The cybersecurity talent shortage is shifting from a headcount problem to a profile problem. As AI speeds up attacks, companies need security people who can brief a board, run a crisis and prove recovery works. Those profiles are rare, and a job spec written two years ago will not find them.

This hits two groups. Hiring managers see searches drag on because the spec still says "security operations" while the real need is broader. Security professionals see their own value change: deep tooling skills still matter, but the ability to explain risk to non-technical colleagues now decides who gets the senior roles.

Demand has grown faster than the number of people with the right experience. Regulation adds to it, and AI-driven attacks raise the bar for what a security team has to handle. The gap is widest at senior level, where experience cannot be shortcut.

Global workforce studies, such as the ISC2 cybersecurity workforce study, have put the gap in the millions of people for years. Numbers like that vary by method, so treat them as a rough direction. The more useful question for a hiring manager is which profiles are missing in your own team.

In the Netherlands, the cybersecurity skills gap shows up in searches that take months. Entry-level roles attract plenty of applicants. Senior roles with cloud, identity and regulatory knowledge do not.

That is a market where a cybersecurity recruitment partner has to know the roles well enough to tell a real match from a keyword match. We wrote more about the hiring side in our piece on why the shortage is often a hiring problem.

AI shortens the time between finding a weakness and exploiting it, and it lets attackers work at larger scale. Defenders get less time to patch, investigate and respond. That changes what a security team needs to be good at.

The European Central Bank has warned significant banks that AI can identify vulnerabilities and generate working exploits at a speed not seen before. It asked them to submit action plans covering governance, resources and timelines.

Dutch authorities, including the NCSC and the AIVD, jointly warn that AI will increase the number, scale and complexity of attacks, and that it is already automating the path from finding a vulnerability to exploiting it.

ENISA's 2026 threat report points the same way: criminal and state-linked groups are using AI more. That is an observation about attackers. What it means for hiring is our reading: teams need people who can work in shorter decision windows.

Cyber resilience is the ability to keep operating during an attack and to recover fast afterwards. It is a leadership issue because it needs budget, authority and decisions that no security team can make alone.

The Dutch authorities explicitly ask organizational leaders to allocate resources, prioritize security and give security experts the room to act. NIS2 raises management accountability, and the ECB confirms that DORA applies to AI-enabled threats.

Consider a mid-sized company with a strong security engineer who finds an exposed system. The fix needs a supplier, a budget and a business owner who accepts downtime. If the engineer cannot get those three people in one room, the fix waits.

Resilience work is mostly that kind of coordination. Which is why influence inside the company now weighs as heavily as technical depth.

The hardest profiles combine two things: technical depth and the ability to work across legal, finance and operations. Pure specialists are still needed, but the combined profiles are where searches stall.

From the searches we see and the policy direction, these are the ones to watch. This is our own assessment.

• Security leaders who can brief a board and turn exposure into revenue, customer and regulatory risk.
• Cloud and identity security architects, because attacks go after access, APIs and internet-facing assets.
• Third-party risk specialists, since the ECB highlights third-party software and open-source components.
• AI-security specialists who know model governance and how to defend AI systems themselves.
• Risk professionals with regulatory knowledge who can translate NIS2, DORA and the AI Act into controls that can be tested.

Many of these people come from mixed backgrounds: audit, risk, operations or engineering. Standard CV filters tend to miss them.

Start with the outcome you need, not the tool list. Write the role around what the person must change: lower exposure, faster recovery, a board that understands the risk. Then test for that in the interview.

A few changes that work in practice:

Give candidates an incident scenario with incomplete information and conflicting priorities. Listen to how they decide as well as what they know.

Ask them to explain one technical vulnerability in terms of revenue, customers and regulators. Strong candidates do this without notes.

Look at blended backgrounds. Someone from audit or operations with security depth can outperform a pure specialist in a resilience role.

Build from within too. Security engineers who get exposure to finance, legal and procurement can grow into risk leaders. That takes time, so it complements external hiring and does not replace it.

In our Delivery Sprint, the intake is where this gets sorted. We agree on the outcome and the interview scenarios before we approach anyone. The longer view is in our article on hiring through the shortage.

If you work in security, the market is rewarding range. Tool skills get you in the room. Explaining risk and getting decisions made keeps you there.

That does not mean every engineer must become a manager. Security engineers who can use automation for detection, triage and vulnerability prioritization, and who understand the risks of those same tools, are in demand as well.

Practical steps: take on an incident review that involves other departments, write one risk summary for a non-technical reader, and learn how NIS2 or DORA applies to your employer. Recruiters who know the field will ask about exactly these things.

On pay, entry-level salaries are easy to look up and vary a lot by region and employer. Senior and leadership pay is less transparent, and rising demand for combined profiles puts upward pressure on it. We cannot give a hard number here, because public data on that is thin.

The cybersecurity talent shortage is real, but the sharpest part of it sits in a specific group: people who combine technical depth with the ability to lead through an incident. AI-driven threats raise the pressure, and regulators now expect management to own the answer.

For hiring managers, that means rewriting the spec around outcomes and testing for judgment. For security professionals, it means building range beyond tools. If you are working on a hard security search, our earlier analysis of the shortage is a good place to compare notes, and we are happy to talk through your profile.

1. Articles written by Alfred Monterie
2. Thema’s
3. Security & Awareness Archieven - Computable.nl
4. Laatste nieuws
5. Actueel
6. Actueel Archieven - Computable.be

Written by our AI, read by a flesh-and-blood recruiter.