In October 2024, Change Healthcare published a notice confirming that its February breach had exposed the personal data of 100 million individuals. That figure landed on the news as a remarkable and disturbing milestone: the largest known data breach in US healthcare history. It was also a number that, for most healthcare professionals and IT leaders, confirmed something they already knew viscerally. The systems protecting the most sensitive data people possess are failing, and the people responsible for preventing these failures cannot keep up with demand.

The scale of that breach is genuinely important, but what matters more for your career is the human context underneath it. Change Healthcare is a critical infrastructure company. It processes insurance claims and handles a significant fraction of US healthcare IT transactions. The organization has substantial resources, substantial security expertise, and substantial motivation to prevent breaches. Despite all of that, the breach happened, went undetected for months, and eventually exposed more patient records than any attack before it.

That failure did not occur in a vacuum. It occurred in an environment where cybersecurity teams are severely understaffed, where security professionals command significant salaries but face even greater demand, and where many organizations are making fundamental tradeoffs between security capability and operational cost. For IT workers considering a career shift, that environment presents an opportunity that is straightforward and real.

The Breach, and What It Reveals About Security Architecture

The Change Healthcare incident began in February 2024 when attackers gained access through a VPN without multi-factor authentication. That sentence should stop you: a major healthcare IT company with nation-level importance had VPN access unprotected by MFA in 2024. The attackers then moved laterally through the network, compromised credentials, and accessed patient data across multiple systems. The company did not detect the activity until March, and breach notices did not reach affected patients until October. That five-month window between compromise and notification represents failures not just in detection but in monitoring and incident response.

Change Healthcare’s situation is not an outlier, though its scale is severe. Throughout 2024, we have seen similar patterns: attackers gain access through weak authentication, move laterally because segmentation is insufficient, and operate within networks for weeks or months before detection. The technical baseline for defending healthcare infrastructure has not been met across the industry, and it’s not because security knowledge is missing. It’s because security teams are not large enough and not funded sufficiently to implement what they know works.

That matters because it points to a systemic problem. Change Healthcare needed a security team large enough to enforce MFA across all entry points, monitor for lateral movement, and maintain sufficient visibility to detect compromise in weeks rather than months. The company had resources to hire such a team. Most organizations do not have those resources, yet they operate systems that handle equally sensitive data. The result is a spectrum of vulnerability, with most healthcare IT infrastructure sitting somewhere between “reasonably protected” and “genuinely at risk.”

The Staffing Numbers, and What They Actually Mean

The phrase that captures this crisis is straightforward: there are only 83 cybersecurity professionals for every 100 open positions. That’s not a shortage in the abstract sense. That’s a structural imbalance where the demand for security expertise exceeds the supply by 20 percent, and that gap is persistent, industry-wide, and getting worse as organizations recognize that security actually matters.

The practical implication is that if you have a security certification and five years of experience, you have multiple job offers at any given moment. If you have a security background and you want to move from general IT into security-focused work, the market is aggressively recruiting you. If you are considering a career transition into security, the timeline is favorable in a way that rarely occurs in technology labor markets.

What makes this unusual is the duration. Normally, labor markets oscillate. There’s a shortage, companies hire aggressively, new people enter the field, and eventually supply catches up. The cybersecurity shortage has been persistent since roughly 2015, through multiple economic cycles, with continuous upward pressure on salaries and benefits. That persistence suggests something structural: security work is harder to automate than many IT roles, it requires genuine expertise and judgment, and organizations finally recognize that they cannot operate major systems without it.

The Change Healthcare breach is one data point on a larger timeline. Three billion records were exposed in the National Public Data breach, the Snowflake breach chain exposed critical customer data through vendor compromise, and healthcare itself continues to experience both ransomware attacks and credential-based breaches. Each of those events increases the realized cost of inadequate security. Each one makes it harder for executives to argue that security is a discretionary expense. And each one increases demand for people who can prevent the next one.

Where Cybersecurity Demand Is Actually Concentrated

It’s important to be specific about where this demand lives, because not all security roles have equal growth. The shortages are acute in a few domains, and understanding which ones matters for your planning.

Healthcare IT and security is the most obvious. Healthcare IT touches sensitive patient data, faces strict regulatory requirements, and increasingly faces sophisticated attacks because healthcare is profitable for criminals and nation-states alike. Every major hospital system, every health insurance company, every healthcare IT vendor is looking for security engineers, security architects, and security operations staff. The salaries are meaningful, the job security is high, and the work has direct societal impact.

Financial services security is similarly constrained. Banks, payment processors, and fintech companies need people who can understand both the technical systems and the regulatory environment, who can maintain security while meeting compliance requirements. This is a smaller pool than healthcare, but the demand is intense.

Cloud security and infrastructure security are also accelerating. Organizations are moving workloads to cloud platforms, and they need people who understand how to secure cloud infrastructure, who can design identity and access management for distributed systems, and who can maintain compliance and visibility across multiple platforms. This is a newer domain than traditional network security, and the competition for talent is less established than in some other areas.

The common thread is that these domains require expertise that cannot easily be outsourced or automated. You cannot buy a product that solves the problem and then staff it with junior people. You need experienced security professionals who understand the domain, the threat environment, and how to make tradeoffs between security and business capability.

Building a Healthcare IT Security Career

If this resonates for you, here’s what a realistic path looks like. You don’t need to start as a security expert. Many people in security moved into it from adjacent domains: network operations, systems administration, infrastructure engineering. What matters is that you have a solid technical foundation and genuine interest in security problems.

From there, the first step is usually a security certification. The most widely recognized are Security+, CEH, or CISSP, depending on your background and timeline. Security+ is the fastest, requiring minimal experience and serving as a baseline credential that many organizations require. CEH is more intensive and more focused on practical penetration testing and attack methodology. CISSP requires significant experience but is the credential that matters most for leadership and architecture roles. Pick the one that fits your current position and your target role.

Then you have a choice: go specialized or go broad. Some people move into specific domains like security operations (SOC analyst roles), threat intelligence, or penetration testing. Others move into security engineering roles where they design and implement security controls. Healthcare organizations need both paths, and both lead to strong career progression.

The salary reality is straightforward: getting your first security certification opens doors to positions that pay significantly more than general IT work, and the gap widens as you accumulate experience and specialization. A security operations analyst with two years of experience might earn 30 percent more than a general system administrator with the same tenure. A security architect with ten years of experience might earn twice what a general infrastructure architect earns.

The Larger Dynamics at Play

The Change Healthcare breach is significant not because it’s novel but because it’s at the largest scale we’ve seen. It confirms that existing approaches to healthcare IT security are insufficient. That confirmation ripples through the industry: healthcare organizations recognize they need to invest more in security, insurance companies are pricing breach risk differently, regulators are paying more attention, and boards are asking harder questions about security posture.

That pressure translates directly into hiring demand. Organizations that were running with minimal security staff are suddenly authorized to hire more. Organizations that had security budgets that lost annual battles with cost control are getting approval for expansion. And organizations that were paying commodity rates for security roles are increasing compensation to compete for talent.

None of that is permanent, but it’s real for the next several years at minimum. Major healthcare breaches take time to litigate, years to fully understand, and months to implement better controls. During that window, security hiring accelerates.

Your Move, Starting Now

If you’re in general IT and considering a transition, or if you’re in healthcare IT and wondering whether moving into security is viable, the answer is yes with significant caveats. Yes, the market is hiring. Yes, the compensation is competitive and growing. Yes, the expertise you build is portable across organizations and industries.

The caveat is that you need to actually invest in the knowledge. Security is not purely an operational field like system administration. It requires understanding threat models, attack patterns, defensive architecture, and compliance frameworks. That’s learnable and not exceptionally difficult, but it requires genuine study, not just time on the job.

Start by taking your first security certification and building hands-on skills through labs or a SOC analyst role. Move into a healthcare environment if possible, because healthcare pays better and the compliance requirements create depth to the work. As you gain experience, you’ll see career paths toward architecture, management, or specialization. The market is hungry for people at every level of that trajectory.

The Change Healthcare breach was a failure of security practice and security staffing. It was also a signal to every healthcare IT worker who sees it that the organization will finally fund security investment. That’s the moment to position yourself to benefit from it.