The Help Desk → Cybersecurity Staircase: Tech’s Most Reliable Path [2026]
The internet has one standing joke about tech careers, and it’s the help desk: the password-reset purgatory, the ticket mines, the job you take when the “real” tech jobs said no. Meanwhile, the seat at the top of the staircase that starts there — information security analyst — is what the Bureau of Labor Statistics now calls the fastest-growing computer occupation and the fifth-fastest-growing occupation in the entire United States: a $124,910 median, 29% projected growth, and a top decile clearing $186,420.
The doctrine from Boring Is the Arbitrage applies here in its purest form: the crowd prices careers by the entrance, not the destination. The entrance is mocked, so the line is short — and the destination has a six-figure median, a hiring gap measured in the millions, and no pedigree filter anywhere on the stairs. No. 002 climbs the whole thing, rung by rung.
The Staircase at a Glance
| Rung | Typical Money | Typical Timing |
| 1. IT Support / Help Desk | ~$60,340 median (computer user support, BLS) | Year 0–1; Security+ earned here |
| 2. SOC Analyst or Junior Sysadmin | $60K–$80K postings; sysadmin median $96,800 | Year 1–3 |
| 3. Information Security Analyst | $124,910 median; 29% growth; ~16,000 openings/yr | Year 3–6 |
| 4. Senior / Engineer / Architect track | Top 10% above $186,420; CISO track beyond | Year 6+ |
Timings are typical, not guaranteed — cert velocity and documented competence compress them; coasting stretches them. Industry moves the band too: security analysts in the information sector median $136,390; finance $126,970 (BLS).
The Mechanic Everyone Misses: The Top Seat Is Experience-Gated
Here’s the detail that turns the mocked door into the smart one. BLS lists the typical entry for information security analysts as a bachelor’s plus related work experience — the $124,910 seat is not a day-one job. Almost nobody walks into it from campus, no matter the degree. Which means the “lesser” rungs aren’t a detour from the security career; they are the security career’s qualifying mechanism. The help desk teaches you every system a company runs and how users actually break them. The SOC seat teaches you what attacks look like at 2 a.m. That’s the “related experience” the posting wants — and the people dunking on those rungs are mocking the only staircase that reaches the floor they claim to want.
Why the Staircase Is Underpriced
The demand is structural and enormous. Every company is a target; breach records keep setting all-time highs; and the global industry reports millions of unfilled security positions with the skills gap still widening. BLS’s 29% projection is roughly seven times the all-occupation average — and most of the demand is at exactly the analyst level this staircase produces.
The supply is throttled by mockery. Prestige-chasers skip the ladder because rung one is a punchline, and degree-holders skip it because they feel entitled to start higher. The result: the most reliable feeder path into a top-five-growth occupation has less competition at its entrance than jobs paying half as much. The joke is doing your competition-reduction for free.
And the moat is certs plus documented competence — not pedigree. No famous-school filter, no leetcode gauntlet. Security+ opens the SOC door, experience compounds, and the CISSP waits at the top as the field’s most-requested credential — a moat you can build entirely on evenings while rung one pays the bills.
The Doors In (Both Audiences)
New grads: any degree works — info systems is the natural fit (full map: the Information Systems New Grad Blueprint), but the help desk hires broadly, and a home lab plus Security+ outweighs major selection. The trade for you is patience-for-position: accept the lowest entry salary in tech in exchange for the fastest-compounding ladder in it.
Career changers: this is the most second-career-friendly path in technology, full stop. Security teams are full of former teachers, veterans, retail managers, and accountants, because the field is too understaffed to gatekeep and the work rewards exactly what career changers carry: reliability, documentation discipline, and calm under incident pressure. The sequence is brutally concrete: Security+ (weeks of evening study), a documented home lab, help desk or SOC seat, then climb. Your prior career isn’t wasted — it’s your differentiation in an industry that badly needs people who can talk to humans. The Side Door artifact here: a writeup of a real (or realistic) incident triage — what you saw, what you checked, what you’d escalate — because a hiring manager reads that and sees a shift they don’t have to babysit.
Where the Staircase Goes (Above the Table)
Past the analyst seat, the field forks: security engineering and architecture (building the defenses instead of watching them — the top-decile territory above $186,420), incident response and threat hunting (the adrenaline lane), GRC and security compliance (where this staircase meets the audit world — a natural fork for the control-minded), and ultimately the CISO track, a boardroom seat that barely existed a generation ago and now sits in every serious company. The staircase also exports well: cloud security, application security, and the AI-security lanes on our emerging board all hire from exactly this foundation.
The Price of the Trade (Every Trade Has One)
House honesty, four items. Rung one pay is genuinely low — the ~$60,340 support median trails every other door in tech; you’re buying the ladder, not the doorstep. The ticket grind is real — some days are password-reset purgatory, and the climb rewards people who treat the grind as reconnaissance. Tier-1 is automating — AI is eating the scripted layer of support, which doesn’t kill the staircase but does compress it: linger on rung one and the rung thins under you; climb on schedule and automation is your tailwind, because every automated tier-1 task creates more machine output someone must secure. And the top rungs carry on-call — BLS says it plainly: security analysts sometimes work outside normal hours, because attackers don’t book meetings. The $124,910 median includes the 2 a.m. phone.
Your First 12 Months on the Staircase
Months 1–3: Close tickets like a craftsman and treat every one as reconnaissance — you are being paid to learn the company’s entire attack surface. Book Security+ with a date, not an intention.
Months 4–8: Cert in hand, start aiming at security work from inside: volunteer for the phishing-report queue, the access reviews, the patching audit nobody wants. Build the home lab and document it — what you built, what broke, how you fixed it.
Months 9–12: Trigger metrics for the SOC jump: Security+ passed, one security-adjacent responsibility owned at work, and one incident-style writeup that proves you can triage and communicate. Hit all three and start applying to SOC seats internally and out — and run the free salary audit first, because this field’s spread between identical titles is enormous.
Full disclosure: I’m working through a cybersecurity program myself, so I’ve inspected these stairs personally — and here’s what two decades of auditing taught me to notice: the internet prices this ladder by its first rung, and payroll prices it by its last one. That gap between the punchline and the paycheck is as pure as career arbitrage gets. The government ranks the destination fifth-fastest-growing in the nation; the industry reports millions of empty seats; the entrance requires no pedigree, no connections, and no famous logo — just certs, documented competence, and the willingness to be briefly unimpressive.
Everyone wants the $124,910. Almost nobody will take the stairs. That’s the whole trade. Boring IS the arbitrage — Exhibit 002.
Sources
U.S. Bureau of Labor Statistics, Occupational Outlook Handbook (May 2024 wage data; 2024–34 projections): Information Security Analysts (median, growth, ~16,000 annual openings, percentiles, industry medians, entry requirements, on-call note) and Computer and IT Occupations; BLS Monthly Labor Review, 2024–34 projections overview (“fastest growing computer occupation” and fifth-fastest overall) · Support and sysadmin medians per BLS OOH occupation pages · Global workforce-gap and certification-demand figures per ISC2 workforce studies and industry hiring analyses (2024–26). Rung timings are editorial estimates from typical career progressions.
