How to get hired
Security job posts in India fall into five tracks. Each has its own entry route and its own interview, so read the post and decide which one you are applying for. Round-the-clock monitoring (SOC) is big enough to have its own guide.
GRC: governance, risk and compliance
Policies, risk assessments, ISO 27001 audits, vendor security reviews, and now data protection under the DPDP Act 2023, whose Rules were notified in November 2025 with most obligations phased in over 18 months. Big 4 firms and consultancies hire heavily here, and so do banks and insurers under RBI and IRDAI expectations.
Who gets in: B.Com, BBA and MBA graduates with an IT audit interest, CA and CISA candidates, and engineers who like process. The certificates that matter are ISO 27001 Lead Auditor or Lead Implementer for the first years, then CISA or CISM later. Our CISA and IT audit guide covers the audit side.
VAPT and penetration testing
Testing web apps, APIs, mobile apps and networks for vulnerabilities and writing the report. Clients include banks, fintechs and government bodies, and many audits must be done by CERT-In empanelled auditing firms, which are good places to start.
Who gets in: graduates who can show they can actually find bugs. A portfolio of write-ups from legal practice platforms and responsible-disclosure findings matters more than any course. CEH (EC-Council, now v13) appears in many Indian job posts and tender requirements; OSCP-style hands-on certifications carry more weight with technical interviewers. Never test a site you don't have written permission to test: unauthorised access is an offence under the IT Act, whatever your intent.
Identity and access management (IAM)
Joiner-mover-leaver processes, single sign-on, privileged access, access reviews, on platforms like SailPoint, CyberArk, Okta and Microsoft Entra ID. Services firms run large IAM practices and train freshers and support engineers into them. It is a good, less crowded door.
Network and endpoint security
Firewalls, proxies, VPNs, endpoint protection and data loss prevention. Network engineers move here naturally; see our network engineer guide.
Cloud and application security
Securing AWS, Azure and GCP setups, Kubernetes, CI/CD pipelines and code. This is usually a move for people who already have cloud or development experience.
Certifications, honestly
- CompTIA Security+ (SY0-701) is the broad entry certificate and a sensible first step.
- ISC2 Certified in Cybersecurity (CC) is an entry credential too, but ISC2 ended its free-exam "One Million" programme in May 2026; check the current fee.
- CISSP and CISM are senior credentials. CISSP requires five years of paid security work in at least two of its domains (a degree can waive one year), so don't let anyone sell it to you as a fresher course.
- CEH is common in Indian tenders and job posts; ask the employer whether they require it before paying.
What interviews ask
- Basics: the TCP handshake, ports, DNS, how HTTPS works, hashing versus encryption.
- Web: the OWASP Top 10, XSS versus CSRF, SQL injection and how to prevent it, broken access control.
- Track questions: for GRC, Annex A controls of ISO 27001 and how you'd assess a vendor; for VAPT, walk through how you'd scope and test a login page; for IAM, how you'd handle an employee who changes departments.
- Indian rules: CERT-In's directions (report notified incident types within 6 hours, keep logs for 180 days in India) and the DPDP basics.
- A practical round for technical tracks: a vulnerable app or a log file.
First titles
Information Security Analyst, Associate – Cyber Risk, VAPT Analyst, Security Analyst, IAM Analyst, GRC Analyst, Network Security Engineer.
What the work is like
GRC is office-hours work with audit seasons and long documents. VAPT runs on project deadlines and report writing (good writers get promoted). IAM and network security run on tickets and change windows. Across tracks, incidents can pull anyone in at odd hours.
Pay is wide: compliance roles start modestly, while experienced cloud security, IAM architects and senior pentesters are among the best-paid people in IT. The ladder usually runs Analyst, Senior Analyst or Consultant, Manager, then Security Architect, Head of GRC or CISO.