Short version: Computer user support specialists are IT's launchpad, not its ceiling. The realistic path runs Tier 1 helpdesk → Tier 2 desktop / endpoint → systems administrator, and then forks into three high-paid tracks — infrastructure and DevOps, security engineering, and IT management. Two-year cadence is normal: 12–24 months at Tier 1, 18–36 months at Tier 2, first specialist title by year five, six-figure title by year six to eight. What separates the fast progressors from the stalled ones is not raw talent — it's picking a stack, earning a certification per rung, shipping one visible internal project a year, and learning to script (PowerShell or Python) early. Below is the full path, salary bands at each rung, and the exact certifications the sysadmin panel screens for.
The five-rung path (with salary bands)
BLS OES groups Computer User Support Specialists under SOC 15-1232 (about 850,000 U.S. workers) and Network & Computer Systems Administrators under 15-1244 (about 380,000). The path threads through those codes and into 15-1211 (systems analyst), 15-1212 (information security analyst), 15-1256 (site reliability / DevOps), and 11-3021 (computer & information systems manager). Titles vary — the sequence and the pay bands are consistent.
| Rung | Typical title | Years | Salary band (US metro) | Certification target |
|---|---|---|---|---|
| 1 | Tier 1 helpdesk / IT support | 0–2 | $38K–$54K | CompTIA A+ |
| 2 | Tier 2 desktop / endpoint support | 2–4 | $52K–$72K | CompTIA Network+, Microsoft Endpoint Administrator |
| 3 | Systems administrator / IT engineer | 4–7 | $68K–$110K | Server+, AWS SysOps, Azure Administrator |
| 4a | DevOps / SRE / cloud engineer | 6–9 | $130K–$220K | AWS Solutions Architect, Terraform Associate |
| 4b | Security engineer | 6–9 | $105K–$180K | Security+, SSCP, CISSP |
| 4c | IT manager | 7–10 | $110K–$160K | ITIL v4, PMP |
| 5 | Senior/Staff engineer, director, VP, CISO, CIO | 10+ | $160K–$300K+ | Vendor-specific + leadership |
Rung 1 — Tier 1 helpdesk (year 0–2)
Tier 1 is the entry lane. You log tickets, run password resets and access provisioning, walk end users through basic troubleshooting, and route escalations to Tier 2. The metrics your manager reads every Monday are: ticket-to-resolution time, customer satisfaction score, first-contact resolution rate, and ticket volume per shift. The distinguishing candidates hit those numbers and quietly earn CompTIA A+, learn a ticketing platform end-to-end (ServiceNow, Jira Service Management, Freshdesk), and start writing PowerShell or Python scripts to automate repeat tickets.
Tier 1 is also where you pick a stack. Do you like the Microsoft ecosystem (Windows, Entra ID, Intune, Endpoint Manager)? The Apple stack (macOS, Jamf, Apple Business Manager)? Google Workspace and Chromebook fleets? Linux-heavy environments (SUSE, Red Hat, Ubuntu)? The choice determines your Tier 2 and Tier 3 vocabulary for the next decade. Sticking with the stack you started on is a fine strategy — most fast progressors do.
Rung 2 — Tier 2 / desktop support (year 2–4)
Tier 2 owns endpoint management. You image and provision laptops (Autopilot for Windows, Apple Business Manager and Jamf for Mac, Kandji for Apple fleets), manage MDM, run patch cycles, own the printer fleet nobody wants, and take some Tier 3 escalations. The step-change from Tier 1 is that you now touch the fleet, not just the user. This is where scripting stops being optional. PowerShell for Windows shops, Bash and Python for cross-platform, Google Apps Script for Workspace-heavy environments.
The Tier 2 project that gets you promoted is usually one of five: an Intune or Jamf rollout, an MFA project across the fleet, a zero-touch imaging pipeline, a patch-cadence rewrite, or a SaaS-license reclamation project that saves visible money. Do one. Document it. Present it. Your Tier 3 title is on the other side of that project.
Rung 3 — Systems administrator / IT engineer (year 4–7)
Systems administrators own infrastructure — identity (Active Directory or Entra ID, Okta, ADFS), servers (Windows Server, Linux distributions), file storage, backup, and increasingly a chunk of the SaaS admin stack. In a smaller organization you may also own the network (switching, routing, firewalls) and the phone system (Zoom Phone, Cisco, RingCentral). This is the rung where "systems administrator" becomes a specific-stack title — Windows Systems Administrator, Google Workspace Administrator, Linux Systems Administrator, Okta Administrator.
On-call rotations begin here. Runbook writing begins here. Post-incident reviews begin here. Certifications at this rung do work: Server+ or a Microsoft equivalent, an AWS or Azure administrator credential, and — if the shop is heavily on-prem — VMware if you're going that way. The pay band opens sharply, because on-call comp starts to matter.
Rung 4 — The three forks
4a. Infrastructure, DevOps, cloud engineering (year 6–9)
The classic "up and to the right" fork. You take your sysadmin knowledge and layer on infrastructure-as-code (Terraform, Pulumi), CI/CD (GitHub Actions, GitLab CI, Argo CD), container orchestration (Kubernetes, ECS, Cloud Run), observability (Datadog, New Relic, Grafana), and cloud provider depth (AWS, GCP, Azure). Six-figure titles are the norm. This fork rewards scripting and code fluency the most.
4b. Security engineering (year 6–9)
Security engineers protect the environment you already know. You'll spend more time in policy, audit, and compliance than junior engineers expect, and the rest in detection engineering (SIEM tuning, EDR configuration), incident response, and IAM. Certifications ladder — Security+ → SSCP → CISSP (five-year experience minimum) → optional specialties (CCSP for cloud, OSCP for offensive). CISO is the top of this fork.
4c. IT management (year 7–10)
Management is the fork most support specialists actually take. You own a team of Tier 1 and Tier 2 support people, budget, vendor relationships, procurement, and a chunk of the strategic-planning cycle. ITIL v4 helps. PMP helps in larger organizations. The role rewards operators — people who can hold a large ticket queue, a budget, and a Board update in the same week.
Rung 5 — Senior IC, management, or executive (year 10+)
Every rung above IT manager rewards specialization plus organizational trust. Senior/Staff/Principal engineer titles on the DevOps or security fork sit at $160K–$300K+ in tech-heavy metros. IT director sits at $150K–$220K. CISO sits at $200K–$400K+ depending on company size and equity. CIO sits at $250K–$550K+ at mid-to-large companies. All are reachable from the support specialist rung — the difference is which fork you took and how deliberately you built visibility.
Pivots off the classic path
- SaaS platform administrator — Salesforce, Workday, ServiceNow, HubSpot. Certifications matter more than tenure. Pay: $85K–$160K.
- Network engineering — Cisco (CCNA → CCNP), Juniper, or SD-WAN specialists. Pay: $95K–$160K.
- Database administration — SQL Server, Oracle, Postgres, or the modern data stack (Snowflake, Databricks). Pay: $110K–$180K.
- Field engineering / MSP — Managed Service Provider career. Pay: $65K–$115K.
- Software engineering — Rare but real. Requires 1–2 years of self-driven code fluency; DevOps and SRE are the friendliest bridges.
Why people stall (and how to unstall)
Map your next rung with a strategist who has hired at every level.
Marqee pairs IT candidates with a career concierge who identifies the two-year plan, the certification, and the project that gets you promoted — and reaches the hiring manager directly at your target company.
See how Marqee works →Get startedFrequently asked questions
The classic path runs Tier 1 helpdesk → Tier 2 desktop / endpoint support → systems administrator or Tier 3 escalation engineer → three forks: (1) infrastructure and DevOps, (2) security engineering, or (3) IT management. Adjacent pivots include network engineering, cloud engineering, database administration, and Salesforce or Workday administration. Two-year cadence is realistic — 12 to 24 months at Tier 1, 18 to 36 months at Tier 2, and a first specialist title by year five. Six-figure titles typically arrive at year six to eight for those who take on-call, certifications, and a scripting or cloud focus.
Three to five years is typical. The fastest paths combine three things: strong ticket-to-resolution numbers on the helpdesk, a CompTIA Server+ or Microsoft/AWS certification, and one visible internal project (a Windows Autopilot rollout, an Intune migration, a MFA project). Slower paths repeat Tier 1 without a certification or a project and stall at Tier 2 for years. The distinguishing move is picking a stack (Microsoft, Google Workspace, Apple, or a Linux-heavy environment) and building depth.
For infrastructure: CompTIA A+ → Network+ → Server+ → then a vendor path (Microsoft Endpoint Administrator, AWS SysOps, or Google Cloud Associate). For security: CompTIA Security+ → SSCP → CISSP once you have five years experience. For cloud: AWS Solutions Architect Associate or Azure Administrator. For management: PMP or ITIL v4 for larger organizations, or a CISSP for security-adjacent leadership. Certifications alone don't move you — projects and scripting do — but they're the ATS keywords that get the interview.
Yes, and roughly one in eight support specialists eventually pivots. The realistic path adds a scripting language early (Python or PowerShell), moves through automation (script your tickets, script your provisioning) into DevOps or Site Reliability Engineering, and lands in a full software role two to four years later. Fewer take the classic 'boot camp to junior developer' pivot because it usually means a pay cut. The DevOps or SRE pivot lets you leverage your existing infrastructure knowledge without starting over.
Tier 1 helpdesk: $38,000–$54,000 in most metros. Tier 2 desktop or endpoint support: $52,000–$72,000. Systems administrator: $68,000–$110,000. Senior sysadmin or IT engineer: $95,000–$145,000. IT manager: $110,000–$160,000. IT director: $150,000–$220,000. Security engineer path: $105,000–$180,000 by year five in the specialty. DevOps and cloud engineer path: $130,000–$220,000 in tech-heavy metros. Bands from BLS OES 15-1232 (support), 15-1244 (network admin), and 15-1231 (network support) plus tech-industry compensation surveys.
Both work; pick the one that matches how you like to spend your day. Cybersecurity is more paperwork and policy than most people expect — you'll spend a lot of your time on compliance, audit response, and incident coordination. Cloud engineering is more building and less policy. If you like scripting and building things, cloud. If you like reading logs and thinking about threat actors, security. Both pay similarly at the senior level, with security edging ahead at the CISO track.
Rarely, and usually not to your advantage. Employers hire junior engineers straight out of a bachelor's or a boot camp, but the missing helpdesk time shows up in weaker fundamentals — no direct-user context, no ticketing muscle memory, no experience with the small ways things break. Support time compresses fast if you certify and script. A year on the helpdesk with a Network+ and a personal automation project is a stronger year-two resume than a year of unemployed cert-chasing.
There isn't one, in practice. Every current CIO started somewhere; a meaningful share started in support or helpdesk. The real question is which fork you take. Support to management tops out at IT director or VP of IT. Support to security tops out at CISO. Support to cloud engineering tops out at Principal Engineer or Distinguished Engineer roles inside big tech. The support specialist title is a launchpad, not a ceiling.