Pathways Into Cybersecurity: Is There a Right Way In?

Thomas Burt • August 4, 2025

How to stand out, or step in, to a growing field.

Peoplebank employee in a light green blazer stands in a server room

Cyber security continues to be one of the most in-demand areas of IT, with businesses facing mounting threats and needing professionals who can protect their infrastructure, data, and users. But for those looking to break into the industry (or move up within it) there’s often confusion about what the ideal path looks like.


Is a university degree essential? Do short courses count? Does infrastructure experience matter? In truth the best path often depends on individual priorities and contexts, but hopefully we can pass on some insights that lift the veil when it comes to navigating or crafting a career in cybersecurity. 


There’s No One-Size-Fits-All Path


While some roles still list formal degrees as a prerequisite, many employers today are open to varied forms of experience and training, especially when candidates can demonstrate hands-on knowledge and a security focused mindset.


For example, programs like a six-month Application Development course or intensive real-world learning (like Leaders IT’s’ CUSP program), include industry placements or project-based assessments that are incredibly effective for opening doors to employment. As Senior Sourcing Specialist, Patrick Fraser-Schmuki affirmed, “in the right context you’ll often get just as much value from one of these focused programs as a broader three-year bachelor’s degree.”


Two Common Entry Routes Into Cyber Security


For those serious about a cyber security career, two clear entry points tend to emerge:


  1. The Infrastructure Path
    Starting out in roles like infrastructure engineer, network engineer, or system administrator allows professionals to gain a broad understanding of how systems connect and operate. Over time, they build a “security lens” into their work and transition into cyber-specific roles with a deep understanding of the environments they’ll be protecting.

  2. The Direct Cyber Path
    Others pursue cyber security certifications or degrees from the outset, aiming to move straight into an entry-level security role. This can work, but it may offer a narrower perspective compared to someone who’s worked across multiple IT domains.


When it comes to senior or specialist cyber roles, that infrastructure lens is often a game-changer. From the perspective of a specialist recruiter, Patrick says, “If you’ve worked across networking, platforms, and systems, your security thinking becomes broader. It’s not just about spotting one vulnerability; at the higher levels you need to be aware of a diverse range of risks others might miss.”


What Do Employers Really Want?


While some clients request very specific experience backgrounds, most employers prioritise practical experience and adaptability.

Some are looking for generalists they can train on particular tools or technologies. Others prefer candidates who’ve grown into cyber roles through other IT disciplines. The consistent key is showing a strong foundation in IT and a clear interest in security.


From his experience Patrick said, “there are more doorways open to those who’ve built a solid IT background and then transitioned into security. That foundation can make someone more effective in a cyber role, and more attractive to a hiring manager.” 


Making the Move: Advice for Mid-Career Transitions


If you're already working in IT and looking to shift into cyber security, a great first step is to lean into the security elements of your current role.


Whether you're in network engineering, cloud infrastructure, or even development, there’s likely a security angle to your work. Flag that interest to your manager, take on related tasks, and consider upskilling through targeted certifications.


Then, look for bridging roles like security-focused network engineering or architecture, which blend existing skills with a stronger cyber emphasis. These stepping stones can eventually lead to fully specialised security roles.


The Pursuit Will Pay Off


There’s no universal blueprint for getting into cyber security, and that’s a good thing. Whether you’re coming from a structured university degree, a coding bootcamp, or a general IT background, what matters most is your curiosity, practical experience, and commitment to learning.


At Peoplebank, we’ve seen successful cyber professionals evolve through all kinds of journeys. If you're looking to explore the next step in your cyber career or find the right candidate for your team, get in touch with us.


By Aniela R • October 22, 2026
Australian organisations are adopting AI at extraordinary speed. Copilots are writing code, agents are moving through business systems and employees are putting company data into public tools, often before security teams have had a say. Attackers are using the same technology to sharpen phishing, automate reconnaissance and identify weaknesses faster. Cyber security and the people responsible for it, has moved firmly up the board agenda. The question is whether boards and executive teams are backing their concern with the investment and capability required to manage the risk. Cybersecurity is no longer just an IT responsibility. In many organisations, it has become the foundation upon which digital transformation, customer trust and operational resilience are built. While it was once viewed as the digital equivalent of locking the front door, cybersecurity is now embedded in every aspect of business performance and growth. AI is expanding the cyber threat landscape Every new AI tool, integration and agent creates another potential way in. Proofpoint's 2026 Voice of the CISO report found 85% of Australian CISOs view generative AI as a security risk, up nine points in a year, while 83% believe employees are likely to use AI in ways that could expose sensitive data. The cost is rising too. The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024–25, while the average self-reported cost per report for a large business rose 219% to $202,700. From Peoplebank's perspective, this makes cyber security as much a workforce challenge as a technology one. As AI expands the risk landscape, technology investment must be matched by investment in people who can secure it, govern its use and build resilience. How boards are navigating the evolving risk landscape The AICD's Director Sentiment Index for the first half of 2026 ranked cyber crime and data security among directors' top three concerns, while more than half said AI adoption was moving faster than their organisation could keep up. Boards are increasingly treating AI and cyber as connected risks. The conversation is shifting from "are we compliant?" to "what happens if this goes wrong?" Security leaders are expected to explain the potential impact on enterprise value, operations, reputation and data. Yet the expertise to challenge those answers can be missing. A 2025 Diligent Institute and Governance Institute of Australia survey found 53% of Australian boards named cyber security their top strategic priority, but only 13% had recruited AI-savvy directors and 21% mandated AI training. Diligent via KBI.Media ASIC has similarly warned that governance risks falling behind AI adoption. ASIC Peoplebank sees this as much a capability challenge as a governance one. Strong oversight depends on having expertise across the boardroom and the business to translate emerging AI and cyber risks into informed decisions and effective controls. Are boards approving more budget? Largely, yes. Gartner forecasts Australian information security spending will exceed AU$7.5 billion in 2026, up 9.5% on 2025, with AI adoption and AI-enabled attacks among the drivers. PwC's 2026 Digital Trust Insights found nearly three in four Australian organisations expected cyber budgets to rise, with 37% naming AI as their top cyber budget priority. But more budget does not automatically deliver more capability. Proofpoint found 79% of Australian CISOs are managing expanding AI risks without a proportional increase in resources or expertise. The tools are being bought, but the people needed to secure and govern them remain harder to find. Peoplebank identify a continuing talent shortage and a growing need for AI-literate security staff. The tools are being bought; the people needed to run and govern them are harder to find. What Peoplebank is seeing in executive hiring One sign that organisations are taking AI-driven cyber risk seriously is movement at the top of the security function. Peoplebank is seeing increased activity at CISO level, alongside greater appetite to build the teams beneath them. Demand for dedicated CISOs and Heads of Cyber has grown by around 20% year on year across Australian enterprise, government and SME organisations , with hiring activity particularly concentrated in Sydney and Melbourne. Peoplebank data shows that around 60–70% of executive briefs for CISO and Head of Cyber roles now explicitly include AI governance, AI threat mitigation or responsible AI adoption among their core responsibilities. The CISO role has expanded. Security leaders are increasingly expected to secure AI alongside the wider technology environment, from employee use and vendor risk to agents accessing business data. Security leaders are also open to moving. The IANS and Artico Search 2026 State of the CISO report found nearly seven in ten CISOs were open to a career move within the next year, while 52% said their scope was no longer fully manageable. New security leaders often arrive with a mandate to close capability gaps, creating demand further down the function for architects, engineers and governance specialists who can design controls, secure AI platforms and establish appropriate policy and assurance. The bigger picture for cyber talent and how it's shifting The most in-demand cyber security roles Peoplebank worked on in FY26 were Security Engineers, Security Architects and cyber security support professionals. Demand also remains strong across cloud security, security operations, identity and access management, and governance, risk and compliance. The wider skills challenge is significant. ACS Digital Pulse 2026 backs this finding, showing 84% of workers had used AI tools, but only 7% demonstrated advanced AI literacy. Peoplebank data shows cyber security roles take an average of 33 days to fill, eight days longer than broader technology roles. In FY26, 84% of Peoplebank's cyber security placements were contract engagements and 16% permanent. That model reflects how many organisations are accessing specialist capability. AI security requirements are often tied to defined programs, from securing new platforms to establishing AI governance, making contract specialists, project teams and salaried consultant models valuable ways to access capability quickly. Turning investment into capability For boards approving greater cyber investment, the challenge is turning that budget into capability. The organisations that do this well: Get the leadership right. A CISO with a clear mandate, reporting line and budget can turn investment into a coherent security program. Link hiring to risk. If AI data exposure is a priority, fund roles with the expertise to address it. Blend contract and permanent talent. Bring in specialists for urgent programs while building a permanent core that retains knowledge. Invest in existing people. Upskilling security and risk teams in AI can complement external hiring for scarce skills. Move quickly. With cyber positions taking longer to fill, slow approvals and lengthy interview processes increase the risk of losing strong candidates. AI will continue to reshape the threat landscape. Leadership teams that invest in the people, not just the platforms, will be better placed to adopt it safely and turn cyber investment into genuine resilience. How Peoplebank can help Peoplebank partners with organisations across Australia to source cyber security capability across permanent, contract and workforce solutions, from analysts and engineers to architects, security leaders and project teams. Whether you're appointing a security leader, securing an AI platform or building internal capability, our specialists can help you find the right people. Contact Peoplebank to discuss your cyber security hiring requirements.
Team meeting in a bright office | Salary Guide
By Aniela R • October 19, 2026
Salary Guide, trends, hiring insights
Australians in jobs
By Aniela R • August 3, 2026
New data reveals how Australians move between jobs and what it means for employers and job seekers Australia's workforce is more dynamic than many people realise. New research from Jobs and Skills Australia highlights how workers move between occupations and industries throughout their careers, providing valuable insights for employers, recruiters and professionals planning their next career move. According to JSA's newly released Occupation Mobility Interactive Tool, career pathways are often far more interconnected than traditional job titles suggest. Careers are no longer linear One of the key findings from the report is that occupations tend to form clusters, with workers moving between roles that share similar skills and experience requirements. Rather than following a single, predictable career path, many Australians build careers through a series of lateral moves, stepping stones and transferable skill opportunities. For example, Australia's most common occupation, Sales Assistant (General), acts as a significant gateway role. Workers frequently transition into related customer service positions, while others leverage their experience to move into higher-skilled roles such as retail management, administration and clerical positions. The research identifies eight broad occupational mobility clusters across the labour market, including: Social, Education and Service Health Science and Research Engineering and ICT Other specialised occupational groups These clusters demonstrate that many careers are connected through transferable skills, creating opportunities for workers to pivot into new occupations without starting from scratch. Careers are like LEGO creations. Even when you dismantle one model, the individual blocks remain valuable and can be reassembled into something entirely new. Transferable skills are the pieces that make career pivots possible.
Contract work
By Aniela R • July 3, 2026
Peoplebank Australia | Beyond the Contract | Benefits
Peoplebank contractor working at a desk
By Mimi Petrakis • May 20, 2026
Learn how workforce sustainability impacts IT recruitment. Focus on retention & strategic planning for a resilient workforce.
Peoplebank contractor in a bright office
By Mimi Petrakis • May 5, 2026
Learn key strategies to retain top tech talent. Enhance engagement & culture for better retention. Contact us for expert recruitment solutions.
A cyber security ai specialists defending against AI fraud
By Dimitri P • March 31, 2026
AI voice cloning is eroding trust in financial services. Learn key risks, layered controls, and the cyber/AI talent needed, via Peoplebank FS specialists.
Remote and hybrid work trends in Australia’s tech industry: balancing high-paying digital jobs with
By Dimitri P • February 28, 2026
Discover if remote and hybrid tech jobs in Australia pay less, or if top digital talent can now have both high salaries and flexible work options in 2026.
Peoplebank Feb 2026 Salary Guide Insights - role and regional pay benchmarks across 13 tech sectors
By Dimitri P • January 31, 2026
Find out more about the Peoplebank Feb 2026 Salary Guide for role-level pay bands, state insights, trend analysis and recruiter commentary to set competitive offers.
2026 tech hiring: AI fluency, data & cybersecurity demand, and hiring for learning mindset
By Dimitri P • December 31, 2025
Sumi Dahal predicts 2026 tech hiring will prioritise AI fluency, data and cybersecurity roles, and favour candidates with curiosity and a growth mindset.