Infrastructure Security Engineer

1What you'd actually do

• Reviewing and acting on vulnerability scan output - working out which of the flagged issues on servers, containers or network devices actually matter in your environment, chasing the teams who own those systems, and tracking the patching through to completion
• Configuring and tuning security tooling: firewall and network rules, endpoint protection agents, cloud security posture tools, logging pipelines that feed the monitoring team
• Working on identity and access - setting up or reviewing accounts, groups and permissions in systems like Active Directory or a cloud identity provider, tightening over-permissive access, and dealing with privileged (admin-level) accounts
• Writing automation: scripts or infrastructure-as-code (configuration written as code files and applied automatically) so that hardened settings get applied consistently rather than clicked through by hand on each machine
• Reviewing designs for new systems before they go live - sitting with an engineering team and asking how data flows, where secrets are stored, what happens if a component is compromised, and pushing back where the answer is weak
• Handling requests and exceptions from the rest of the business - someone needs a firewall port opened, a legacy server can't be patched, a supplier wants a connection into the network - and deciding what compensating controls make that acceptable
• Contributing to incidents when infrastructure is involved: isolating a host, revoking credentials, checking whether a newly published vulnerability affects anything you own

2How graduates get in

• Graduate schemes in technology or cyber security at large banks, insurers, telecoms, retailers and consultancies - the most common structured route. Many rotate you through several security or IT teams before you specialise, so you may not land in infrastructure security immediately.
• Government and defence routes, including Civil Service technology and cyber fast-stream-style schemes and roles at defence contractors. Security clearance is usually required, which normally means UK residency for a set number of years - check individual vacancies as the rules differ by clearance level.
• Direct entry into a junior IT operations, service desk, network or systems administration role and moving sideways into security after a year or two. This is very common and arguably the strongest foundation, because infrastructure security is hard to do without knowing how the infrastructure works.
• Direct entry as a junior/associate security engineer or SOC (security operations centre) analyst at a managed security service provider, then moving into engineering. MSSPs hire in volume and are a realistic first job even without a big-name graduate scheme.
• Degree apprenticeships in cyber security or digital technology - an alternative to the graduate route rather than a follow-on, but worth knowing about if you're still choosing.
• Conversion routes from a non-computing degree via a cyber security MSc, or via self-taught labs and certifications plus a home lab you can talk about. Possible but less common at graduate-scheme level than a computing background.

3What employers ask for

• A degree is usually expected but the subject matters less than you'd think. Computer science, networking, software engineering, cyber security and information systems are the obvious ones; maths, physics and engineering graduates are routinely hired. Non-technical degrees are possible but you'll need demonstrable technical evidence.
• Grade requirements vary a lot. Many large graduate schemes ask for a 2:1, some ask for a 2:2, and a growing number have dropped a fixed classification in favour of tests and interviews. Smaller firms and MSSPs often care mainly about what you can do.
• Demonstrable hands-on experience with operating systems and networks - a Linux and Windows home lab, cloud free-tier projects, capture-the-flag competitions, university society work, or a placement year. This carries real weight at interview.
• Certifications are common but rarely required upfront. Entry-level ones such as CompTIA Security+ or Network+, a cloud fundamentals or associate-level certification, or Microsoft/Cisco associate certifications help you get shortlisted; employers often fund these once you're in.
• Security clearance for government, defence, critical national infrastructure and some finance roles. Levels range from basic checks up to SC and DV, and the eligibility rules (including how long you must have lived in the UK) differ - read the specific advert.
• Some employers use technical assessments, coding or scripting exercises, or scenario questions in place of formal qualifications, so the balance between paper credentials and practical testing genuinely differs between organisations.

4Skills that matter

5Where it leads

1. Graduate or junior security engineer: working on assigned tickets, vulnerability remediation and tooling under supervision, learning the estate. Typically the first year or two, though structured schemes often run for around two years before you're placed permanently.

2. Security engineer: owning specific controls or platforms end to end - the vulnerability management programme, the cloud security tooling, the privileged access system - and being the person other teams come to for those.

3. Senior security engineer: designing controls rather than just operating them, setting standards, reviewing architecture for major projects, and mentoring juniors. Timelines here vary widely with employer size and how much you move between organisations.

4. From senior, the path forks. Common directions are security architect (designing how security works across the whole estate), specialist tracks such as cloud security, identity and access management, detection engineering or offensive security/penetration testing, and management tracks leading teams. Consultancy and contracting are also well-trodden routes.

5. Longer term, some move into leadership roles such as head of security engineering or CISO (chief information security officer), while others deliberately stay on a deep technical track as a principal engineer or architect - both are respected and paid accordingly.

6Where this varies

The job title covers noticeably different work depending on where you land. In a large bank or insurer it is heavily process- and audit-driven, with regulatory requirements shaping what you do and long change-control queues. In a cloud-native tech company it looks much more like software engineering, with everything defined as code and the boundary between security and platform engineering blurred. In consultancies and managed security service providers you work across several client environments at once, which builds breadth fast but gives you less depth in any one estate. Government and defence work adds clearance requirements, more restricted tooling and sometimes on-site-only working. On-call is common but not universal - some teams carry a rota, others hand out-of-hours work to a dedicated operations centre - so ask about it at interview.