The Challenge of Filling Cybersecurity Roles: Mismatched Expectations and Untapped Talent
A scenario unfolds in many organizations where a security manager finds themselves grappling with an open position for most of the year. The vacancy calls for a candidate who is a certified information systems security professional, equipped with five years of experience in cloud security, adept in incident response, skilled in a scripting language, knowledgeable about artificial intelligence security, and capable of briefing a board. However, the salary offered is more aligned with someone who possesses just a fraction of these qualifications.
In another corner of the industry, a recent graduate emerges, equipped with a degree in information technology, a self-funded Security+ certification, and a wealth of hands-on experience from a home lab. Despite sending out approximately 200 applications for entry-level positions, this individual has received little to no feedback. Meanwhile, a security director boasting 11 years in the field, with four years managing a team, faces disappointment as well. Both find that, despite fulfilling the industry’s proclaimed needs, the hiring processes keep them perpetually in a state of separation.
The Entry-Level Experience Paradox
The cybersecurity workforce has been characterized by the persistent narrative that millions of jobs remain unfilled. However, recent research has shifted the focus from merely counting heads to addressing the competencies and skills in demand. A 2026 analysis suggests that the crux of the issue lies more in the mismatch between what employers expect and the readiness of candidates, rather than a sheer lack of available talent.
At the entry-level, this mismatch is particularly glaring. A May 2026 career analysis cited a surplus of candidates, indicating that boot camps and academic programs are producing graduates at a faster rate than organizations can hire them. Additionally, a panel discussion in April 2026 confirmed that while entry-level talent is abundant, employers often overlook these candidates in favor of what they deem to be “unicorns”—those with years of experience in rapidly evolving technologies that have yet to cultivate a seasoned professional.
In Australia, a study conducted by CyberPath revealed that entry-level job postings frequently require two to three years of experience, alongside certifications that can cost up to AUD 4,000 (approximately USD 2,795), with no guarantee of a job upon completion. Jon France, the Chief Information Security Officer (CISO) of ISC2, pointed out that unrealistic requirements, such as CISSP certifications for junior roles, often stem from the fact that Human Resources departments draft job listings without proper context or consultation.
The Missing Path to Cybersecurity Leadership
The challenges don’t stop at the entry-level. As professionals ascend the ranks, an alarming number find themselves stuck in managerial positions, despite the industry’s claims of a scarcity of mid-level talent. A survey conducted by IANS and Artico Search showed that only 34% of cybersecurity professionals plan to stay with their current employers, with middle managers exhibiting significant restlessness; approximately 43% of these individuals contemplate leaving.
Career advancement has been highlighted as a crucial determinant of job satisfaction. However, investigations indicate that many organizations lack formal plans to transition individuals into CISO roles. In fact, many capable security leaders find it challenging to pivot from tactical tasks to strategic risk management, primarily because they are not afforded opportunities to engage in these broader responsibilities.
Impediments to securing board-level exposure are also prevalent. According to a benchmark report, while 95% of CISOs provide updates to their boards, a mere 60% engage in full-board discussions, often focusing more on compliance rather than strategic dialogues. This lack of interaction means that potential CISOs are expected to gain the necessary experience to secure these roles without any access to the decision-making realm.
Consequences of Hiring Failures: Burnout in the Workforce
As these dynamics play out, it is often the employees who bear the brunt of these organizational misalignments. Research by SANS in 2026 indicated that burnout is an acute issue for 40% of organizations, while another study revealed that cybersecurity professionals in the Asia-Pacific region were losing close to five hours weekly to burnout.
The individuals who would otherwise mentor junior staff and cultivate future leaders are frequently caught in the exhausting grind of existing systems exacerbated by technical debt. This debt consumes a significant portion of IT budgets, leaving insufficient resources to focus on employee growth and support. Consequently, empty seats linger, and the workload on remaining staff only intensifies.
Reconstructing the Cybersecurity Career Ladder
Breaking this cycle necessitates structural changes at all levels within organizations. For entry-level positions, hiring managers must distinguish between immediate skill needs and achievable training outcomes, often leading to more reasonable job descriptions and a genuine training plan. In the middle ranks, defining a genuine deputy CISO role and providing aspiring leaders with the exposure they require can help bridge the gap in experience that hiring committees demand.
At the highest level, a candid evaluation of the CISO role—clarifying both its authority and responsibilities—can render it a position worthy of pursuit. However, this stands in stark contrast to the short-term targets that frequently prompt organizations to leave vacancies unfilled. Until these systemic issues are addressed, the struggle will continue, leaving many positions unoccupied and qualified candidates withdrawn.
This analysis forms part of a broader series, "The Elephants in the Technology Room," focused on the hidden crises undermining IT and cybersecurity teams in 2026. As industry stakeholders acknowledge these realities, there may be hope for a reformed hiring landscape that genuinely supports career advancement and nurtures the cybersecurity workforce of the future.