How Do I Move From Infrastructure Into Cyber Security?

You don’t need to start again. For most Infrastructure Engineers, the move into cyber security is a sideways step rather than a leap: you take the part of infrastructure you already know best, whether that’s identity, cloud or networking, and lean into the security side of it. A Systems Engineer working heavily with Entra ID and Conditional Access might move into Identity and Access Management (IAM), a Cloud Engineer into Cloud Security, and a Network Engineer into Network Security.

Hayley Bee, our cyber security specialist and Principal Consultant, regularly talks with Infrastructure, Network and Cloud Engineers about making this move. And the encouraging part is that your infrastructure background isn’t something you need to leave behind. In fact, it’s one of the things Cyber Security Managers ask us for most.

What’s the cyber security market like in Australia right now?

It’s a tricky market to break into cold, but a good one for people who bring real technical experience. In our Market Report & Salary Guide 2026/27, we rated cyber security hiring as very hard, with employers most selective about technical depth and specialist capability. Budgets are mostly maintaining current headcount, and as AI takes on more lower-level tasks, there are fewer junior roles to go around.

That’s exactly why the infrastructure route works. You’re arriving with the hands-on experience employers are prioritising. The same report found that on the infrastructure side, cloud and security skills are already commanding a clear pay premium, so moving in this direction tends to pay off even before your job title changes.

Which area of cyber security is closest to the work you already do?

Start by looking at what you spend most of your week on. The most natural moves we see look like this:

• Systems Engineer → IAM. If you’re deep in Entra ID, Conditional Access and privileged access, you’re already doing a lot of what an IAM specialist does.
• Cloud Engineer → Cloud Security. You know how the environment is built, which is half the job of securing it.
• Network Engineer → Network Security. Firewalls, segmentation and traffic flows are a natural next step.
• Infrastructure Engineer → Security Engineering. If you keep getting pulled into security projects, that’s often the start of the transition.

As Hayley puts it: “Cyber security doesn’t always have to be a dramatic career change. Sometimes it’s simply the next stage of your technical career.”

What can you do if the direct route isn’t opening up yet?

Hayley’s first piece of advice is to keep strengthening the foundations: networking, infrastructure, identity, cloud and endpoints. It can feel like you’re standing still, but this is the knowledge that makes you valuable once you do move across.

It’s also worth getting closer to security work in your current role. Many people make this move without changing employers first. If there’s a security project happening in your team, put your hand up for it. The more involved you become in that work, the more your experience starts to look like security engineering on a CV, and the easier the conversation becomes when you apply for a cyber security role.

Who already works in cyber security that you could learn from?

Build relationships with people already working in cyber security. Ask them how they got there and what their employers actually value. You’ll often find their path looked a lot like yours. And while you’re at it, look sideways as well as upwards. IAM, cloud security and security engineering can all be excellent transition points, even if they’re not the role you eventually want.

What do Cyber Security Managers actually look for?

One of the most common requests Hayley gets from Cyber Security Managers is for candidates with strong foundations in infrastructure, networking and cloud. The reason comes down to understanding.

“Having that foundational knowledge means you understand not just what you’re securing or changing, but why those changes need to happen in the first place.”

Without it, she explains, you can find yourself following processes, implementing controls and completing tasks without really understanding the risks you’re addressing or the impact of the changes you’re making. Or, in her words: “It’s about understanding the technology you’re protecting, not just the security tools you’re using.”

The same pattern shows up in DevSecOps, which is becoming an increasingly common route into cyber security. These are usually people who started in DevOps and moved gradually into security through IAM, secrets management, cloud security or securing CI/CD pipelines. But there’s a catch. Hiring managers often still want DevOps Engineers who originally came from infrastructure, networking or systems administration. Those people stand out because they already understand how systems communicate and where the risks sit, and they’ve built automation, Infrastructure as Code and containerisation skills on top of that.

So if you’re coming from infrastructure, you’re holding the hardest part to teach.

Frequently asked questions

Do I need to start in a junior cyber security role?

Not necessarily. Junior cyber security roles are becoming harder to find as AI takes on more entry-level work. For most Infrastructure Engineers, a sideways move into an area like IAM or cloud security, using the experience you already have, is the more realistic route.

Will I take a pay cut moving into cyber security?

It depends on the level you move in at, but there’s a lot of overlap. In our salary guide, a senior Infrastructure Engineer in Sydney or Melbourne sits around 120k-140k+, while a mid-level Security Engineer sits around 110k-150k+ and a senior one 150k-180k+ (permanent, base excluding super).

Can I move from DevOps into DevSecOps?

Yes, it’s an increasingly common route, and you’ll stand out most if your DevOps skills sit on top of an infrastructure, networking or systems administration background.

Which cyber security skills are employers asking for most?

In our 2026/27 report, the top skills in cyber security roles were SIEM, IAM and DFIR (digital forensics and incident response). IAM is the one most Infrastructure Engineers already have a head start in.

Thinking about making the move?

If you’re an Infrastructure, Cloud or Network Engineer weighing up a move into cyber security, have a chat with Hayley. She can tell you which sideways step makes sense for your background and what employers are asking for right now. Or browse our live cyber security jobs.