Cyber Security
Digital Resilience & Defence
Cyber security is the invisible shield protecting our digital world. As threats evolve, the need for skilled professionals who can defend against, respond to, and anticipate attacks has never been greater.
The Eight Domains of Cyber Security
We've identified eight key domains that cover the spectrum of modern cyber defence and strategy.
Security Operations
£75,000+ (range across UK SOC Analyst to Threat Intel Analyst postings, IT Jobs Watch)
Offensive Security
£130,000+ (Penetration Tester to Red Team postings, IT Jobs Watch; Bug Bounty pay too variable to include)
Engineering & Architecture
£150,000+ (Security Engineer to Enterprise Security Architect postings, IT Jobs Watch; Cryptography Lead via Cryptography Engineer proxy, Glassdoor UK)
Governance & Risk
£95,000+ (GRC Analyst to IT Auditor postings, IT Jobs Watch/Glassdoor; cross-checked against ONS Risk managers median £54,619)
Strategy & Leadership
£200,000+ (Head of Security to CISO postings, IT Jobs Watch/Glassdoor UK; top CISO pay exceeds £270,000)
Emerging Cyber
£100,000+ (IoT Architect, Zero Trust and AI Engineer postings, IT Jobs Watch; Quantum Security proxied via Quantum Computing Engineer, Glassdoor UK)
Digital Forensics & Incident Response
£71,000+ (Digital Forensics Analyst to Incident Response Lead postings, IT Jobs Watch/Glassdoor; eDiscovery Specialist narrower niche, £25,000–£39,000)
Cloud & Application Security
£105,000+ (Application Security to DevSecOps Engineer postings, IT Jobs Watch; Product Security Lead via Glassdoor UK proxy, £43,000–£93,000)
Security Operations
The frontline of defence, monitoring systems and responding to active threats in real-time.
Monitoring systems and responding to active threats in real-time.
Growth Potential
£34,000 — £75,000+ (range across UK SOC Analyst to Threat Intel Analyst postings, IT Jobs Watch)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to detect and triage a live security incident before it escalates into a full breach."
Offensive Security
Thinking like a hacker to find and fix vulnerabilities before the bad guys do.
Thinking like a hacker to find and fix vulnerabilities before the bad guys do.
Growth Potential
£49,000 — £130,000+ (Penetration Tester to Red Team postings, IT Jobs Watch; Bug Bounty pay too variable to include)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to find and responsibly report an exploitable vulnerability before a real attacker does."
Engineering & Architecture
Building systems that are 'Secure by Design' from the ground up.
Building systems that are 'Secure by Design' from the ground up.
Growth Potential
£50,000 — £150,000+ (Security Engineer to Enterprise Security Architect postings, IT Jobs Watch; Cryptography Lead via Cryptography Engineer proxy, Glassdoor UK)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to design systems that are secure by default, rather than patched after the fact."
Governance & Risk
Managing the human, legal, and business side of digital trust.
Managing the human, legal, and business side of digital trust.
Growth Potential
£35,000 — £95,000+ (GRC Analyst to IT Auditor postings, IT Jobs Watch/Glassdoor; cross-checked against ONS Risk managers median £54,619)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to translate legal and regulatory requirements into practical, auditable controls."
Strategy & Leadership
Defining the security vision and protecting the organisation at executive level.
Defining the security vision and protecting the organisation at executive level.
Growth Potential
£78,000 — £200,000+ (Head of Security to CISO postings, IT Jobs Watch/Glassdoor UK; top CISO pay exceeds £270,000)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to set and defend a multi-year security strategy and budget at board level."
Emerging Cyber
Defending the next generation of technology from futuristic threats.
Defending the next generation of technology from futuristic threats.
Growth Potential
£40,000 — £100,000+ (IoT Architect, Zero Trust and AI Engineer postings, IT Jobs Watch; Quantum Security proxied via Quantum Computing Engineer, Glassdoor UK)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to anticipate and defend against attack surfaces that don't exist yet, from AI systems to quantum-era cryptography."
Digital Forensics & Incident Response
Investigating what happened after an attack, and proving it
Reconstructing digital evidence after a breach — tracing how attackers got in, what they touched, and building the case for legal or insurance action.
Growth Potential
£26,000 — £71,000+ (Digital Forensics Analyst to Incident Response Lead postings, IT Jobs Watch/Glassdoor; eDiscovery Specialist narrower niche, £25,000–£39,000)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to reconstruct an attack timeline from digital evidence that holds up in court or before a regulator."
Cloud & Application Security
Securing the code and cloud platforms modern products are built on
Embedding security into the software development lifecycle and cloud environments, rather than bolting it on afterwards.
Growth Potential
£45,000 — £105,000+ (Application Security to DevSecOps Engineer postings, IT Jobs Watch; Product Security Lead via Glassdoor UK proxy, £43,000–£93,000)Typical Roles in this Domain
Framework Essentials
Accreditation Benchmarks
"Ability to catch vulnerabilities in code and cloud configuration before they reach production."
UK Cyber Security Council's Standard for Professional Competence and Commitment (SPCC)
For years, being a cyber security professional has mostly meant one thing: holding the right qualification, or the right job title. The UK Cyber Security Council, the body the government has chartered to professionalise the sector, is deliberately changing that. In its own words, its professional titles exist to help people "stand out in a crowded field of certifications, qualifications and training," the same way a chartered title already works in engineering, law or accountancy. The bar isn't just technical knowledge any more: it's technical knowledge plus communication, integrity, professional commitment and collaborative leadership, assessed together and kept current through ongoing CPD. For TechSkills, that reframes what a genuinely job-ready Cyber apprenticeship or degree needs to produce. Not just someone who can pass a technical assessment, but someone building the fuller professional profile this Council now expects.
The National Cyber Security Centre describes the UK Cyber Security Council as the body setting the standard for professional competence and commitment in cyber security: a single, unified national standard in place of the fragmented mix of qualifications and job titles the profession has relied on until now.
New entry-level requirement · April 2026
Associate Cyber Security Professional (ACSP)
The Council's entry-level professional registration, for people at the start of their cyber security careers who are either in an early-career cyber role or ready for their first one. Achieving it lets someone join the UK Cyber Security Professional Register and use the ACSP post-nominal.
ACSP
Associate Cyber Security Professional
Building knowledge, skills and experience in an early cyber security career.
PraCSP
Practitioner Cyber Security Professional
Applying cyber security expertise independently and effectively.
PriCSP
Principal Cyber Security Professional
Leading teams, projects and specialist practice.
ChCSP
Chartered Cyber Security Professional
Influencing organisations, standards and the wider profession.
Five areas of competence and commitment
Knowledge, understanding and experience
Real technical grounding, not just a passed exam.
Communication and interpersonal skills
Explaining risk and technical issues clearly to people who aren't cyber specialists.
Integrity
Acting honestly and within the profession's ethical principles.
Personal and professional commitment
Treating cyber security as a profession to keep developing in, not just a job title.
Collaborative management, leadership and mentoring
Working effectively across SOCs, incident response teams and cross-functional delivery, not operating alone.
Staying registered
Staying on the UK Cyber Security Professional Register isn't a one-off achievement: applying for a title requires committing to the Council's code of ethics, and 75 hours of Continuing Professional Development over three years (25 hours a year) is required to keep a title current.
Already a real requirement
This is already a real employer requirement, not a theoretical framework: the NCSC's CHECK scheme (which approves penetration-testing providers for government and critical national infrastructure work) now requires, for every new applicant, at least one proposed CHECK Team Leader to hold a UK Cyber Security Council Professional Title in the Security Testing specialism at Principal level or above, confirmed directly on the NCSC's own CHECK scheme page.
What does "good" look like in Cyber Security?
TechSkills enrichment across Cyber Security programmes is built to develop these eight things, not just technical skill on its own.
1
Technical competence
Hands-on technical career insight from a working cyber professional: real tools, real environments, real decisions.
2
Professional ethics
What the Council's Ethical Principles actually ask of a cyber professional, and why integrity is judged as seriously as technical skill.
3
Communication
How cyber professionals explain risk to a board, a client or a non-technical colleague, a skill the Council explicitly assesses.
4
Collaboration
What it's really like working inside a SOC, an incident response team, or a cross-functional delivery team.
5
Leadership
How cyber professionals grow into leading a team, a project or an area of specialist practice.
6
Continuing professional development
Why the learning doesn't stop at qualification. Staying current is a Council requirement, not just good practice.
7
Real-world application
Real employer case studies of cyber work in context, not textbook scenarios.
8
Career progression and professional registration
How to move from Associate through to Chartered status, and why professional registration is starting to matter for real roles, per the NCSC CHECK scheme requirement above.
Build these exact competencies in the Skills Lab
The Professional Practice zone and Employer's Essentials develop this same behavioural and ethical foundation.
Every claim above was checked directly against the Council's and NCSC's own live pages on 2026-08-20 (not a search snippet or a third-party summary); see the sources below. The one exception is the five competency areas' exact wording, corroborated via a third-party professional-standards summary rather than the Council's own primary Standard document. As of 2026-08-24 we've located that primary document (v4.2, October 2024, linked below) but haven't yet re-verified this exact wording word-for-word against it — worth doing before treating this list as final.
A Resilience Mindset
The Ever-Changing Threat
New vulnerabilities emerge every day. This matrix will evolve alongside the threat landscape to ensure it remains relevant for professionals.