A managing director at a mid-sized logistics firm told me he'd advertised for an information security manager and had CVs flooding in within days. He still didn't have anyone he'd be happy to put in front of his board.
Both of those things can be true at once. The government's latest research on the cyber labour market shows why. Ipsos and Perspective Economics carried it out for the Department for Science, Innovation and Technology, and it was published at the end of September as Cyber security skills in the UK labour market 2026.
Most of its data was collected last year, so it's about a year old, but the picture it paints is more interesting than the usual skills shortage headline.
Is cyber security hiring easier than it was?
In some ways, yes. Among the cyber security firms in the survey that had tried to recruit, 53% had at least one hard-to-fill vacancy, compared with 70% in 2023. The researchers say the market is moving from favouring candidates to favouring employers.
Fewer firms are growing, too. Just 53% of cyber security firms expected to grow their workforce, down from 67% the year before. One micro business in the interviews said it had stopped advertising altogether after a single LinkedIn post brought in about 1,300 CVs in the first week. Plenty of choice, then, for anyone with time to read them.
The report's job postings analysis shows where most of the demand sits. Some 64% of core cyber postings asked for between two and six years of experience.
And at the other end, the unemployment rate for cyber security graduates rose to 11% in the 2022/23 academic year, against 6% for graduates overall. So I'd say the middle of the market is busy. Employers hiring there have plenty of choice.
The difficulty has moved up the ladder.
Which cyber roles are still hard to fill?
Mostly the experienced ones. Among firms that did have hard-to-fill vacancies, 56% named staff with around three to five years behind them, and 35% named principal-level roles, which the report defines as around six to nine years. That principal figure was 16% a year earlier, and 11% named director-level roles.
By specialism, governance and risk management came top at 27%. Secure system architecture and design followed at 24%, with audit and assurance at 23%.
The base for that question was only 66 firms, so I'd treat the percentages as a steer rather than a count. But the direction fits what I see. All three specialisms rely on judgement as much as technical skill. And some of the recruitment agents interviewed for the research also reported more interest in AI-related skills, particularly around governance, defence and security architecture.
If that carries on, the senior roles will ask for even more than they do now.
Why a pile of CVs doesn't mean a short search
One large cyber security business in the research said that finding someone who is technically strong and can also manage people is close to impossible. I hear a version of that from IT directors and managing directors all the time. The CVs arrive, and most of them are a good engineer or a good auditor, rarely both.
It also helps to be clear about which job you're really hiring for.
A security manager who sets policy and talks to the board is a different person from one who spends the week in the tooling, even when the job titles match. Get that wrong in the advert and you'll spend a month reading the wrong CVs. And a good candidate will have spotted the mismatch before you have.
A security lead I spoke to recently, with around eight years behind them, said they ignore any advert that doesn't give a salary. I doubt they're unusual.
What I'd put in the advert
Start with the salary. The report found that 76% of core cyber job postings last year carried no salary information at all, up from 70% in 2023. Median advertised pay for core cyber roles was £58,050, with a mean of £60,800, and London's mean was £70,200. I'd expect a senior hire to sit above those figures, so treat them as a floor.
Say what the job is, too.
Is it governance and risk, or hands-on security engineering? Does it include managing people? Candidates at this level decide quickly, and a vague advert tells them nobody has thought it through. Or worse, it attracts the wrong people in bulk.
And be straight about what the first six months look like, because a good candidate will ask.
What if you have nobody in the seat yet?
Many UK organisations lack confidence in handling a breach. The report found that 47% of the people responsible for cyber security in UK businesses, and the same share in charities, lacked the confidence to deal with a breach or attack and hadn't outsourced that function.
If that's you, don't wait for the perfect hire before you cover the basics. Get an incident response arrangement in place with a specialist provider, and then take the time to find the right permanent person. Rushing a senior appointment to fill a gap is how people end up with someone who's technically fine and wrong for the board.
I'd also look at whether an interim could bridge the gap while you search.
In my experience it's often quicker than a permanent search, and it shows you what the role really needs before you commit to a salary and a job description.
Where a specialist helps
Dozens of CVs, let alone 1,300, is a lot of reading for someone with a day job. The value of a specialist recruiter in a market like this isn't finding people. It's telling the governance lead from the engineer in a few minutes, and knowing which of the strong candidates is open to a move.
A generalist agency or a job board can't do that for you, because it depends on knowing the difference between the roles.
If you're hiring a security or IT lead and want to talk it through, get in touch with our IT recruitment team. You can also see how we approach hiring an information security manager.
