Cyber security has become a business priority for businesses as threats continue to grow in scale and complexity. The global cost of cyber crime is projected to reach USD 13.8 trillion by 2028, but the demand for skilled professionals still outpaces supply. The APAC region currently has the highest shortage, with over 2.1 million cyber security roles unfilled, followed by North America.
To address these challenges, organisations are shifting from short-term fixes to long-term hiring strategies - investing in future-ready skills, compliance, and professional development to build resilient security teams.
Here are some of the key trends shaping cyber security hiring today.
1. Demand for cyber security specialisations
As threats become more sophisticated, demand is increasing for individuals with expertise in cloud security, application security, digital forensics, and threat intelligence. Roles, requiring deep technical knowledge and hands-on experience are highly sought after.
Rishipal Singh, Lead Principal Consultant at Nicoll Curtin, highlights the growing focus on emerging specialisations in cyber security.
“There’s more demand for web, mobile, and API protection, compared to traditional infrastructure, as businesses move to digital platforms. Companies are prioritising hands-on experience with modern tools and embedding security early in the development lifecycle.”
Nicoll Curtin’s Principal Consultant, Philip Quinn, points out the rise in the demand for Cyber Threat Intelligence Analysts, Penetration Testers and Incident Response Managers/Specialists, Reverse Engineers and Malware Analysts/Specialists.
"Digital Forensics skills and experience are another area where we are seeing increased demand as digital evidence in criminal and civil investigations increases. We are working with a number of specialised cyber clients in this area more frequently now, too."
In response, organisations are:
- Prioritising hands-on skills and certifications, such as CISSP, OSCP, GIAC, and CompTIA Security+
- Hiring from non-traditional pathways, including military service, bootcamps, and career changers.
- Using technical assessments and project-based interviews to evaluate real-world capabilities.
This focus on specialist roles ensures security teams can address targeted and new forms of attack more effectively.
2. Focus on compliance and security clearance
Cyber regulations are tightening as more countries plan to adopt legislation similar to the UK’s Cyber Security and Resilience Bill. Industry is now placing greater emphasis on compliance expertise to navigate complex standards such as ISO, NIST, GDPR, and SOC 2. These frameworks provide guidelines for information security management, risk assessment, data protection, and auditing processes. In sectors handling sensitive information or working on government-linked projects, holding an active security clearance offers a significant advantage by demonstrating trustworthiness.
To stay ahead, employers are:
- Targeting candidates with experience in regulatory frameworks and cyber governance.
- Investing in internal training to improve audit readiness and compliance knowledge.
- Offering competitive packages, including flexible working and performance bonuses, for professionals with security clearances.
3. Importance of soft skills in security roles
Employers are increasingly looking for specialists who can communicate clearly, collaborate effectively, and influence decision-making. Today’s cyber teams often work cross-functionally, supporting legal, compliance, and executive teams in understanding and managing risk.
To strengthen these capabilities, companies are hiring people who can:
- Translate technical risk into language that supports informed business decisions.
- Provide calm, confident leadership in high-pressure situations.
- Work collaboratively with stakeholders to deliver secure outcomes.
4. The impact of AI on cyber security hiring
While automation and machine learning have strengthened threat detection and incident response, they also come with risks. 78% of people opened phishing emails written by AI, and over a fifth clicked on malicious content.
Despite this, most cyber security professionals believe the benefits outweigh the concerns. AI is already proving its value in threat detection, network monitoring, and vulnerability management, especially within operational technology environments.
Rishipal Singh explains how AI is reshaping cyber security jobs and solutions:
“Some roles now require experience in threat modelling for AI systems or understanding adversarial attacks. At the same time, many new and existing tech companies are developing tools to address these threats, giving businesses a much wider range of user-friendly vendor products to choose from than before.”
Philip Quinn notes that AI has also led to a rise in Zero Trust Architecture and Identity Access Management implementations.
As a result, forward-looking companies are:
- Hiring professionals with experience securing AI systems and data pipelines.
- Creating new roles focused on AI governance and ethical machine learning.
- Training internal teams to detect and respond to AI-powered attacks.
5. Retention strategies for security professionals
With cyber specialists in short supply, retaining top performers has become a strategic priority. Career development opportunities, such as internal mobility, continuous learning, and certification support, are now seen as key for engagement and retention. Top employees want roles that offer both challenge and progression.
To meet these expectations, employers are:
- Offering learning stipends, training programmes, and support for professional certifications.
- Mapping out career pathways into leadership, architecture, or specialist technical roles.
- Encouraging cross-functional projects to broaden skills and experience.
- Focusing on development to create motivated, long-term cyber teams.
This approach helps companies build resilient teams ready to meet evolving cyber threats.
