 to £35,000, mid-level from £40,000 to £65,000, and senior or architect roles start at £70,000 or higher.

Where can I find cyber security jobs in the UK?

Securityjobsboard lists sector-specific cyber and security vacancies across the UK, free for jobseekers. It is affiliated with the BSIA and focuses exclusively on the security sector, which means less noise than general job boards.