Module 0: Orientation: Is cyber for you?

Estimated time: 60-90 minutes · Prerequisites: none

What you'll get from this module

By the end you'll be able to:

• Describe the Australian cyber job market and why it's hiring.
• Name the realistic entry roles for a career changer, and which roles are not entry-level.
• Set realistic salary and pathway expectations.
• Understand the citizenship and clearance realities for government/defence work.
• Know how to study this course to actually finish it.

---

1. Why cyber, why now (in Australia)

Australia has a sustained shortage of cyber workers, and the data backs it up:

• Jobs & Skills Australia projects cyber employment growth of +14.2% to 2029, more than double the national average (6.6%). (JSA measures this for the occupation group it uses to track cyber roles, "Database and Systems Administrators, and ICT Security Specialists".)
• Around 621 new cyber job ads per month were posted over the year to September 2025.
• 94% of cyber professionals work full-time (vs 69% of all occupations), with median full-time earnings around $118,000/year.

This is a field where demand outstrips supply, entry is possible without a degree if you can show skills, and the work is stable and well-paid. It's one of the most realistic technical career changes available in Australia today.

Source: Jobs & Skills Australia, "Cyber security skills in demand as labour market evolves" (2025), jobsandskills.gov.au

---

2. Myth-busting: what cyber work actually is

Myth	Reality
"You need to be a genius hacker."	Most cyber work is defensive: monitoring, investigating, documenting, improving processes.
"You need a computer science degree."	Many entry roles ask for skills + a cert (Security+), not a degree. Hands-on evidence (labs, a portfolio) matters more.
"It's all penetration testing."	Pen testing is a small, senior slice. The bulk of jobs are SOC, GRC, identity, and security operations.
"You must be young / male / technical already."	Career changers from audit, admin, project, trades, defence and unrelated fields succeed constantly. Diverse backgrounds are an asset.

---

3. The realistic entry roles

These are the first jobs a career changer can actually land:

• SOC Analyst (Level 1): you watch security alerts, triage them, and escalate real incidents. The single most common entry point. Great if you like investigation and pattern-spotting.
• GRC / Security Analyst: Governance, Risk & Compliance: policies, frameworks (ISO 27001, the Essential Eight), risk registers, audits. The best fit if you come from audit, risk, legal, project management, or business analysis, it rewards documentation and communication over deep tech.
• IAM / Identity Analyst: managing who has access to what (accounts, MFA, joiner/mover/leaver). Often reached from IT service desk.
• Security-focused IT support: a service-desk or sysadmin role with a security lean, used as a feeder into the roles above.

Progression roles, NOT your first job:

• Penetration Tester: needs OSCP-type certs and usually 2+ years of verified security experience.
• Security Consultant / Architect / CISO: strategic, senior, experience-heavy.

Aim your first application at SOC L1 or GRC. Trying to start as a pen tester is the most common way career changers stall.

---

4. Salary reality (AUD, entry bands)

From the Hudson Cyber Security Salary Guide (January 2026), permanent base salaries (excluding superannuation):

Role	Entry band
SOC Analyst L1 / Junior	$75,000 - $95,000
Information Security GRC: Junior	$75,000 - $95,000
(progression) SOC L2 / GRC Mid	$95,000 - $135,000

Career changers often start at or just below the bottom of these bands, and typically reach six figures within roughly three years in a capital city. Salaries flattened somewhat in 2026 after sharp prior rises, but demand remains steady.

---

5. The citizenship & clearance reality

A large share of Australian cyber jobs (especially in government and defence) require:

• Australian citizenship (mandatory for AGSVA security clearances and for ASD/ACSC roles).
• A security clearance, commonly NV1 (Negative Vetting 1), which permits access up to SECRET. Employers often sponsor a Baseline clearance first.

If you're not a citizen, or don't want clearance work, focus on the large private sector (banks, MSSPs (managed security service providers), consulting, retail, healthcare) which hire heavily and usually don't require clearances.

Plan your target early. It changes which jobs you apply for and whether clearance sponsorship matters.

---

6. Your pathway from here

This course (free)
   → CompTIA Security+ (SY0-701)      ← the recognised entry cert
   → Entry role: SOC L1 or GRC Analyst
        ↕  (optional accredited study, often free)
   → Free TAFE cyber quals
        • Cert IV in Cyber Security (22603VIC)
        • Diploma of IT — Cyber Security (ICT50220)
   → ADF / APS traineeships (paid, structured)

You do not have to do all of these. This course + Security+ + a portfolio is enough to start applying. TAFE and traineeships are accredited options if you want formal qualifications or a structured, funded route.

---

7. How to actually finish this course

Most self-paced courses are abandoned. Here's how to beat that:

1. Schedule it. Two fixed sessions a week beats "when I have time."
2. Do the labs. Reading about cyber ≠ doing cyber. Employers hire the doing.
3. Build in public. Keep notes and a simple portfolio (a GitHub repo or blog). It becomes interview evidence.
4. Join a community. Learning with others dramatically improves completion: a study group or Discord.
5. Aim at a role. Decide now: SOC or GRC? It focuses everything you do next.

---

Self-check

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 7A sceptical friend says there’s no point retraining: “the cyber market’s already full.” What does the Jobs & Skills Australia data actually show?

Cyber employment is projected to grow +14.2% to 2029, more than double the national averageCyber employment is growing roughly in line with the national averageCyber employment is shrinking as demand dries upMost cyber jobs are part-time or casual, so the growth doesn’t mean stable work

Question 2 of 7You’re worried you don’t qualify because you’re not a “genius hacker” with a computer science degree. What does the module say most cyber work actually involves?

Offensive hacking: breaking into systems from day oneDefensive work: monitoring, investigating, documenting and improving processesAdvanced programming that genuinely requires a computer science degree

Question 3 of 7You’re choosing which role to aim your first applications at. Which of these is NOT a realistic first job for a career changer?

SOC Analyst (Level 1)GRC / Security AnalystPenetration TesterIAM / Identity Analyst

Question 4 of 7You’ve been offered your first junior SOC role in a capital city. Based on the Hudson Cyber Security Salary Guide (January 2026), what base salary band should you expect?

$55,000 - $70,000$75,000 - $95,000$95,000 - $135,000Around $118,000

Question 5 of 7You’re a permanent resident, not (yet) an Australian citizen, planning your job search. Which part of the market should you focus on?

Government and defence roles at ASD/ACSCHold off applying anywhere until you obtain an NV1 clearance yourselfBaseline-cleared roles only, since Baseline doesn’t need citizenshipThe private sector: banks, MSSPs, consulting, retail, healthcare

Question 6 of 7You want the fastest credible route to your first applications. According to the pathway, what is enough to start applying?

This course + CompTIA Security+ (SY0-701) + a portfolioYou must first complete the Cert IV in Cyber Security (22603VIC)You need an ADF or APS traineeship before anyone will hire youA university degree in cyber security

Question 7 of 7A fellow learner reads every module carefully but never opens the labs and keeps no notes or portfolio. What is the module’s diagnosis?

They’re fine: thorough reading is what employers hireThey should double their reading time and study alone to stay focusedThey should do the labs and build in public, because a portfolio becomes interview evidence

These facts shape every decision you make from here (which role you aim at, what salary you accept, which jobs you can even apply for) so make them automatic before you move on.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 17

Prompt

Projected Australian cyber employment growth to 2029 (JSA)?

---

Next module

➡️ M1: Computing & digital foundations: how computers actually work, and setting up your first practice lab.