Too Old for Cybersecurity? (The Brutal Truth)
Every week someone asks me if they're too old for cybersecurity. They're usually 45 or 50, sometimes 60. They've got a mortgage, a family, and a salary they can't afford to gamble with.
The short answer: no, you're not too old. People get into this field in their forties, fifties and sixties all the time.
But that answer on its own isn't much use, because age usually isn't the thing that's really stopping you. In this guide I'll show you what is. First, real people who made the switch later in life. Then why AI has quietly shifted the odds towards experienced workers. Then which roles to aim for instead of starting at the bottom, and how long it actually takes. Finally, one thing to do this week.
TL;DR if you've only got 30 seconds
You're not too old. People get in at 40, 50 and 55. The real blocker is usually money, not age.
AI is making fast technical work cheap and judgement scarce. Twenty years of work gives you judgement.
Skip the generic junior job. Pick the security role next to your background: developer to application security, a manager who has owned audits or compliance to governance, risk and compliance.
This week: rewrite your CV in security words (risk, control, governance, incident).
Let's start with the people who've already done it.
People Who Got In at 40, 50 and 55
These are StationX students I've worked with. I'm using first names only.
Jeff, in his fifties. He's now a Cyber Offense Analyst, and he calls it his dream role.
William, in his forties. He now works at the Pentagon, in the Navy's cyber advisory office.
Krisann, at 55. She started out in the sewing industry with no certifications at all. Thirteen months later she had nine, including one from ISC2 (one of the main bodies that set security certification exams), and she was invited to a workshop to write questions for a new ISC2 exam. In her words: "If I can make a change at 55, anyone can."
If you've ever read the comments under YouTube videos on this topic, you already know stories like these exist. Can people your age get in? They clearly can. So what's actually in your way?
The Real Blocker Isn't Age, It's Money
Picture someone who's 48. They earn a decent salary. They've got a mortgage and people who depend on them.
Almost every piece of advice they read says the same thing: start with an entry-level job. Get a help desk role, or a junior job in a security operations centre (a SOC, the team that watches alerts all day), and work your way up.
For a 24-year-old living with their parents, that's fine. For our 48-year-old, it might mean a big pay cut for a few years. That fear is completely reasonable.
But I think that fear belongs to the old job market, and the market is changing.
How AI Changed the Maths for Career Changers
For years, a young candidate's biggest advantage in cybersecurity was speed with the tools. They could configure systems quickly, run scans, and learn new software fast. And they were cheap to hire.
AI is now making that kind of work cheap. Think about the jobs a junior used to spend their week on: checking alerts, running scans, writing basic configurations. More and more of that is being done by AI, faster than any junior.
What AI can't do well is judgement. For example:
Which risk matters. Knowing which of fifty risks is the one that actually matters to this business.
What's worth building. Knowing what's worth building in the first place.
Saying no. Telling a nervous executive that the thing they're asking for is a bad idea, and getting them to listen.
If you've been working for 20 or 25 years, you've built up that kind of judgement in your own field: which problems really matter, what's worth doing, and when to push back. You can't download it and you can't get it from a certification. Add the security knowledge for the role you pick (more on that below) and it becomes security judgement.
So the skill that used to be scarce is getting cheap, and the skill you already have is getting scarce. I go deeper into how directing AI works, and why it changes what a security job is, in Karpathy's Agentic Engineering (Explained).
Skip the Junior SOC Job: Pick the Role Next to Your Background
This is where most career-change advice goes wrong. If you apply as a generic junior SOC analyst, you're competing with 24-year-olds on their terms. Don't do that.
Instead, pick the security role that sits right next to the work you already do. Two examples:
If you're a developer, look at application security. Application security (AppSec) is about finding and fixing security flaws in software. You already know where the bugs come from, because you've written some of them.
Real job ads back this up. MyFitnessPal is hiring an Application Security Engineer (remote, US) at $90,000 to $120,000. The requirement reads:
"2-4 years of experience in security engineering, application security, software engineering, or a closely related role"
Software engineering is on that list.
If you're a manager, look at governance, risk and compliance. Governance, risk and compliance (GRC) is the side of security that sets the rules, checks they're followed, and gets organisations through audits. You already know how organisations behave and how to get something approved.
At the top end, OpenAI is hiring a GRC Program Manager for Audit & Controls at $216K to $252K. One of the requirements:
"Direct ownership of meaningful audit, security, customer-assurance, or regulatory outcomes."
Notice what that asks for. It isn't general management. It's managers who have owned the result of an audit, a compliance programme, a regulatory deadline or a customer's security review, and answered for it. If you've managed people, budgets or operations but never owned anything like that, close the gap before you apply: volunteer to run your team's part of the next audit, or take charge of your department's risk register. That's the experience that turns "manager" into "GRC candidate" on your CV.
The same idea works for other backgrounds. Network engineers can move towards cloud and infrastructure security. People from audit or legal often fit GRC. For the full background-by-background version, with more real ads, see Which Cyber Security Job Fits Your Tech Background?
These aren't entry-level salaries, because these aren't entry-level jobs. They're jobs that need someone who has already worked for a long time.
But don't compare these ranges with an entry-level salary. Compare them with what you earn now. If your current pay is at or below the range, the specialist route may mean no pay cut at all. If you earn more than that, this route can still make the cut much smaller than starting on the help desk, but it can't promise there won't be one.
There is a catch, and it's worth being straight about. Even the MyFitnessPal role asks for 2-4 years in security or software engineering. If your background has nothing next to security, there may be no specialist role to step sideways into yet. Then a junior role really can be the right first move. It just shouldn't be the default for someone with 20 years of relevant experience.
⚠️ A note on the numbers. These are the ranges each employer advertised when we checked on 29 October 2026, in US dollars, and the top-end roles are at well-funded AI companies. Job ads close fast: several of the ads we first planned to quote had already closed when we checked. To see more, browse our AppSec ads and GRC ads, where every listing is checked and archived.
The Age Bias You Can't Talk Around
Now the part you won't like. Some hiring managers will look at your date of birth and pass. That's real, and you won't argue them out of it.
So don't try. It does narrow your options, and that's frustrating. Aim for the employers and roles where your experience is the point: the specialist jobs above, where 20 years of work is an advantage.
How Long a Cybersecurity Career Change Takes
This depends almost entirely on where you're starting from.
Already in IT, software development, or IT or security audit? Your day job is already close to security. Being ready for interviews in about three months is possible. We've seen people do it, but that's the exception, not the rule.
Somewhere in between? Maybe you're a manager, a project manager or a financial auditor aiming at GRC. You already do the risk, rules and sign-off side of the job, but you still need the technical basics. Expect to land between the two estimates, and budget towards the longer end.
Starting with no technical background, and nothing in your work that touches risk, controls or compliance? Plan on two to three years.
So let's run the numbers. Say it takes you two years. If you're 48 now, you'll be 50 when you get in, with 15, maybe 20 years of working life still ahead of you.
Two years to buy twenty. That's the trade.
Why Career Changers Actually Fail
The people who don't make it rarely fail because of their age. They fail because they spread themselves across everything.
A bit of networking. A bit of cloud. A bit of malware analysis. A bit of hacking. After two years they've learned a lot, but they're not qualified for anything in particular. A lot of broad degrees leave people in the same place.
If that sounds like you, you're not behind. You've just been aiming at a target that's too wide. Pick one role, ideally the one next to your background, and learn what that role needs.
What to Do This Week: Rewrite Your CV in Security Language
One thing you can do this week takes about 20 minutes.
Open your CV and your LinkedIn profile. Go through them and circle every time you:
Managed a risk. A supplier that might fail, a deadline that might slip, a budget that might overrun.
Enforced a rule. A policy, a process, a sign-off that had to happen.
Had to tell someone no. And made it stick.
Then rewrite those lines using security words: risk, control, governance, incident.
This is a made-up example, not a real CV, but it shows the idea. A project manager might have written "Managed supplier relationships and kept projects on schedule." Rewritten in security language, the same experience becomes "Assessed supplier risk and enforced contract controls across 12 suppliers, escalating issues before they became incidents."
You've been doing security or risk work for years. You've just been calling it something else. On its own, that won't qualify you for the job. What it does is show a hiring manager which of your experience carries over.
✅ Where to go next. I've put the rest of this in writing: which roles map to which backgrounds, and what to learn in what order. It's a free web-book called Become the Cyber Security Expert the AI Era Demands, and it reads in your browser. If you want structure, mentoring and real supervised projects to get you there, have a look at the AI Master's Program.
Frequently Asked Questions
Is 50 too old to get into cybersecurity?
No. People get in at 50 and older. At 50 you may still have 15 to 20 working years ahead, so even a two-year switch leaves a long career. Aim for a role that uses your existing experience rather than a generic junior job.
Will I have to take a pay cut to move into cybersecurity?
Not necessarily, but it depends on what you earn now. If you aim at a generic entry-level role, a pay cut is likely. If you aim at a specialist role next to your background, such as application security for developers or GRC for managers who have owned audit or compliance work, advertised salaries are often well above entry level. Compare those ranges with your current pay, not with entry-level pay. The specialist route can shrink the cut or avoid it, but it can't guarantee there won't be one.
Do I need a degree to get into cybersecurity?
Not always. The application security role in this article asks for "Education and/or certifications equivalent to BS in Computer Science or IS related field". So certifications can stand in for the degree. Focused skills and proof of what you can do count for more than a broad qualification.
What's the best cybersecurity role for a career changer?
The one closest to what you already do. Developers often fit application security. Managers who have owned audit or compliance work, auditors, and people from legal often fit governance, risk and compliance. Network engineers often fit cloud and infrastructure security.
How long does a career change into cybersecurity take?
From IT, software development, or IT or security audit, being interview-ready in about three months is possible but unusual. From no technical background, plan on two to three years. Managers, project managers and financial auditors aiming at GRC usually land in between, so budget towards the longer end.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
