This is for SOC analysts who want to be running a security function one day and can't see the route from where they sit. By the end you'll have a sequence of moves, the qualifications that matter at each one, and a way to tell whether you're actually progressing. If you haven't looked at what each rung pays, start with the UK salary breakdown for SOC analysts. This piece picks up where that one stops.
The short version: most analysts who stall do it at the same two points. They stay a specialist too long, or they chase certifications instead of scope. A CISO is hired for judgement over risk and the ability to talk to a board. Nobody gets that from a fourth technical badge.
1. Get properly good at one layer of the SOC
Tier 1 triage is a starting point, not a career. Spend roughly two to three years there and move up to Tier 2 or Tier 3 as soon as you can handle an incident end to end without someone holding your hand.
Pick one depth area. Detection engineering, threat hunting, or incident response. Learn the tooling your employer actually runs, whether that's Splunk, Microsoft Sentinel, CrowdStrike or Elastic, and learn to write your own detections rather than just consume other people's.
How you'll know it's worked: you're the person the Tier 1 team escalates to, and you've closed an incident where you wrote the timeline, the root cause and the recommendations yourself.
Beyond Tick Boxes: Diversity Recruitment Strategies That Actually Transform UK Workplaces
Master the Virtual Hot Seat: 7 Video Interview Techniques Recruiters Don't Tell You
AI Governance Careers Surge in 2026: Why This Role Will Define the Next Decade
2. Take the first certification that fits the job you want
Certs are a filter. Recruiters and automated screens use them, and hiring managers mostly skim past them once you're in the room. Don't collect them for fun.
For the SOC and engineering side, CompTIA Security+ gets you through early screening and something like GIAC (GCIH or GCIA) signals real depth. Pick one. Not four. Many analysts I speak to have a stack of entry level certs and no evidence they've run anything under pressure.
How you'll know it's worked: your CV gets past filters it didn't before, and you can explain in an interview what the cert changed about how you work.
3. Move sideways into something with a different shape
This is the step people skip, and it's the one that matters most. A CISO has to understand more than alerts. Spend time in security engineering, GRC (governance, risk and compliance), or architecture. One of them, for at least a couple of years.
GRC feels dull to analysts. Do it anyway. Anyone who's never written a risk register or sat through an audit will struggle in a leadership interview. The NCSC's guidance on risk management is a decent free grounding in how the UK public sector frames this.
How you'll know it's worked: you can explain a technical control to a non technical person and tie it to a business risk they care about.
4. Step into a lead or manager role before you feel ready
The jump from individual contributor to team lead trips up a lot of strong technicians. Ask for a small team, even two or three people. Run the rota, handle the performance conversations, own a budget line.
The pay bump can be modest here, and that's fine. You're buying the experience. A SOC manager or security team lead with a track record of retaining people and hitting service levels is far more credible than a brilliant analyst with no reports.
How you'll know it's worked: someone you managed has been promoted, and you can describe a hire or a dismissal you handled.
5. Add the leadership credentials
Now certifications earn their keep. CISSP is the one most UK and US employers still ask for at senior level, and it requires five years of relevant experience, so start the clock early. ISC2 sets the criteria and you should read them before you sit anything. CISM is the other common choice for management focused roles. Choose based on the jobs you're actually applying for.
Plenty of people ask whether a master's or an MBA is needed. For most CISO roles, no. For some large financial services and listed company roles, a business qualification can help, but demonstrated delivery counts for more.
How you'll know it's worked: senior job specs you're reading stop containing requirements you can't tick.
6. Build a head of security or deputy CISO track record
This is the stage where you own a programme: incident response plans, board reporting, third party risk, a budget you defend. Smaller firms will often give you this scope earlier than a bank will, so a head of security job at a scale up can be a faster route than waiting for a deputy role at a big name.
For regulated sectors, learn how the regulator thinks. If you're aiming at financial services, the FCA sets expectations on operational resilience that you'll be expected to speak about fluently.
Some of the strongest UK candidates I work with cross the Atlantic at this point, because US defence tech and financial services firms pay more and give you scope sooner. That route has its own requirements, clearances above all, and it's worth planning for rather than stumbling into.
How you'll know it's worked: you've presented to a board or audit committee and fielded hard questions without handing off to someone else.
7. Apply for CISO roles with a story, not a list
By now your CV should read as a deliberate climb. Interview panels for CISO roles want to hear how you've handled a real incident, how you prioritise with limited money, and what you'd do in your first ninety days. Prepare those three answers in detail.
Expect to start in a smaller organisation or a deputy role first. That's normal. A first CISO job at a mid sized firm often leads to a bigger one two or three years later.
You can browse current cyber security roles on OHUB to see how senior job specs are worded and what they ask for.
How you'll know it's worked: you're getting second interviews, and the feedback is about fit rather than gaps.
If a step goes wrong
Stuck at Tier 2 for years. Change employer. Some SOCs have no promotion path because the team is outsourced or tiny. Moving to a firm with a larger security function is often quicker than waiting.
Can't get a management role. Run something unofficial first: a mentoring scheme, a graduate intake, a tooling migration. Then put it on the CV with outcomes.
Passed CISSP but nothing changed. The cert opens doors but doesn't walk you through them. Check whether your experience actually matches the roles you're applying for.
Hit the ceiling at a big employer. Look at a head of security role at a smaller company. The title and scope can jump in one move.
Next step: write down which of the seven you're on, and the one thing you could do in the next three months to move to the next. Then do that.
