Cyber security is one of the fastest-growing technology fields in Australia, with government agencies, banks, critical infrastructure operators and technology companies all competing for experienced security professionals. For skilled workers in Britain, that demand makes Australia an attractive move. However, migrating as a cyber professional is more complicated than many people expect, mainly because of how Australia classifies cyber security occupations for visa purposes.
If you are researching Australia PR for cyber security engineers from the UK in 2026, the most important decision you will make is which occupation code to use. That choice determines which visas are available to you. This guide explains the occupation codes, the Australian Computer Society (ACS) skills assessment, the points you are likely to need, and the state nomination and employer-sponsored routes that are currently most realistic. For an overview of all permanent residency options, see our Australian permanent residency services.
Why the Occupation Code Matters So Much for Cyber Professionals
Until early 2025, almost all cyber security migrants used a single occupation: ICT Security Specialist (ANZSCO 262112). Australia then introduced several cyber-specific occupation codes, and ACS began assessing them. These newer codes better describe modern cyber roles, but they do not all give access to the same visas.
Australia uses different occupation lists for different visas:
- The Medium and Long-term Strategic Skills List (MLTSSL) gives access to the points-tested Subclass 189, 190 and 491 visas.
- The Core Skills Occupation List (CSOL) is used for employer-sponsored visas such as the Skills in Demand visa (Subclass 482) and the Employer Nomination Scheme (Subclass 186).
This means a code can be excellent for employer sponsorship but unavailable for independent PR, or the other way round.
Cyber Security Occupation Codes at a Glance
| Occupation | ANZSCO | Main list | Typical visa access |
|---|---|---|---|
| ICT Security Specialist | 262112 | MLTSSL | Points-tested 189, 190 and 491 |
| Cyber Security Engineer | 261315 | CSOL | Employer-sponsored 482 and 186 |
| Penetration Tester | 261317 | CSOL | Employer-sponsored routes |
| Cyber Governance Risk and Compliance Specialist | 262114 | CSOL | Employer-sponsored routes |
| Cyber Security Advice and Assessment Specialist | 262115 | CSOL | Employer-sponsored routes |
| Cyber Security Analyst | 262116 | CSOL | Employer-sponsored routes |
| Cyber Security Architect | 262117 | CSOL | Employer-sponsored routes |
| Cyber Security Operations Coordinator | 262118 | CSOL | Employer-sponsored routes |
Occupation lists change. Always check the current Home Affairs skilled occupation list before applying.
The Key Point for Cyber Security Engineers
The Cyber Security Engineer occupation (261315) currently sits on the CSOL, not the MLTSSL. If you nominate this code, your realistic routes are employer-sponsored, not the independent 189 visa or state-nominated 190 and 491 visas.
If you want to apply for points-tested PR, you would generally need to be assessed as an ICT Security Specialist (262112). You can only do this if your actual duties genuinely match that occupation’s description. Choosing a code just to access a visa, when your work does not fit it, can lead to an unsuccessful skills assessment and credibility problems later. Many senior security engineers do carry out duties that fit ICT Security Specialist, but this needs to be assessed carefully against your reference letters.
The ACS Skills Assessment for Cyber Professionals
The Australian Computer Society assesses all of these cyber occupations. A positive ACS outcome is required before you can lodge an Expression of Interest (EOI) for a points-tested visa, and it is often needed for employer-sponsored visas too.
How ACS Assesses Your Qualifications
ACS reviews whether your degree is comparable to an Australian bachelor’s degree or higher, and whether it has an ICT major closely related to your nominated occupation. A UK computer science, cyber security or information security degree will usually be assessed on its content and units rather than its title alone. Applicants without a relevant ICT qualification may use the Recognition of Prior Learning (RPL) pathway, which requires more experience and a detailed project report.
The ACS Experience Deduction
One feature of ACS assessments catches many applicants out. ACS deducts a period of your experience before treating the rest as skilled employment for points purposes. For applicants with an ICT major closely related to the nominated occupation, this deduction is commonly two years. Applicants with less closely related qualifications face longer deductions.
For example, a UK security engineer with eight years of experience and a closely related computing degree may have only six years counted as skilled. That affects the experience points available. Our guide on how UK work experience counts for Australia PR explains how to document British employment properly.
Evidence That Strengthens Your Assessment
- detailed reference letters describing your security duties, tools, frameworks and responsibilities
- dates, hours per week and employment type for every role
- supporting payslips, P60s, HMRC records or employment contracts
- academic transcripts showing ICT units
- evidence of certifications such as CISSP, OSCP or CISM, which can support your duties but do not replace qualifications or experience
For a full overview of the assessment process, see our skills assessment guide for Australia PR. If your ACS outcome was unsuccessful, read our article on what to do after a negative skills assessment.
Check Your Assessment’s Validity
Home Affairs generally treats a skills assessment as valid for three years, unless the letter states a shorter period. Check the validity shown on your ACS outcome letter carefully, because your assessment must be valid when you are invited to apply.
Core Requirements for Points-Tested PR
To apply for the 189, 190 or 491 visa as an ICT Security Specialist, you must meet these requirements at the time of invitation:
- a positive ACS skills assessment in an eligible occupation
- age under 45
- at least competent English. UK passport holders are generally treated as meeting this, as explained in our guide to English test exemption rules for UK citizens
- at least 65 points on the points test
How Many Points Do Cyber Security Professionals Need?
ICT occupations are among the most competitive in Australia’s skilled migration programme. ICT Security Specialist received no Subclass 189 invitations in the August 2025, November 2025 or June 2026 rounds. When it was last invited in 2024, minimum scores were around 95 to 100 points.
Here is how a typical UK cyber professional might score:
| Points factor | Example UK security professional | Points |
|---|---|---|
| Age | 30 years old | 30 |
| English | Superior test result | 20 |
| Qualification | Bachelor’s degree | 15 |
| Overseas experience | 6 years assessed as skilled after ACS deduction | 10 |
| Partner | Single | 10 |
| Total | 85 |
Even a strong profile like this may fall short of recent ICT 189 cut-offs, which is why state nomination and employer sponsorship are so important. A superior English score is essential. Our guide to the PTE score needed for Australia PR explains the results required. You can estimate your own score with our Australia PR points calculator.
Visa Pathways for UK Cyber Security Professionals
Subclass 189: Possible but Very Competitive
The Skilled Independent visa needs no sponsor, but recent rounds have issued very few ICT invitations. Lodging a 189 EOI costs nothing and keeps the option open, but you should not rely on it. Our guide on how to get an Australia PR invitation from the UK explains how invitation rounds work.
Subclass 190: State Nomination
State and territory governments set their own occupation lists, and several have included ICT Security Specialist in recent years. Victoria and New South Wales in particular have nominated ICT professionals. A Subclass 190 nomination adds 5 points and leads directly to permanent residence.
However, many states now prioritise applicants already living and working in their state. Some state programmes also use the newer cyber codes differently, so check each list carefully. Read our guide to Victoria’s skilled visa nomination program for 2026–27 for an example of how a state selects candidates.
Subclass 491: Regional Nomination
The Subclass 491 Skilled Work Regional visa adds 15 points but requires you to live and work in regional Australia. Regional cyber roles are less common than in major cities, and 2026–27 regional visa places have been reduced significantly. This route suits only some applicants.
Not sure which cyber occupation code fits your experience? GIEC Global UK can review your duties, qualifications and points, and advise on the strongest and most defensible strategy. Book a cyber security migration consultation with our team.
Employer-Sponsored Pathways: Often the Strongest Route
For many UK cyber security engineers, employer sponsorship is the most realistic path to Australian PR in 2026. Australian employers face a well-documented shortage of experienced cyber professionals, and the newer cyber codes on the CSOL were designed for employer-sponsored migration.
Skills in Demand Visa (Subclass 482)
An approved Australian employer can nominate you for a role such as Cyber Security Engineer, Cyber Security Analyst or Penetration Tester. Your salary must meet the applicable income threshold and the market rate for the role. Depending on your occupation and passport, a skills assessment may be required.
Employer Nomination Scheme (Subclass 186)
After working for your sponsor for the required period on a 482 visa, you may be able to apply for permanent residence through the Temporary Residence Transition stream. Some applicants can also apply directly for a 186 visa if they meet the Direct Entry requirements.
How UK Cyber Professionals Find Sponsors
Many UK applicants secure sponsorship by applying to Australian employers with international hiring programmes, consultancies with UK offices, managed security service providers, and organisations in financial services and critical infrastructure. Our guide on jobs and salary expectations after Australia PR gives an overview of the Australian employment market.
Comparing Pathways for UK Cyber Professionals
| Pathway | Typical occupation code | Key requirement | Current outlook |
|---|---|---|---|
| Subclass 189 | ICT Security Specialist (262112) | Very high points | Weak in recent rounds |
| Subclass 190 | ICT Security Specialist (262112) | State nomination | Possible, varies by state |
| Subclass 491 | ICT Security Specialist (262112) | Regional nomination | Limited |
| Subclass 482 to 186 | Cyber Security Engineer (261315) and other CSOL cyber codes | Australian employer sponsor | Strong if you secure a job offer |
Security Clearances and Citizenship
Many Australian Government, defence and national security cyber roles require a security clearance. In most cases, clearances require Australian citizenship. Permanent residence alone usually does not qualify you for these positions. If you want to work in these sectors, plan for the citizenship pathway. Our guide on how soon UK citizens can apply for Australian citizenship after PR explains the timeline.
Private-sector cyber roles, such as those in banking, consulting and technology companies, are more widely available to temporary and permanent visa holders.
Common Mistakes UK Cyber Professionals Make
| Mistake | Why it matters |
|---|---|
| Assuming Cyber Security Engineer (261315) is eligible for the 189 visa | It is currently a CSOL occupation for employer-sponsored routes |
| Choosing a code that does not match your duties | Can lead to a negative ACS assessment |
| Forgetting the ACS experience deduction | Overestimates your experience points |
| Skipping an English test because of a UK passport | Loses up to 20 points that ICT applicants usually need |
| Relying only on the 189 visa | ICT Security Specialist has not been invited in recent 189 rounds |
| Generic reference letters | ACS needs detailed, role-specific duties |
Changes to Watch in 2026 and 2027
The Australian Government has announced a redesign of the skilled migration points test, aimed at selecting younger, more highly educated and higher-skilled migrants. The new points table and start date had not been confirmed at the time of writing.
Since 19 September 2026, new processing priority directions have favoured occupations in sectors such as healthcare, construction, education and resources, as well as certain defence-related roles. Most cyber occupations are not in the main priority sectors, so processing may take longer for some applicants. However, roles connected to defence or AUKUS-related work may receive higher priority in some cases.
The 2026–27 Migration Programme has also increased places for employer-sponsored visas, which supports the case for pursuing sponsorship alongside any points-tested application. To strengthen a points-tested profile in the meantime, read our guide on how to improve your Australia PR points before invitation.
How GIEC Global UK Can Help
Getting Australia PR for cyber security engineers from the UK requires careful planning, especially around occupation codes and ACS assessments. GIEC Global UK helps UK cyber professionals select the right and defensible occupation, prepare strong ACS evidence, maximise their points, and combine state nomination with employer-sponsored strategies. Contact our team for a tailored review of your profile.
Disclaimer: This article provides general information based on Department of Home Affairs, ACS and published invitation data available in October 2026. It is not legal or migration advice. Occupation lists, assessment criteria, state programmes and invitation results change regularly. Always check official sources or speak to a qualified adviser before acting. No skills assessment, nomination or visa outcome can be guaranteed.
Frequently asked questions
Can UK cyber security engineers get Australia PR in 2026?
Yes, but the route depends on the occupation code. Cyber Security Engineer (261315) currently supports employer-sponsored visas, while points-tested PR generally requires assessment as an ICT Security Specialist (262112) if your duties genuinely fit.
Is Cyber Security Engineer eligible for the 189 visa?
Cyber Security Engineer (ANZSCO 261315) is currently on the Core Skills Occupation List, which is used for employer-sponsored visas such as the 482 and 186, not the points-tested 189 visa.
Which occupation code should cyber security professionals use for Australia PR?
Use the code that genuinely matches your duties. ICT Security Specialist (262112) gives access to the 189, 190 and 491 visas, while newer cyber codes such as Cyber Security Engineer and Penetration Tester mainly support employer-sponsored routes.
Who assesses cyber security occupations for Australian migration?
The Australian Computer Society (ACS) assesses all cyber security occupations, including ICT Security Specialist, Cyber Security Engineer, Penetration Tester and Cyber Security Analyst.
How many years of experience does ACS deduct?
ACS commonly deducts two years of experience for applicants with an ICT major closely related to their nominated occupation. Longer deductions apply where the qualification is less closely related.
How many points does an ICT Security Specialist need for a 189 invitation?
ICT Security Specialist received no 189 invitations in the August 2025, November 2025 or June 2026 rounds. When it was last invited in 2024, minimum scores were around 95 to 100 points.
Can an Australian employer sponsor a UK cyber security engineer?
Yes. Approved employers can sponsor cyber security engineers and other cyber roles on the CSOL through the Subclass 482 visa, with a pathway to PR through the Subclass 186 visa.
Do UK cyber professionals need an English test for Australia PR?
UK passport holders are generally treated as having competent English. A test such as PTE or IELTS is still strongly recommended, because superior English can add 20 points.
Do I need Australian citizenship for cyber security jobs in Australia?
Many government, defence and national security roles require a security clearance, which usually requires Australian citizenship. Most private-sector cyber roles do not.
Do certifications like CISSP or OSCP help with an ACS assessment?
Certifications can support evidence of your duties and expertise, but they do not replace the qualification and employment requirements ACS uses to assess your skills.
Which states nominate cyber security professionals?
States such as Victoria and New South Wales have nominated ICT professionals in recent years. Each state sets its own occupation list and criteria, and many prioritise applicants already living there.
Can I change my ANZSCO code after an ACS assessment?
You can apply for a new assessment under a different occupation if your duties genuinely match it. The code must reflect your actual work, not just the visa you want.
