Blog / AI cyberattacks: what they mean for security hiring

AI cyberattacks: what they mean for security hiring

AI cyberattacks make existing attack methods faster. For security hiring, that shifts which profiles matter and why 'cybersecurity experience' is no longer a precise requirement.

AI cyberattacks mostly make known attack methods faster and cheaper to run. For hiring, that means "cybersecurity experience" on a job ad says very little. Teams need people who can detect, judge and respond at machine speed, and who understand how AI systems themselves can be abused.

This hits two groups. Security engineers will see their role shift toward detection, automation and AI risk. Hiring managers will find that the profile they wrote six months ago no longer matches the problem they need solved. Below is how we see that shift from the recruiting side.

How are AI-powered cyberattacks changing the work?

AI-powered cyberattacks speed up things attackers already did: writing phishing mails, scanning for weak spots, adapting scripts. The techniques are mostly familiar. The volume and pace are new, and that changes what defenders spend their days on.

We are recruiters, not malware analysts, so we stay out of the technical detail. What we see is the effect on job requirements. When attacks come faster, a team that triages alerts by hand falls behind. Companies respond by buying AI and automation tools, and then discover they need people who can run those tools safely.

One more development matters for hiring. Recent threat reporting from CERT-EU describes autonomous AI agents interacting with websites in ways that go beyond passive browsing. Security teams now have to watch software agents as well as human attackers. Few candidates have done that before.

Why is the skills gap in the Netherlands so visible?

Dutch organizations adopt AI for defense faster than they learn to apply it. PwC's Dutch survey results show that 61% cite too little knowledge about using AI in cyber defense as a major barrier, against 50% globally.

61% of Dutch organizations say a lack of knowledge about applying AI to cyber defense holds them back, compared with 50% globally. (PwC, Digital Trust Insights 2026, Dutch outcomes)

Uncertainty about risk adds to it. 52% of Dutch respondents say they do not know how much AI risk is acceptable, versus 39% globally. And protection against AI-enabled attacks is a priority for 36% of Dutch respondents, according to PwC Netherlands.

Read that carefully. The gap is about knowledge, not only headcount. You can add ten people and still lack the one who knows how to validate what an AI tool flags.

Which security roles get harder to fill?

The roles that combine security basics with cloud, automation or AI knowledge get harder to fill. Pure generalists are easier to find. People who can tune detections, secure AI agents or explain risk to a board are not.

From what we see in the market, these profiles come up most:

Security engineers who harden cloud, identity and endpoint setups.
Detection and response engineers who tune SIEM, XDR and SOAR tools and check AI-generated alerts.
Threat intelligence specialists who turn a flood of signals into decisions.
AI security and governance specialists who set rules for agents, models and data.
Security automation engineers who build automation that does not make mistakes at scale.

Cloud and identity architects belong on that list too. AI systems depend on APIs, privileged access and third-party services, so someone has to own those permissions. Our own work in cloud, such as Azure architect roles, shows how often security questions end up on the architect's desk.

How long does it take to hire a security engineer?

In the Netherlands, filling a cybersecurity role reportedly takes about 127 days, against 82 days for a general IT role. That figure comes from a secondary market overview, so treat it as an indication, not a hard benchmark.

The same overview estimates around 13,800 open cybersecurity vacancies in the Netherlands in 2026. Even if the real number is lower, the direction is clear.

Four months is a long time to run without a security engineer. Someone leaves, the detection rules stop getting tuned, and the remaining team works around the gap. That is the real cost of a slow search.

It is also why many employers train their own people. Roughly 45% of Dutch organizations offer internal cybersecurity training to existing IT staff. That works for some roles. It does not replace a senior hire who has already done the job under pressure.

Why does a generic CV search miss good candidates?

A keyword search for "security engineer" misses people whose experience sits under another title. Platform engineers, DevSecOps engineers, detection engineers and data governance leads often do the exact work a team needs, without the label.

Here is a typical case. A client asks for a security engineer with three certifications and AI experience. Almost nobody matches. When we go through the intake, the real tasks turn out to be: tune cloud detections, review access for a new AI service, and explain findings to the CTO. An SRE with a security focus, or a DevSecOps engineer, can do that. The certification list is what made the pool look empty.

That is why we map candidates against tasks, not titles, in the intake and sourcing steps of our Delivery Sprint process. Requiring every certificate shrinks the pool without proving someone can investigate an incident. The same logic applies to adjacent skills: a team that hires cloud engineers with a security mindset often finds people it would have skipped on paper.

There is one limit. Adjacent profiles need honest conversation about what they have not done yet. We say that to both sides, up front.

What should security engineers do to stay in demand?

Build evidence of judgment, not just tool knowledge. Employers want people who can validate automated output, manage permissions for AI agents and make a call when the data is unclear. Those skills show up in how you describe past incidents.

If you are a security engineer, a few things help in conversations with recruiters and hiring managers:

Describe decisions you made under uncertainty, not only tools you used.
Show that you can explain a risk to someone who is not technical.
Get hands-on with AI-specific topics such as agent permissions, prompt injection and data access controls.

Communication matters more than most engineers expect. Threat analysts who can connect an indicator to a business consequence are valued over those who only collect data.

Location is flexible for many of these roles. Searches such as security engineer hiring remote or near Amsterdam both exist, and some employers can help with visas for the right senior profile. Ask early, because it changes the pool.

Junior profiles are a different story. Few teams have the time to coach them while attacks speed up, so entry-level security hiring is slower than the headline vacancy numbers suggest.

Veelgestelde vragen

How is generative AI used in cyberattacks?

Attackers use it to write convincing phishing messages, adapt scripts and research targets faster. It mostly speeds up known methods. Defenders see more attempts, in better language, in less time.

Does AI create new types of malware or just speed up existing attacks?

Current reporting points mostly to speed and scale of existing techniques, not a new class of malware. Evidence is still limited, and this may change. New risks do appear around AI agents and their permissions.

How can companies defend against AI-powered cyberattacks?

Combine tools with people. Automation and AI detection help, but someone must tune them, check their output and own the decisions. Many Dutch firms also train existing IT staff while hiring for senior gaps.

What skills do security engineers need to counter AI-driven threats?

Solid security basics, cloud and identity knowledge, automation skills, and awareness of AI risks like prompt injection and agent permissions. Clear communication with non-technical colleagues matters just as much.

Conclusie

AI cyberattacks are a labor market story as much as a technical one. As attacks speed up, the scarce resource is experienced judgment: people who can set up, question and govern automated security tools. Titles and certificate lists describe that poorly.

If you are hiring for a security role that keeps sitting open, or you are a security professional wondering how your profile reads in this market, we are happy to compare notes. A short intake call is usually enough to see whether the role is defined around tasks or around a wish list.

Sources

Written by our AI, read by a flesh-and-blood recruiter.