Changing Lanes

The field looks like one job from outside. From inside it's a dozen, and not all of them connect.

Across white-collar work, more people are changing what they do, not just where they do it. Revelio Labs, a firm that sells workforce data to investors and HR departments, reckons that about 38.5% of job-switchers in 2025 moved into a different category of work, up from 35% in 2019. The destinations pulling people in hardest are the obvious ones: AI project coordinator, AI engineer, the roles every company is suddenly staffing. The figure is economy-wide, and it comes from a vendor whose business is making the labor market look worth watching, so treat the decimal point with suspicion. The trend underneath it is real enough: more people are changing the kind of work they do, not only the place they do it.

Inside cybersecurity, changing lanes is harder than that dashboard makes it look, because the field is not one job with a few variations. A security operations analyst, a detection engineer, a penetration tester, a governance and risk auditor, an identity engineer, and a security architect share a vocabulary and a set of conferences, and past that they do work that has little in common. The person watching alerts at two in the morning and the person writing a risk register for the board are both "in security," and on most days their jobs would be unrecognizable to each other.

The field does have maps, and they're worth reading. CyberSeek, the workforce tracker built by the analytics firm Lightcast with the certification body CompTIA and the government's NICE program, sorts cyber roles into feeder, entry, mid, and advanced, and its pathway tool will show you the lateral moves open from wherever you happen to be standing. The NICE Cyber Career Pathways work, maintained on the government side, groups roles the same way and marks both the moves up and the moves sideways. What the maps can't tell you, because they're drawn as clean lines between boxes, is which of those sideways moves is a short step and which is a cliff.

Here's the part you learn by watching rather than from a chart. Some moves are short. Security operations into detection engineering is one of the cleaner ones, but only for the analyst who has learned why alerts fire, what telemetry feeds them, and how bad logic turns into noise, rather than the one who has spent a year clicking through a vendor console. The same upstream curiosity makes security operations into threat hunting or incident response a close move. Threat intelligence looks like the same lane and isn't quite: it adds its own craft of sourcing, source evaluation, confidence language, and writing that a decision-maker can use, so treat it as adjacent rather than automatic. Blue team into red team is real and learnable too, though mostly for the hunters, responders, and detection engineers who already reason from attacker behavior; the proof a red team wants is evidence of exploitation method, clean reporting, and operational discipline, not defensive intuition on its own.

Other moves look adjacent on the map and play out as near-restarts. Governance, risk, and compliance into penetration testing is close to starting over. Into detection engineering it depends on what the GRC work involved: a career of policy and evidence collection is a restart, while time spent close to logs, cloud controls, and identity is much less of one. It runs both ways, but not as a mirror image. The exploit specialist who moves into writing policy isn't starting from zero on security judgment; she already knows which controls matter and which are theater. What she has to build is the governance side of the work, the audit rhythm, the risk language, and the skill of writing a control somebody else can operate.

Some of the most reliable bridges are the least glamorous ones, and they rarely make the conference talks: system administration or identity work into identity security, infrastructure or DevOps into cloud security, security operations into incident response or threat hunting, software development into application or product security, and hard-won practitioner experience into sales engineering or product work at a security vendor.

The move that fools the most people isn't sideways at all. Going from a technical seat into people management reads like a promotion up your own lane, and it's a different job in a different lane that happens to pay more. The distinction worth drawing is between technical leadership and managing people. A principal engineer, an architect, an incident commander, or a tech lead is still using the craft. A manager who owns headcount, budget, reviews, and hiring is using it as background, and the engineer who takes that title expecting to keep doing the work is the one who's unhappy a year later. It can be the right move. It's worth taking with both eyes open about what you're trading away.

So what travels when you change lanes? Less of the specific craft than people hope. The useful remainder is smaller: how systems fail, the adversary's habit of thinking, a working map of who owns what inside your organization, the shared vocabulary, and the trust you've already banked. That remainder helps you argue for the next lane. It doesn't stand in for proof that you can do the daily work once you're in it, and the particular craft, writing detections, running an audit, exploiting a web application, mostly stays in the lane where you learned it. Treating the substrate as a teleporter is how people take a distant move, fail to show the daily craft, and have to retreat.

The cheapest lane change, when it's available, is the one where you don't have to earn your credibility back from nothing, and that often means a move inside your own company. Economy-wide, and on Revelio's own workforce data, about 28% of career changes happen within the same parent firm; Revelio also argues, from earlier retention work, that the chance to move laterally predicts whether people stay more strongly than pay does. Treat that as vendor evidence for a believable point, not as a law of cybersecurity.

The mechanism is real where the conditions hold. When the company has an actual adjacent opening and managers who don't hoard their people, the colleague two doors down already knows you show up and keep your head when something's on fire, and that can be worth more to her than a stranger's flawless resume. It breaks in the ordinary case, though: the small security team with nowhere to move, the manager who blocks the transfer, the internal move that brings the new work and none of the new title or pay. For the leader, the lesson runs the other way. Build no internal lanes and you train people at your own expense, then watch them change lanes at someone else's company. The practical version of building one is a rotation, a stretch assignment, or a shared project with a receiving manager who's allowed to say yes before the person resigns.

A certification helps less than the marketing implies and more than the cynics admit. What it does is signal a direction. An offensive-security certificate tells a hiring manager you're serious about getting into offense; a cloud-security one says you're moving toward the cloud, and either can get you read for a lane you haven't worked in yet. What it doesn't do is make the move for you. The stretch project on real work, the thing you can point to, is what carries you across. And the numbers the certification bodies and the workforce vendors publish about which skills are scarce all carry the interests of the people publishing them, the ones who do well when the shortage looks dire. The figures from before this year are probably stale on top of that. The shape of the lanes outlasts any single year's count of them.

Since the whole economy is being told to run toward AI, the cyber version of that move deserves a straight answer. There's a real adjacent lane here: securing AI systems, reasoning about the risks in machine-learning pipelines, governing how models get used inside a company. Security people are well placed for parts of it, but only with the right neighboring craft: cloud, application security, data security, privacy, vendor risk, model risk, or architecture. A career spent in alert triage or audit doesn't carry into model lifecycle, data provenance, and the abuse of prompts and tools on its own. The lane is crowded and loud at the moment, with many of the people arriving from fields where demand has softened. On Revelio's data it's also one of the harder doors rather than an easy internal one: moves into AI roles happen inside the same company only about 18% of the time, against roughly 28% for career changes in general. Move toward it because the problems suit you, not because an arrow on a slide happens to point that way.

If you're going to change lanes, a few things separate a deliberate move from a bad one. Look one step over, not three: find your current role on CyberSeek or the NICE pathway and study what sits directly beside it before you fix your eye on the lane across the lot. Build the bridge skill while you're still drawing a paycheck, on real work: write one detection from the alert you keep closing, sit with the cloud team and document an identity failure path, turn an audit finding into a control test, write an incident note straight from the logs, or take one bug from report to fix alongside an engineer. Make the internal move first if there's one to make, because spending banked trust beats buying new. And be specific about what you carry and what you don't. Tell the hiring manager, in plain terms, that you've done alert triage and log analysis but haven't owned detection-as-code yet, and then show the detection you wrote and tested. That kind of honesty reads as judgment, not weakness.

The lanes are learnable, and you can know the distance between them before you move. What nobody hands you is the map of which walls are real and which are painted on. You get that by watching who crossed before you and what it cost them, or by asking them while you've still got the choice. The people who ask first tend to be the ones who get across.

Sources

Revelio Labs, "AI Prompts a Rise in Career Changes" (also headed "Career Switching Is Rising, and AI Is Driving It"), Dean Boerner, June 9, 2026. https://www.reveliolabs.com/news/macro/ai-prompts-a-rise-in-career-changes/. About 38.5% of job-switchers changed category in 2025 vs 35% in 2019; same-role-type switchers down from over 63% (2023) to about 61.5% (2025); about 28% of career changes occur internally within the same parent firm, against about 18% for moves into AI roles; lateral opportunity predicting retention more strongly than pay (Revelio's prior retention work, referenced in the same article).

CyberSeek, Cybersecurity Career Pathway tool. https://www.cyberseek.org/pathway.html. Built by Lightcast with CompTIA and the NICE program; sorts roles into feeder, entry-level, mid-level, and advanced-level, mapping both vertical progression and lateral moves within a role category.

National Initiative for Cybersecurity Education (NICE) / CISA, Cyber Career Pathways Tool, niccs.cisa.gov. Groups cyber work roles and maps vertical advancement alongside lateral movement between related roles.

Sam Altman and Dario Amodei remarks on AI and jobs, as reported by Fortune, May 26, 2026 (referenced in the Revelio article above). Context only for the "run toward AI" framing, not a labor figure.