Insight and analysis on the information technology space from industry thought leaders.

Pivoting from Offensive to Defensive SecurityPivoting from Offensive to Defensive SecurityPivoting from Offensive to Defensive Security

Here's how to transition from an offensive to defensive cybersecurity professional.

Picture of Industry Perspectives

Industry Perspectives

June 2, 2025

5 Min Read

hand turning dice so they read "defensive" instead of "offensive"

Alamy

By Pushkar Jaltare

The most secure companies in the world use a combination of offensive and defensive cybersecurity strategies to protect their digital assets from outside threats. Defensive security engineers build secure infrastructure from the ground up, while pen testers take an offensive stance and identify ways hackers could penetrate a system. Offensive and defensive skills rely on a deep understanding of software architecture, yet each requires a different mindset and technical expertise. Education and skills training are the place to start for pen testers seeking to transition from offensive to defensive security. Over time, the shift in mindset from offensive to defensive security leads to an entirely new way of looking at software.

The good news for professionals who want to make a career switch from offensive to defensive cybersecurity is that the knowledge and skills are transferable. Defensive work does require additional training and knowledge, as well as a new mindset. Experience in offensive security, also known as OffSec or penetration testing, gives practitioners a strong foundation in cybersecurity from which to build. Because their job entails breaking into software systems, penetration testers know how to take advantage of an attack surface, which is all the entry points into a system. OffSec professionals also understand the different types of security controls companies need to apply to mitigate those vulnerabilities in their systems.

The main difference between the two roles is the scope of responsibilities. Pen testers are only required to break into a system, while defensive engineers need to secure the entire attack surface from multiple exploits. With the rise of generative artificial intelligence (GenAI), third-party tools, and remote work , the volume of code and number of connected devices continue to increase, resulting in expanding attack surfaces. In a 2024 study , 62% of organizations reported that their attack surface had grown in the previous two years. Along with managing these growing risks, defensive security engineers have a broad range of duties that include applying security safeguards, monitoring systems, remediating flaws, and promoting security within their company. Defensive practitioners advocate for Secure by Design principles, which center security as a core product offering and aim to build in best practices from the beginning of the design stage.

Technical Skills to Develop

OffSec professionals already understand software engineering, yet it is critical to deepen that knowledge to facilitate a transition to the defensive side. It's crucial for security engineers to have an intimate familiarity with the system they are tasked with defending. Defensive engineers engage in threat modeling , which involves mapping and analyzing the security risks in a system. Resources like the Mitre Att&ck knowledge base provide starting points for threat model planning. Another essential resource is the OWASP Top 10 , which ranks the 10 most popular attacks currently used against companies. Gaining expert-level knowledge of these attacks and how to protect against them is vital for a successful career transition into defensive security.

Another important defensive security skill is practical knowledge of how to apply isolation and segmentation in real-world contexts. If one part of a system is compromised, isolation and segmentation reduce what is known as the blast radius, or the percentage of the system that is compromised. When components are segmented, hackers can access only one contained part of the system and are prevented from accessing other areas. The defensive skill set also includes knowledge about implementing secure login processes, like multifactor authentication or biometrics, and access controls that limit the privileges of specific users. In addition, it's imperative for defensive engineers to understand cryptography, or the encryption and decryption of data as it is moved from one place to another.

Many resources are available to help those interested in gaining the necessary skills to pivot from offensive to defensive security. One starting point is online courses and boot camps, which can be supplemented with self-study through books on software architecture and concepts like threat modeling, segmentation, authentication, authorization, and cryptography. Additional AI and machine learning training is crucial for defensive security professionals as these technologies play a growing role in software architecture. Many large companies employ bug bounty programs that invite outside security professionals to identify security flaws in exchange for payment. Participating in these programs helps job seekers develop relationships with companies they are interested in working for.

New Responsibilities and Perspectives

Because breaking into a system is easier than building and maintaining a secure system, a significant shift is required to transition from an offensive to a defensive role. Defensive engineers focus on design principles like isolation, reduction of the blast radius, secure defaults, and minimizing privileges. They know how to scale up a system securely using design patterns, thereby protecting companies from entire categories of attacks. Overall, it is this type of big-picture, holistic mindset that defensive practitioners bring to the table. How multiple components fit together in a software architecture can introduce vulnerabilities, and it is the defensive engineer's job to monitor and remedy these issues as they arise.

Defensive engineers also go beyond the technical details and are vital to their company's security culture. This may include persuading teams to make changes or communicating with leadership regarding security investments. Defensive security professionals combine technical expertise and communication skills in ways that require broader expertise than their offensive counterparts.

Companies want software that is resistant to cyberattacks. To make it resilient, it's imperative for defensive security engineers to thoroughly understand every architectural defect across an entire system. Offensive testers also require a thorough understanding of how to spot flaws and suggest relevant fixes. The offensive and defensive mindsets complement each other, and learning creates a better practitioner in both areas. While there is no established career path from offensive to defensive security, a determination to learn and an open mind are crucial for those just getting started.

About the author:

Pushkar Jaltare is a security architect at Fastly with expertise in web, mobile, and cloud security assessments, threat modeling, and identity and access management. Pushkar holds a master's degree in information assurance from Northeastern University. Connect with Pushkar on LinkedIn .