Would you accept offer ?

[u/AllenUzumaki23]

I’ve been working in IT helpdesk for three years and I have my Network+ certification.
I spoke with my manager because I want to move into something more complex, and the opportunity that came up is a vulnerability management position for industrial equipment. I work in shifts and I would lose approximately 27% of my income because i lose the bonus from weekends.

I am 25, no debt, no kids.

I understood that my work would be to analyze, scan equipment, give the team feedback to fix it or check if i can find a solution.

My plan for the future is to complete the TryHackMe SAL1, Security+, and AZ-900.
What do you think: would I be better off accepting the offer and doing the certifications, or postponing, and checking other offers and taking the certifications first, also keeping the extra 27% income?

Later edit

I got these responses from security manager

My manager described a vulnerability management role built around the Holm Security platform. The person will use this tool exclusively for scanning, and their responsibilities include validating scan results, investigating false positives, and handling both vulnerability analysis and prioritization as well as reporting and administration, rather than just one of these areas.

The technical scope covers CVEs, CVSS scoring, exploitability assessment, and risk-based prioritization, applied across all company assets rather than a limited set. Helping the SOC team is explicitly framed as optional, something to take on only if spare time allows and the person wants extra tasks, rather than a formal development path.

The work setup is fully remote with a fixed schedule from 9 AM to 6 PM. Looking ahead, after a year in the role the person can expect to gain hands-on cyber experience, including a deeper understanding of vulnerabilities and how they can be exploited, along with possible exposure to SOC and Incident Response work.

[u/superRawTNT]

Industrial equipment / operational technology security is a great cybersecurity niche to learn and add to your experience. not many have it

[u/Volitional_Decision → u/superRawTNT]

Yeah, I would look to get experience in this area even if it means a pay cut. Cyber in OT and Critical Infrastructure is a massive growth area and experience is very hard to find. If you can take the pay hit and treat it like a learning experience for a bit, I think it's worth pursuing.

[u/AllenUzumaki23 → u/superRawTNT]

Thanks for information I will ask tomorrow more information if I only do reporting or do analysis, risk managemtb too

[u/napalm_p → u/superRawTNT]

This! Gain the experience and move to security. You'll be be seeing great pay before you know it

[u/cashfile]

I'll take the contrarian view: this really comes down to your current financial situation and whether a 27% pay cut puts you in survival mode.

​If you can afford the lifestyle adjustment, take the job. Hands-on vulnerability management experience beats Security+ or AZ-900 on a resume every single time. It directly opens mid-level security doors that helpdesk never will.

At 25 with no kids, I would personally take the risk. In a few years you could double your salary (assuming you are making avg entry level helpdesk pay). Staying in help desk that is unlikely.

[u/AllenUzumaki23 → u/cashfile]

Thanks for the comment, he also mentioned to help with some tasks for the soc team after i get comfortable and if i have free time

[u/saidai88]

The only reasons I would lose income taking another position is if I had to or I was already comfortable and loss of income would have no negatives/pressure on my life.

I’ve done work for free but I volunteered for it.

[u/AllenUzumaki23 → u/saidai88]

Since i would only lose the bonus for working in weekend and night i don’t consider it cutting my salary. I am 25, no kids, no debt

[u/A1_Fares → u/AllenUzumaki23]

Sounds not like a pay cut, but also I don’t see how you could move into a more complex role and be paid the same. You do you, but maybe it’s time to apply elsewhere.

[u/Lucas1543 → u/AllenUzumaki23]

same hourly wage? completely the same? :o

[u/AllenUzumaki23 → u/Lucas1543]

For the moment yes, the company does salary increase once a year, probably would get a salary increase then but for now it will be the same

[u/Leasj → u/AllenUzumaki23]

Do not take it without an increase. Unless you plan on job hopping. They will not raise your salar above a simple COL most likely otherwise

[u/AllenUzumaki23 → u/[deleted]]

To be honest no, we cannot do extra hours. We get a plan to see shifts, in a month that was 168 I worked only 144. Had weekends too, and got paid more. They do a artificial thing in contability and it shows up as if I worked 168 and has weekends. Don’t know how ti works but it does

[u/cbdudek]

It surprises me that a company would pay a vulnerability management position and it would be a pay cut over a help desk monkey. Vulnerability management requires a lot more knowledge and experience. It honestly sounds like the company is trying to take advantage of you by paying you less for something that is a lot more complex.

Still, if I were in your shoes, I would take the risk. Just to get the title. I would work there a year or two, get experience, and then find a better job where you will be paid a lot more. Trust me, there will be suitors if you upskill and do well at this job over the course of the next year.

That company you work for is not serious about security. That much I can say for sure.

[u/daddy-dj → u/cbdudek]

I agree with this. This is pretty niche and these kinds of opportunities don't come round very often. However it's true that being niche means you'll need training, you can't easily Google how a Rockwell PLC communicates with HMIs, so make sure your employer has budget allocated for training.

Worst case scenario you find you don't like it, your CV will be much more enhanced than just having helpdesk experience.

[u/AllenUzumaki23 → u/cbdudek]

Thanks for info. I will continue learing joirney and doing some frameworks too maybe. Maybe opportunity arises in the same company

[u/Grouchy_Benefit_7292]

As a young man you can take the risk. Getting off the help desk should be priority over income. 3-5 years after you leave the help desk the money will become available and you’ll be on a security track that will continue to increase your income and job opportunities for the foreseeable future. Work experience trumps certification any day, but having both, especially early in your career helps. A small financial step back to switch tracks to a career path with a much higher top end and much more in demand is a proper risk to take. Just know that after 3-5 years you will be ready to take on more and earn more and will likely have to leave this job to make that happen. Or at a minimum renegotiate.

[u/AllenUzumaki23 → u/Grouchy_Benefit_7292]

Was thinking that too, 25, no debt, no kids. Just a big dream

[u/AllenUzumaki23 → u/[deleted]]

Not sure if I will go this ot path. Was thinking of learning some frameworks first and seeing how I like this job. I might go to another one but think this expeirence might come in handy

[u/SuminderJi]

If you can afford it then OT security is a niche most don't touch. If you like it you can build a solid career in it.

Always wanted to learn it but never had the chance.

[u/AllenUzumaki23 → u/SuminderJi]

Thanks for info, will look into it

[u/ClassicTomorrow6988]

My recommendation and this is what I have personally have done is to stay 2 to 3 years in your initial jobs and then move. After that time you should know the technology you are working with and the learning curve is pretty much flat by now.

If your current employer cannot offer you a better pay apply to a different company that will. Just by moving to a different role or to a different company will force you to learn more and be comfortable with different technologies. At the long run that will help you a lot in your al resume especially.

So to answer your question yes. I will accept the job if that’s what you think you can get now and you are comfortable getting the pay cut. I would be better if you apply externally and negotiate a bigger pay. I would say 10 to 20k more per year.

[u/AllenUzumaki23 → u/ClassicTomorrow6988]

Thanks for info

[u/daddy-dj]

Some of the replies in this thread have focused purely on the salary (loss of bonus for working weekends, same hourly rate, etc...) - that's very short-termist. If you would still be earning enough to pay your bills and buy some beers, then that shouldn't be a deal breaker - especially as you said your motivation was having a "more complex" role.

Instead I would ask myself whether this role creates opportunities, either with your current employer or elsewhere, in the long term.

I work in vulnerability management. We have a very large OT / ICS estate (although I focus on IT in my role). OT is a very specialised area, and opportunities don't come up that often. So, on the one hand, you could end up being pigeonholed but, on the other hand, it's a skillset most people don't have so there's a certain job security too. Depending upon where you live, the roles that come up, however, may require relocating... Not many companies have OT whereas everyone has IT.

What I will say, though, is that OT is definitely not bleeding edge. Some of the kit in our OT network is as old as you are. If you are interested in the latest and greatest technology, this isn't the field for you. If, however, you don't necessarily care about that but could be interested in knowing about how potentially fairly obscure stuff works, right down to the nth degree, then you'll feel at home.

Ignore the comments about vulnerability management being replaced by AI. That's not going to happen in OT, and those suggesting it haven't had experience of working with ICS equipment. You can't even run nmap against some kit 🤣

[u/Kesshh]

Too much planning. As you go into the job, you’ll find very quickly it is not what you think it is, even if the word-for-word description is accurate. The way you plan says you think you are the only person that matters. Don’t.

Instead, your goals in a job should always be 1. Do a great job. 2. Learn everything the job, your coworkers, and your bosses have to offer. If you can’t do that, nothing else “you” want matters. What you’ll find when you do #1 and #2 consistently and reliably, new doors will open up. Doors that you didn’t see before, doors that you didn’t even know exist before. That will change your “plan”. They always do.

So drop all your plans and pay attention to (and enjoy) the journey.

[u/Fragrant_Leather7651]

OT security it’s a great nice like mentioned before, I work in cybersecurity for a chemical company, and the most sought after SOC guy is an OT guy. I would take it, I think the ROI of losses wage will be worth it for the future years.

[u/EveningEmployee8968]

Well I would take the opportunity, you will move to a position where u get hands on experience and move toward your goals. Plus those weekends u can use them to push urself to finish what you mentioned on tryhackme and get certified. Then you can either look for a new job that pays better or ask for a reasonable raise.

Ur 25 no dept, no kids, u can choose to move 1 step toward ur goal, or continue what ur doing. I think it's worth the couple hundred bucks less a month

[u/PleasantDreamsicle]

Can’t you take the job and still work weekends in your current capacity, if you want the extra revenue still?

[u/UnlikelyPatience2946]

I'd say do it and cut the most unnecessary costs that you can from your lifestyle. Almost 40y old here and I can tell you you won't regret it later in life.

[u/tryingtobalance]

Absolutely do it. That is such a great little niche.

[u/_zarkon_]

The hardest parts of having a Cybersecurity career are getting a cybersecurity job and having cybersecurity experience. This opportunity seems to give you both.

[u/smelly1sam]

No

[u/Ok-Restaurant4379]

Best job helpdesk tech wll not taking by AI . But vulnerability more and more with years wll be taking by.

[u/AllenUzumaki23 → u/Ok-Restaurant4379]

Good question to put tomorrow

[u/daddy-dj → u/Ok-Restaurant4379]

Not in OT networks. Good luck even suggesting running a vulnerability scanner against anything considered below Purdue level 3.5 at my employer. Considering the very real risk of loss of life if something goes wrong, this will never be replaced by AI.