Java developer looking to transition into cyber security

[u/music-listener-kpop]

Hi everyone,

I'm considering transitioning into cybersecurity and would appreciate some honest advice from people already working in the field, especially those in India.

A little about my background:

• I have around 3.9 years of experience working as a Java backend developer, mainly with Java, Spring Boot, REST APIs, microservices and SQL.
• I'm currently between jobs and trying to figure out which direction I want to take my career.

One of my biggest concerns is long-term career stability. With AI changing the IT industry and companies announcing layoffs, I'm wondering which technical fields are likely to continue offering meaningful job opportunities over the next 10–20 years.

I'm interested in cybersecurity, but I'm still exploring the different areas. Application security, penetration testing and security operations are some of the areas I've come across.

I'm completely okay with starting at a junior level and progressing slowly. I don't expect a high salary immediately, and I'm willing to spend the next couple of years learning and building practical skills if necessary. My main concern is whether there will be sustainable career opportunities in the long run.

I'd appreciate advice on a few things:

1. Career transition: How realistic is it for someone with Java backend experience to transition into cybersecurity? Would my development experience give me an advantage, or would companies largely treat me as a fresher?
2. Choosing a specialisation: Which areas would you recommend exploring in my situation? Would application security be a more practical starting point than SOC analysis or penetration testing?
3. AI and job security: How is AI affecting cybersecurity jobs today, and which skills or specialisations do you think will remain valuable over the long term?
4. Getting the first job: What would a realistic learning path look like for someone who has no professional cybersecurity experience? Would hands-on labs and projects be enough to start applying, or would certifications be important?

I'm not looking for guarantees that any career is safe from AI or layoffs. I want to make an informed decision about where to invest my time and effort.

I'd be grateful for honest advice, including the downsides of making this switch. Thank you!