If you’ve been in the workforce for a while, you may be considering a career change. You’re not alone. According to FlexJobs’ 2026 State of the Workplace Report, 43 percent of surveyed professionals are actively trying to change career fields this year.
Maybe you want a new position that builds off what you're currently doing, or maybe you’re thinking of something in a completely new field. Either way, if you're considering a career in cybersecurity, you're probably making a sound choice. According to the Bureau of Labor Statistics (BLS), job growth for information security analysts is projected at 21 percent from 2025 to 2035, much faster than the average for all occupations.
But at this stage, you may be wondering if you’ve missed your opportunity to move into a continuously evolving and technically complex field like cybersecurity. Could it be too late for you to get started on a cyber career?
We asked Steve Epstein, PhD, portfolio director of cybersecurity at University of Maryland Global Campus (UMGC), to give his expert insight on the prospects for seasoned professionals moving into the cyber field later in their careers.
Can someone be too old to start a degree program in cybersecurity?
EPSTEIN: Absolutely not. Cybersecurity is a field in which maturity and previous professional experience can be significant advantages. Older students often bring valuable skills in leadership, communication, problem solving, risk management, customer service, compliance, and business operations. These abilities are highly relevant because cybersecurity is not solely a technical discipline. It is also about protecting an organization’s people, processes, systems, and information.
Cybersecurity is also a broad field with many different career paths. For example, cybersecurity technology may appeal to someone who enjoys learning how computers, networks, and other systems operate, and then determining how to secure them. Cybersecurity management and policy focuses more on understanding technology well enough to assess risk, develop policies and best practices, meet regulatory requirements, and help organizations make sound security decisions. Although cybersecurity management and policy is generally less technical, it remains a vital part of an organization’s cybersecurity program.
Technology can be learned at any age. What matters most is a willingness to remain curious, practice new skills, and recognize that cybersecurity requires continuous learning. I have seen adult students successfully enter cybersecurity after careers in the military, education, healthcare, law enforcement, business, finance, and many other fields. Your previous career is never wasted experience; it can provide a valuable perspective and become the specialization that distinguishes you from other candidates.
What should I consider in preparing for a career change to cybersecurity?
EPSTEIN: First, identify the specific type of cybersecurity work that interests you. Cybersecurity includes technical areas such as network security, cyber operations, ethical hacking, cloud computing, and digital forensics. It also includes less technical but equally important areas such as governance, risk management, compliance, privacy, policy, training, auditing, and cybersecurity leadership.
Next, evaluate the skills you already possess and identify the gaps that you need to address. If you’re entering a technical cybersecurity role, you’ll want to develop a basic understanding of computers, networks, operating systems, cloud technologies, and security principles. Hands-on practice is extremely important. Virtual labs, cybersecurity competitions, home labs, internships, volunteer opportunities, and scenario-based academic projects can help turn theoretical knowledge into practical ability.
A degree can provide the broader foundation and critical-thinking skills needed for a long-term career, and an undergraduate or graduate certificate offers a great way to gain skills and a valuable credential quickly. The course work exposes you to all the different areas in cyber to help define interests you did not know you had, while an industry certification can demonstrate knowledge in a particular area when you find an interest. Students should also develop communication, teamwork, and writing skills. Cybersecurity professionals must be able to explain complex risks to people who may not have technical backgrounds.
Finally, you should be realistic about your first position. The first job may be an entry-level cybersecurity role or a position in IT, networking, auditing, compliance, or technical support that provides a pathway into cybersecurity. The objective is to begin building relevant experience and then continue progressing.
What are my options if I already have a career in cybersecurity but want to advance?
EPSTEIN: Once you identify the area you want to pursue, review current job postings for those positions. Pay close attention to the skills, experience, education, and industry certifications employers consistently request. This can help you identify gaps in your qualifications and create a focused professional development plan. Preparing for a relevant certification can provide the foundational knowledge needed for the next level and may help your résumé stand out when applying for an interview.
AI tools can also assist with this process. For example, you can use AI to compare your current résumé and skills with several job descriptions, identify commonly requested qualifications, recommend topics to study, and develop a learning plan. However, AI-generated drafts should always be verified against current job postings, official certification requirements, and trusted industry sources.
An advanced degree or graduate certificate can help you expand beyond your current specialty and better understand how cybersecurity supports organizational objectives. Certifications can also be valuable when they align with your specific career goal. For example, you might pursue credentials related to cloud security, ethical hacking, cybersecurity analysis, risk management, or security leadership.
However, advancement requires more than collecting credentials. Seek opportunities to lead projects, participate in incident-response exercises, develop policies, brief senior leaders, mentor colleagues, and collaborate across departments. The ability to connect cybersecurity decisions with business operations, legal requirements, organizational risk, and financial priorities becomes increasingly important as you move into leadership.
Because the field changes so quickly, to be a successful cybersecurity professional is to be a lifelong learner. Artificial intelligence, automation, cloud computing, identity management, privacy, and evolving regulations are continually changing both cyber threats and the ways organizations defend themselves.
Do all UMGC’s cyber programs require a technical background, or are some designed for people without one?
EPSTEIN: UMGC offers several cybersecurity pathways, and they do not all require students to begin with a technical background. For example, the bachelor’s programs in Cybersecurity Technology and Cybersecurity Management and Policy do not require previous cybersecurity experience for admission. The courses build knowledge progressively, although students should be prepared to invest time in learning and practicing unfamiliar concepts.
The cybersecurity management and policy bachelor's is particularly appropriate for students interested in areas such as governance, risk, compliance, policy, incident management, and leadership. It combines technical awareness with concepts from business, management, law, and psychology. The cybersecurity technology bachelor’s provides a more technically focused pathway covering areas such as networking, operating systems, cloud computing, ethical hacking, security administration, and troubleshooting.
The BS in Cyber Operations is more programming-intensive and focuses on areas such as secure software, malware analysis, automation, and offensive and defensive cyber operations.
At the graduate level, the MS in Cybersecurity Management & Policy has many students without technical backgrounds. Students should carefully review the expectations of the individual program. Some technical graduate programs recommend prior knowledge of information technology, networking, databases, or related subjects, while programs in management and policy may be a better fit for professionals pursuing governance or leadership roles.
How do the coursework and projects in these programs help prepare me to gain real-world experience?
EPSTEIN: UMGC’s cybersecurity courses emphasize applying knowledge rather than simply memorizing terminology. Depending on the program, students may analyze organizational risks, configure and secure systems, investigate security incidents, conduct vulnerability assessments, develop policies, evaluate emerging technologies, create incident-response plans, or present recommendations to organizational leaders.
Hands-on courses can expose students to areas such as penetration testing, ethical hacking, packet analysis, cloud computing, system administration, network security, and security monitoring. Many graduate courses use UMGC’s virtual learning environments where you can demonstrate practical cybersecurity abilities. You can also pursue opportunities through UMGC’s Globally ranked Cybersecurity Competition Team.
Coursework does not completely replace professional experience, but it can help students develop practical skills, work products, and examples they can discuss during interviews. The strongest candidates combine academic learning with labs, competitions, internships, volunteer activities, professional networking opportunities to apply their knowledge in the workplace, and many of the classes are certification-based.
Which industry certification exams can UMGC’s cyber programs help prepare me for?
EPSTEIN: The answer depends on the degree, certificate, and courses you select. UMGC courses may help prepare you for certifications from several major industry organizations, including
- CompTIA A+, Network+, Security+, Linux+, Cloud+, CySA+, PenTest+, SecurityX
- CompTIA's new SecAI+ EC-Council Certified Ethical Hacker
- Cisco CCNA and selected CCNP certifications
- AWS Certified Cloud Practitioner and AWS Certified Solutions Architect Associate
- ISC2 Certified Cloud Security Professional and Certified Information Systems Security Professional
- Red Hat Certified System Administrator (RHCSA)
- Microsoft Azure Fundamentals (AZ-900) and Microsoft 365 Endpoint Administrator Associate (MD-102)
- Professional in Business Analysis (PMI-PBA)
- Digital forensics:
- ICMDE: IACIS Certified Mobile Device Examiner
- CHFI: Computer Hacking Forensic Investigator
- GCFE: GIAC Certified Forensic Examiner
All of these certification exam-based classes are available to take across all the cybersecurity programs. Each program has a different set of core courses that are required for that degree, as well as electives where you can specialize in specific areas of choice. These electives can also cross into more advanced AI courses, as well.
Remember that completing a course does not guarantee that you will pass a certification exam. Some certifications also have professional experience requirements that are separate from passing the exam. And all will require extra studying beyond the courses. Students should select certifications strategically based on their experience, intended career path, and the positions they hope to pursue.
What other advice can you offer folks considering a career move to cybersecurity?
EPSTEIN: Don’t feel that you must know everything before beginning. No cybersecurity professional knows everything, and the field changes too quickly for anyone to stop learning.
Cybersecurity needs people with different experiences, abilities, and perspectives. Technical aptitude is valuable, but so are sound judgment, ethical decision-making, curiosity, persistence, communication, and the ability to understand how an organization operates. A successful cybersecurity career is built one course, one skill, one project, and one experience at a time.
Reference on this webpage to any third-party entity or product does not constitute or imply endorsement by UMGC nor does it constitute or imply endorsement of UMGC by the third party.
