The cybersecurity job market is changing what it measures
For years, the conversation about the cybersecurity workforce centered on a single number: how many open roles an organization was carrying. That framing is breaking down. The data from 2025 tells a more strategic story — one about capability, not just count.
Drawing on CyberSN's U.S. Cybersecurity Job Posting Data Report 2025 and the 2025 SANS Global Cybersecurity Workforce Research Report, a clear pattern emerges: leaders are moving away from reactive efforts to fill vacancies and toward a deliberate understanding of what capabilities exist across their workforce ecosystem, where operational risk sits, and how their teams actually support cybersecurity strategy.
This is the shift from headcount to Workforce Intelligence.
The core insight: The strongest cybersecurity organizations in 2025 are not the ones with the most open requisitions filled. They are the ones with the clearest visibility into what their workforce can actually do — and where it cannot.
Which cybersecurity roles are in highest demand in 2025?
Job posting volume remains a useful signal of where the market is investing. Based on 2024 U.S. job postings, the ten most in-demand cybersecurity roles were:
- Security Engineer — 64,300 postings
- Security Analyst — 45,496 postings
- DevSecOps — 36,020 postings
- Cybersecurity / Privacy Attorney — 22,465 postings
- Security Architect — 22,246 postings
- Cybersecurity Manager — 17,975 postings
- Identity and Access Management Engineer — 12,223 postings
- Cybersecurity Specialist — 8,221 postings
- Cyber Risk Analyst — 8,187 postings
- Incident Responder — 7,639 postings
Security Engineers and Analysts continue to anchor the market.
"It's no surprise that Security Engineers and Analysts remain the top two cybersecurity roles, as they are the backbone of cyber teams," says Deidre Diamond, Founder and CEO of CyberSN.
But the headline numbers conceal a more important trend. Demand for these foundational roles is contracting, even as the overall market matures:
- Security Engineer: down 24.97% over 2022–2024 (-4.68% from 2023 to 2024)
- Security Analyst: down 25.88% over 2022–2024 (-13.87% from 2023 to 2024)
Meanwhile, a different set of roles is accelerating.
The fastest-growing roles tell the real story
Year-over-year growth in 2024 reveals where organizational priorities are moving:
- Cybersecurity / Privacy Attorney: +40.74%
- Red Teamer: +29.18%
- Cybersecurity Sales Engineer: +26.22%
- Cyber Threat Intelligence Analyst: +14.24%
- Cybersecurity Specialist: +12.42%
- Incident Responder: +12.14%
- Product Security Engineer: +12.08%
- Governance, Risk & Compliance (GRC) Analyst: +11.81%
- Reverse Engineer / Malware Analyst: +6.66%
- Cybersecurity Director: +4.91%
The 40% surge in Cybersecurity and Privacy Attorneys is not an anomaly.
"This spike is a direct reflection of how regulatory changes are shaping hiring practices," Diamond notes.
The composition of demand is shifting toward governance, threat intelligence, product security, and offensive capability — a signal that organizations are maturing the way they think about workforce structure, not simply expanding it.
Capability, not just titles
The most consequential change is conceptual. Leaders are no longer evaluating their workforce by the titles on an org chart. They are evaluating it by verified capability — what their people can actually do against the threats and obligations the organization faces.
The SANS research makes this concrete. 52% of organizations now cite "not having the right staff" as a bigger challenge than the 48% who cite "not enough staff." The constraint has moved from quantity to capability coverage.
"This is a fundamental shift. Hiring used to be about filling seats. Now it's about verifying skills and making sure people can actually do the work needed," says Brian Correia, Director at SANS | GIAC.
This is precisely where most organizations lack intelligence. Without visibility into the capabilities distributed across their workforce ecosystem, leaders cannot answer the questions that now matter most: Where are we genuinely covered? Where is our operational workforce risk concentrated? Which capabilities do we have, and which only appear on paper?
"Organizations are visualizing cyber capabilities across their teams and realizing it's not about hiring more, it's about building smarter," Diamond observes.
Internal development becomes a strategic priority
If capability is the new measure, then developing capability internally becomes a core strategy rather than a perk. The SANS data confirms the movement:
- 55% of organizations maintain formalized cybersecurity training programs
- 51% prioritize upskilling their current workforce over bringing in external talent
This reflects a recognition that workforce strength is built, not merely acquired — and that an organization without visibility into its own capability cannot make sound decisions about where to invest in development.
"If you don't invest in internal development, you'll see burnout, stagnation, and ultimately failure," Diamond warns.
Correia frames the stakes even more directly:
"This isn't just a retention tactic. It's about survival. The organizations that thrive will be the ones investing in their people."
How AI and regulation are reshaping the workforce
Two forces are accelerating this shift toward capability-based workforce strategy.
Regulation is changing what roles look like — and not only by adding legal headcount.
"New regulations like NIS2 and DORA are influencing how organizations hire, not just adding legal roles but demanding technical staff who understand compliance implications," says Correia.
The 40% growth in cybersecurity attorneys is the visible tip of a deeper change: compliance fluency is becoming a required capability across technical roles, not a specialized function siloed in legal.
AI is reshaping the substance of cybersecurity work rather than eliminating it.
"AI isn't replacing cyber professionals, instead, it is shifting what we need from them. We're seeing demand for people who can work alongside automation tools," Correia explains.
Both forces point to the same conclusion: the capabilities an organization needs are changing faster than any static org chart can reflect. Leaders need ongoing visibility into their workforce ecosystem to keep pace.
Rethinking your cybersecurity workforce strategy
The throughline across the 2025 data is unmistakable. Declining demand for foundational roles, surging demand for governance and offensive capability, the prioritization of verified skills, and the pressure of AI and regulation all point in one direction: workforce planning can no longer be reactive.
"These shifts, combined with the surge in regulatory requirements, are forcing organizations to make cyber workforce planning a board-level conversation," says Diamond.
"Cybersecurity workforce planning can no longer be reactive; it must be deliberate, strategic, and grounded in real data," she adds.
Deliberate, strategic, data-grounded workforce planning requires something most organizations still lack: a clear, current picture of their own workforce ecosystem. That is what Workforce Intelligence provides — the operational visibility to understand capability coverage, locate workforce risk, and align workforce structure with strategy.
The job market has already moved from counting seats to verifying capability. The leaders who gain that visibility first will be the ones building smarter, more resilient cybersecurity organizations.
This analysis draws on CyberSN's U.S. Cybersecurity Job Posting Data Report 2025 and the 2025 SANS Global Cybersecurity Workforce Research Report. The full conversation between Deidre Diamond and Brian Correia is available here.
See your cybersecurity workforce the way the market is moving
CyberSN gives leaders Workforce Intelligence — the visibility to understand capability coverage, workforce risk, and where your ecosystem is strong or exposed. Make workforce planning deliberate, strategic, and grounded in real data.
Explore Workforce Intelligence