Yes, you can make a career change to cyber security at 40, or at 35, or at 52. The switchers who succeed rarely compete with 22-year-olds on raw technical hours; they aim at roles where their existing experience is an advantage, then add the technical layer on top.
That’s the honest version, and it cuts both ways. Your age is not the barrier most people fear. Your time, your finances and the risk of picking the wrong target role are the real constraints. This plan is built around those.
Is it too late to get into cybersecurity at 40?
No, and the reason is structural rather than motivational. Security work is mostly about judgement: deciding what matters, explaining risk to people who don’t want to hear it, following a process when things go wrong, and writing clearly. Those are skills people build over decades in other careers.
Look at the NICE Workforce Framework published by NIST, which describes cybersecurity work roles and the knowledge and skills each needs. A large share of those roles involve policy, risk, audit, training, investigation, project work and communication, not only hands-on hacking. Many of them are a natural extension of what a mid-career professional already does.
What is harder later in life:
- Time. You may have children, parents, a mortgage or rent, and a job you can’t drop.
- Financial risk. Taking a pay cut to start at the bottom hurts more at 40 than at 22.
- Ego. Being a beginner again, sometimes alongside people half your age, takes some swallowing.
None of those are reasons not to switch. They are reasons to plan the switch carefully.
Where your experience gives you a head start
The single most useful exercise for a career changer is mapping your current background to a security role that values it. Here’s a starting point:
| Your background | Roles where it counts | What you’d need to add |
|---|---|---|
| Banking, finance, fraud, compliance | Fraud analyst, GRC analyst, third-party risk, AML-adjacent security roles | Security fundamentals, a framework (ISO 27001 or NIST CSF), basic log reading |
| Internal or external audit | IT audit, GRC analyst, SOC 2 or ISO 27001 readiness work | IT controls, how systems actually work, evidence collection for technical controls |
| Law, legal ops, data protection | Privacy and data protection, GRC, policy, incident response coordination | Security concepts, data flows, the NDPA or GDPR in practice |
| IT support, sysadmin, networking | SOC analyst, security engineer, vulnerability management, pentesting | Attack techniques, detection, security tooling |
| Teaching, training, HR | Security awareness, training design, GRC | Security fundamentals; phishing simulations and how to measure them |
| Military, police, investigations | Incident response, threat intelligence, investigations | Technical foundations: networking, operating systems, logs |
| Project or operations management | Security project and programme management, GRC | Security vocabulary, frameworks, risk registers |
| Software development | Application security, DevSecOps, pentesting | OWASP Top 10, secure code review, testing tools |
If you’re coming from audit, legal or banking, our deeper guide on moving into GRC goes through that route step by step.
The pattern: pick the role where you start at “experienced professional who’s new to security”, not “complete beginner”. That is the difference between a lateral move and a restart.
Which role should a career changer pick?
If you are unsure, use these three questions:
- Do you enjoy hands-on technical puzzles for hours at a time? If yes, SOC analysis, vulnerability management or eventually pentesting may suit you. If you’d rather not, GRC, audit, privacy and awareness are serious careers, not consolation prizes.
- Can your current employer use a security-minded person? An internal move is often the lowest-risk switch available. Many organisations would rather train a trusted employee who already knows the business.
- How much income can you put at risk, and for how long? This decides whether you aim for a direct switch, an internal bridge role, or a slower part-time transition.
The honest 12-month plan
This assumes eight to ten hours a week alongside a full-time job. If you have more time, compress it; if you have less, stretch it. Consistency beats intensity. Ten focused hours every week for a year will take you further than a burst of forty hours in January followed by nothing.
Months 1–3: foundations and a decision
Goal: understand enough to choose a target role with your eyes open.
- Networking basics: IP addresses, ports, DNS, HTTP and what a firewall does.
- Operating systems: comfort with both the Windows and Linux command lines.
- Core security concepts: confidentiality, integrity and availability; authentication; common attacks such as phishing and account takeover; what a vulnerability is.
- Build a tiny lab: install VirtualBox, create a Linux virtual machine and get comfortable with the basics. Your first hour might look like this:
$ whoami
learner
$ ip -brief addr
lo UNKNOWN 127.0.0.1/8 ::1/128
enp0s3 UP 10.0.2.15/24 fe80::a00:27ff:fe4e:66a1/64
$ ls -l /var/log | head -5
total 1840
-rw-r--r-- 1 root root 21094 Oct 10 08:12 alternatives.log
drwxr-x--- 2 root adm 4096 Oct 10 08:00 apache2
-rw-r----- 1 syslog adm 183442 Oct 10 09:41 auth.log
-rw-r--r-- 1 root root 64012 Oct 10 08:12 dpkg.log
$ sudo grep “Failed password” /var/log/auth.log | tail -2
Oct 10 09:40:58 lab sshd[2211]: Failed password for invalid user admin from 10.0.2.2 port 51744 ssh2
Oct 10 09:41:03 lab sshd[2213]: Failed password for invalid user admin from 10.0.2.2 port 51748 ssh2
Reading a log like that, and explaining what it means and what you’d do next, is a real piece of defensive work.
By the end of month 3, write down your target role and why. Our post on whether cybersecurity is hard to learn is useful here if the technical side feels daunting.
Months 4–6: depth in your chosen direction, and a certification plan
Goal: build the knowledge your target role is hired on.
- Technical track (SOC, vulnerability management): log analysis, a SIEM in a home lab, basic detection rules, the MITRE ATT&CK framework.
- GRC, audit or privacy track: a framework in depth, such as NIST’s Cybersecurity Framework 2.0 or ISO 27001, plus risk registers, policies and control testing.
- Pick a certification if it serves the role. For many entry and switcher roles, CompTIA Security+ SY0-701 is a common baseline. It is up to 90 questions in 90 minutes, with a passing score of 750 on a 100–900 scale, and covers five domains: General Security Concepts (12%), Threats, Vulnerabilities and Mitigations (22%), Security Architecture (18%), Security Operations (28%) and Security Program Management and Oversight (20%). CompTIA says the next version, Security+ V8, is expected to launch on or around 17 November 2026, and SY0-701 is still available; check CompTIA’s Security+ page for the current version, retirement dates and price before you book.
A note that matters: a certificate shows you completed a course; a certification is an exam-based credential from a certifying body like CompTIA. Employers read them differently, so describe yours accurately on your CV.
Months 7–9: build evidence
Goal: have three things you can show an employer, not just tell them.
Pick work samples that match your target role:
- SOC track: an investigation write-up of a lab incident, a detection rule with notes on false positives, a short report on a phishing email you analysed safely.
- GRC track: a risk register for a fictional company, a gap assessment against one framework, a policy you drafted and the reasoning behind it.
- Any track: a two-page security improvement plan for a fictional organisation in your current industry. This is where your background shines, because you know how that industry really works.
Keep everything fictional or lab-based. Never use your employer’s real data.
Months 10–12: the move
Goal: land the role, or a bridge into it.
- Try internal first. Talk to your security or IT team. Offer to help with something specific, such as an audit, an awareness campaign or a policy review. Internal moves often happen because someone did useful work before a vacancy existed.
- Rewrite your CV so the top third is about the role you want. Translate your experience into security language without overstating it.
- Apply selectively to roles where your background matters, and say why in the first lines of your cover letter.
Here’s an example of translating experience on a CV (or résumé):
| Before | After |
|---|---|
| “Managed branch operations and compliance checks.” | “Ran monthly compliance checks across 4 branches; identified and tracked control gaps to closure; trained staff on fraud red flags.” |
| “Handled IT issues for the office.” | “Supported 60 users on Windows and Microsoft 365; managed account access and resets; documented recurring incidents and fixes.” |
The second version uses the vocabulary of control testing and access management. The numbers in those lines are illustrative; use your own real ones.
Illustrative journey
Illustrative example, not a real student. A credit risk officer in her early forties studies about eight hours a week. After three months she decides GRC fits better than SOC work, because she enjoys risk assessment and dislikes night shifts. She spends months 4–6 learning ISO 27001 and NIST CSF, passes Security+ in month 6, and builds a vendor risk assessment for a fictional fintech as a work sample. In month 10 she offers to help her own employer’s information security team prepare for an audit. That collaboration becomes the evidence on her CV when she applies for a GRC analyst role. Nothing in that path required her to outpace a 22-year-old at hacking; it required her to point her existing strengths at a security problem.
Mistakes career changers make
- Quitting the current job first. Unless you have significant savings and a clear plan, keep your income while you learn.
- Collecting courses instead of building evidence. Five certificates of completion are worth less than one good work sample.
- Aiming only at penetration testing. It’s a great career, but it’s one of many, and often not the fastest route for someone with ten years in another field.
- Hiding your age or past career. Your past career is your differentiator. Lead with it.
- Believing anyone who promises a job. No course, bootcamp or certification guarantees employment. Anyone who says otherwise is selling something.
What about pay?
Be careful with salary claims you see online, including ones for “entry-level” roles. They vary enormously by country, sector and the evidence behind them. Make the decision on the role you want and the risk you can carry, then research pay for that specific role and location from sources that show their methodology. If you’re in Nigeria, one data point: According to Paylab Nigeria’s salary survey, IT security specialists in Nigeria earn ₦221,000–₦1,075,000 per month gross (80% of respondents; fewer than 20 verified responses; accessed October 2026). That covers a range of experience levels; it is not a starting salary.