Cybersecurity Skills Gap and Hiring Guide

Most security teams no longer struggle to find people in general; they struggle to find people with specific skills, and to keep and grow the people they already have. The 2025 ISC2 Cybersecurity Workforce Study found that 59% of respondents report critical or significant skills needs, up from 44% in 2024, while 39% of organisations had hiring freezes. The UK government's 2025 labour market report shows a similar shift: the estimated shortfall is small, but 49% of UK businesses have a basic technical skills gap. This guide is for security leaders, hiring managers and HR partners. It covers how to describe the roles you need using the NICE Framework, SFIA and the UK Cyber Security Council specialisms, where to recruit from, how to make the hiring process itself resistant to fraud, which certifications to ask for and when, and how to develop and retain staff.

Key takeaways

The gap is about skills more than headcount. Recent studies report a shortage of specific capabilities, led by AI and cloud security, rather than a simple lack of bodies.
Describe work, not job titles. NICE Framework work roles and SFIA skills give you a shared, testable vocabulary that stops job adverts asking for everything.
Widen the funnel deliberately. Career changers and internal transfers already account for a large share of UK cyber recruitment; ask for demonstrated ability, not years and acronyms.
Your hiring process is an attack surface. Deepfake interviews and fake IT workers target remote technical roles, so identity verification belongs in the recruitment workflow and onboarding.
Retention is the cheapest hire. Funded development, clear progression and manageable workloads keep skills you have already paid to build.

The skills gap in numbers

Use primary workforce studies, state the year, and be careful about which figure you quote. A "workforce gap" (estimated unfilled positions) and a "skills gap" (missing capabilities in staff you have) are different measures, and recent reports have moved emphasis from the first to the second.

Source (year)	Finding	What it means for hiring
ISC2 Cybersecurity Workforce Study (2025, 16,029 respondents)	59% report critical or significant skills needs (44% in 2024); 95% report at least one skills need; 88% have experienced at least one consequence of a skills deficiency	Shortages are near universal, so plan for development, not only recruitment
ISC2 (2025)	Top needs: AI (41%), cloud security (36%), risk assessment (29%), application security (28%), security engineering and GRC (27% each)	Prioritise these areas in training budgets and job design
ISC2 (2025)	Hiring freezes 39% (49% at enterprises of 10,000+ staff); budget cuts 36%; layoffs 24%	Many teams must close gaps by upskilling existing staff
UK DSIT, Cyber security skills in the UK labour market (2025 report, 2024 data)	About 143,000 people in cyber roles; estimated shortfall about 3,800; 49% of businesses have a basic technical skills gap and 30% an advanced gap; core cyber job postings fell 33% to 32,370	The UK market has shifted towards employers, but basic skills in general businesses remain weak
UK DSIT (2025)	Cyber sector recruitment: 52% from the existing cyber pool, 28% converting from non-cyber roles, 15% career starters	Career changers are a proven source, not an experiment
US BLS Occupational Outlook (May 2025 data)	Information security analysts: 192,900 jobs, median pay $129,180, projected growth 21% from 2025 to 2035	US demand for core analyst roles is expected to keep growing much faster than average

The DSIT report also records that women make up 17% of the UK cyber workforce, against 48% of the UK workforce overall, and that ethnic minority staff hold only 8% of senior cyber roles (six or more years' experience). Narrow hiring practices therefore leave a large part of the available talent untouched.

What the role does

Most failed security hires start with a vague role. Before you advertise, write down what the person will actually do, using a framework so the description can be compared, assessed and reused.

NICE Framework (NIST SP 800-181 Rev. 1): describes cybersecurity work as Task, Knowledge and Skill statements grouped into work roles. Work roles describe areas of responsibility, not job titles, and one job may combine several. Current components (version 2.2.0, April 2025) are maintained by NIST outside the publication itself. Categories include Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation.
SFIA 9: defines skills with codes and levels 1 to 7, for example Information security (SCTY), Security operations (SCAD), Identity and access management (IAMT), Vulnerability assessment (VUAS), Penetration testing (PENT) and Incident management (USUP). Levels express autonomy, influence, complexity and knowledge, which makes them useful for grading and pay bands.
UK Cyber Security Council: professional titles at Associate, Practitioner, Principal and Chartered levels, awarded in specialisms that include Cyber Security Governance and Risk Management, Secure System Architecture and Design, and Cyber Security Audit and Assurance, with Incident Response being piloted. These help UK employers benchmark seniority.

Hiring need	NICE work role	SFIA skills to assess
SOC or detection analyst	PD-WRL-001 Defensive Cybersecurity; PD-WRL-003 Incident Response	SCAD, USUP
Vulnerability and exposure management	PD-WRL-007 Vulnerability Analysis	VUAS
Security architect	DD-WRL-001 Cybersecurity Architecture	ARCH, STPL, SCTY
Application security engineer	DD-WRL-003 Secure Software Development; DD-WRL-005 Software Security Assessment	SWDN, PROG, PENT
GRC analyst	OG-WRL-002 Cybersecurity Policy and Planning; OG-WRL-012 Security Control Assessment	BURM, AUDT, INAS
Identity engineer	IO-WRL-005 Systems Administration (plus identity tasks)	IAMT
Workforce lead (the person running this programme)	OG-WRL-003 Cybersecurity Workforce Management	WFPL, RESC, PDSV

The table is a starting point: check the current NICE and SFIA definitions before using them in job descriptions. For individual role profiles see the Security Architect Career Guide, the SOC Analyst Career Guide and the GRC Analyst Career Guide.

Core skills and tools

Separate what someone must bring on day one from what you can teach in six months. Most job adverts fail this test.

Category	Hire for	Train for	How to assess
Foundations	Networking (TCP/IP, DNS, HTTP), one operating system in depth, scripting basics	Specific tools such as your SIEM or EDR	Practical exercise on logs or packet captures
Cloud and identity	Understanding of IAM models and shared responsibility	Your cloud provider's policy language and services	Review a flawed IAM policy and explain the risk
AI security	Curiosity and sound risk judgement	LLM threat categories, AI governance tooling	Discuss how they would assess a new AI tool
Risk and GRC	Clear writing, ability to explain risk in business terms	Your control framework (ISO 27001, NIST CSF)	Written risk summary from a short scenario
Behaviours	Communication, problem solving, integrity	Rarely trainable in the short term	Structured behavioural interview

Use work samples, not trivia: a 60 to 90 minute task close to the real job (triage three alerts, review an architecture diagram, write a risk note) predicts performance better than port-number quizzes.
Remove false requirements: a degree, five years' experience and three certifications for an entry role filters out career changers who make up much of the market.
Write skills-based adverts: list four to six outcomes and the skills behind them, and mark which are essential.

Routes into the role

Treat sourcing as a portfolio. Each route has a different cost, time to productivity and risk.

Route	Best for	Trade-offs
Internal transfer (IT operations, networking, development, audit)	Teams that need context about your systems quickly	Backfill needed in the source team; requires a funded training plan
Career changers	Analyst, GRC and awareness roles where communication matters	Six to twelve months to full productivity; needs structured mentoring
Apprenticeships and graduate schemes	Larger organisations building a pipeline	Upfront supervision load; payback over years, not months
Experienced hires	Senior, architecture and leadership roles	Most expensive and slowest to fill; competition with vendors and consultancies
Managed services and contractors	24x7 coverage, niche skills, surge capacity	Knowledge leaves with the contract; access must be governed as third-party access

Small and large organisations differ. A team of two or three should hire generalists, buy 24x7 monitoring as a service and focus internal effort on governance, identity and cloud configuration. A large organisation can afford apprenticeships, a rotation programme and specialists, and should use NICE or SFIA to grade roles consistently across business units. Both should map hiring to the risks that matter, not to a generic org chart.

Securing the hiring process

Remote technical hiring is now a target. The FBI warned in June 2022 of applicants using deepfakes and stolen personal data in interviews for remote IT, programming, database and software roles, and in January 2025 described North Korean IT workers using AI and face-swapping during video interviews, then stealing code and extorting employers once discovered. A fraudulent hire receives valid credentials, which is why this maps to MITRE ATT&CK T1078 Valid Accounts once the person is inside.

Verify identity at offer and onboarding: document checks against a live person, consistent with the Hiring Fraud and Candidate Identity Verification Guide.
Cross-check applicants: reused phone numbers (especially VoIP), email addresses and near-identical CVs across applications, as the FBI recommends.
Control the equipment path: ship laptops only to verified addresses and alert on changes to delivery address or payroll details during onboarding.
Start with least privilege: no local admin, blocked unapproved remote desktop tools, and monitoring for logins to one account from many countries.
Hold staffing agencies to the same standard: audit their verification practices. See the Insider Threat from Fake IT Workers Guide and the Deepfake and AI Impersonation Guide.

Certifications that help

Certifications are a useful signal of structured knowledge and are required for some government and regulated roles. They are not a substitute for a work sample. Ask for them in proportion to the role.

Level	Examples	Reasonable use in hiring
Entry	ISC2 Certified in Cybersecurity (no work experience required); CompTIA Security+	"Desirable" for entry roles; fund it after hire rather than demanding it
Practitioner	CompTIA CySA+, GIAC GSEC, cloud provider security certifications	Evidence of hands-on study in a specialism
Senior and management	CISSP (five years' experience required), CISM, CCSP	Senior and leadership roles; check the experience rules before listing them for mid-level posts
Architecture and specialist	ISSAP (CISSP plus two years, or seven years cumulative), OSCP	Specialist roles where depth must be shown

Listing CISSP for a junior role is a common error because candidates cannot hold the full certification without the required experience. See the Cybersecurity Certifications Guide, the ISC2 Certified in Cybersecurity (CC) Guide, the CompTIA Security+ Guide and the CISSP Certification Guide.

Progression

Development and retention are where most of the skills gap is closed. The DSIT 2025 report found 12% of UK cyber sector employees left in the 18 months before its survey, and that gaps in existing employees' technical skills rose from 18% in 2021 to 28% in 2025.

Baseline (month 1 to 2): map each team member to NICE work roles and SFIA levels, and record current and target skills. Start with the gaps that match your top risks, such as cloud or AI.
Plan (month 2 to 3): give each person a written development plan with a funded course or certification, a stretch assignment and a mentor. Agree how progress will be assessed.
Pilot (month 3 to 6): run a rotation or shadowing scheme with one team, for example SOC analysts spending time with cloud engineering. Collect feedback before scaling.
Scale (month 6 to 12): publish a career framework with levels, expected skills and promotion criteria, so people can see a route to senior roles without leaving.
Review and adjust: if a scheme raises workload or attrition, pause it and fix the cause rather than pressing on. Revisit the skills map at least yearly.

Protect learning time: development that only happens outside working hours rarely survives a busy quarter.
Manage workload: on-call load and alert volume drive people out. See the SOC Staffing and Shift Models Guide.
Grow security champions: developers and IT staff with a security interest extend the team and form a transfer pipeline. See the Security Champions Programme Guide.

Measuring the programme

Time to fill: days from approval to accepted offer, by role family.
Skills coverage: percentage of critical NICE work roles with at least two people at target SFIA level.
Regretted attrition: leavers you wanted to keep, as a percentage of headcount per year.
Internal fill rate: share of security vacancies filled by internal transfers or promotions.
Hiring fraud signals: number of candidates failing identity verification, and onboarding anomalies such as address or payroll changes.
Development delivery: percentage of staff who completed their funded development plan in the year.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.RR-02, GV.RR-04	Roles and responsibilities established; cybersecurity included in human resources practices
NIST CSF 2.0	PR.AT-01, PR.AT-02	Awareness and training for all personnel and for specialised roles
NIST SP 800-53 Rev. 5	PM-13, AT-3	Security and privacy workforce; role-based training
NIST SP 800-53 Rev. 5	PS-3, PS-7	Personnel screening; external personnel security (agencies, contractors)
ISO/IEC 27001:2022 Annex A	A.6.1, A.6.3	Screening; information security awareness, education and training
MITRE ATT&CK	T1078	Valid Accounts: what a fraudulent hire obtains on day one

Common failure patterns

Unicorn job adverts: one role asking for SOC, cloud, application security and GRC expertise attracts few applicants and sets the hire up to fail.
Certification gatekeeping: requiring senior certifications for junior posts excludes career changers and screens on test-taking rather than ability.
Hiring without development budget: filling seats under a freeze-and-thaw cycle while cutting training leaves the skills gap untouched.
Trusting the video call: relying on a single remote interview without identity checks is the gap fake IT worker schemes exploit.
Losing people at the promotion step: no visible route to senior roles means trained staff leave for the next employer to collect the benefit.

Practitioner checklist

Map current roles to NICE work roles and SFIA skills, and record gaps against your top risks.
Rewrite job adverts as four to six outcomes with essential and desirable skills marked.
Replace knowledge quizzes with a short work sample matched to the role.
Remove experience-gated certifications from entry and mid-level requirements.
Add identity verification and address and payroll change alerts to remote hiring and onboarding.
Audit staffing agencies' candidate verification at least annually.
Give every team member a funded development plan and protected learning time.
Publish a career framework with levels and promotion criteria.
Track time to fill, skills coverage, regretted attrition and internal fill rate quarterly.

Cybersecurity Skills Gap and Hiring Guide: Recruiting, Developing and Retaining Talent