Careers in Cyber

The cybersecurity industry has a problem. It keeps trying to solve a talent crisis using the same approach that created it.

For years, the default hiring playbook has looked the same. Post a job listing requiring a four-year degree in computer science or information technology. Add a stack of certifications. Require three to five years of experience in a role that is meant to be entry-level. Run resumes through automated screening. Invite a narrow shortlist to interview. Hire from within that shortlist and repeat.

This model was designed for a world where cybersecurity roles were few, highly specialized, and relatively stable. That world no longer exists. And the organizations still relying on this playbook are not just struggling to fill roles. They are actively limiting the strength of the teams they build.

The numbers are not subtle. CyberSeek data shows that there are significantly more open cybersecurity jobs in the United States than there are qualified workers to fill them. The Bureau of Labor Statistics projects that information security analyst roles will grow 33 percent through 2033, far faster than the average across all occupations.

Yet year after year, the talent supply gap remains. The explanation is not a shortage of people with the potential to do this work well. The explanation is a hiring model that consistently filters out the people most likely to close that gap.

The traditional cybersecurity talent pipeline runs through a small number of entry points: a limited set of four-year programs, a handful of well-known agencies, and the same certification pathways. People who came up through those channels know the handshake. Everyone else starts from the outside.

The job descriptions organizations post today often do not reflect what the actual work requires. Cyber roles have evolved dramatically. As explored in how AI is changing core cybersecurity roles and responsibilities, the skills in highest demand now include risk communication, analytical thinking, cross-functional judgment, and adaptability. Those capabilities do not live exclusively inside four-year computer science programs or a list of vendor certifications.

When hiring criteria do not match the actual work, organizations miss the candidates who fit the work and over-select for people who fit the checklist.

When every hire comes from the same narrow pipeline, teams start to look the same. That is not just an equity problem. It is a resilience problem. Diverse teams bring broader pattern recognition to threat analysis, more creative approaches to problem-solving, and better communication across business units. A talent model that defaults to the same backgrounds, the same schools, and the same career trajectories year after year is quietly undermining its own security capability.

Career changers from adjacent fields, veterans transitioning out of military service, community college graduates, bootcamp completers, and self-directed learners are consistently filtered out before they ever reach a hiring manager. Many of them have demonstrated exactly the kind of adaptability, resilience, and mission orientation that cyber teams need. The traditional model simply does not have a mechanism to see them.

Some organizations, communities, and educational institutions are actively building something different.

Skills-based hiring is gaining real ground. Instead of evaluating candidates by credential, skills-based approaches assess what candidates can actually demonstrate through practical exercises, assessments, and portfolio reviews. Research consistently shows this is a more accurate predictor of job performance and a more equitable way to evaluate non-traditional candidates.

Rebuilding the pipeline from earlier stages is another lever with real momentum. As we explored in our piece on how the cybersecurity pipeline starts in high school, state-level programs that partner with high schools and community colleges are producing job-ready graduates without requiring a four-year degree or years of prior experience. The investment is early, but the return is a deeper and more diverse talent pool.

Mentorship and structured pathways create entry points where the traditional model leaves gaps. The Cyber Guild’s RISE Mentorship program connects emerging talent directly with experienced cyber professionals, helping people build the network and practical knowledge that formal education alone rarely provides.

Embracing career changers as a strategic asset is one of the highest-leverage shifts organizations can make. People coming from teaching, law enforcement, healthcare, finance, and the military bring contextual knowledge that is genuinely valuable in cyber roles, especially as threats become more sector-specific and communication becomes more central to the work.

That includes broadening job descriptions to reflect actual role requirements rather than credential checklists. It means investing in development programs that treat new hires as talent to grow, not fully-formed specialists to absorb. It means building partnerships with community organizations, HBCUs, community colleges, and professional networks that reach talent the standard funnel misses.

It also means accepting that the future of the cyber workforce will not look like its past. As cyber teams adapt to AI-driven threats, the capabilities in highest demand are shifting toward judgment, communication, critical thinking, and contextual analysis. These are human skills, and they are not the exclusive property of any single credential path.

The teams positioned to succeed are the ones that actively seek diverse perspectives, invest in developing talent from within, and build relationships with communities where skilled, motivated people are already waiting to contribute.

The talent model that built cybersecurity to this point was never designed to take it to what comes next. The organizations willing to build something better are not just filling roles faster. They are building more resilient, more capable teams. That is the competitive advantage hiding inside the hiring problem nobody wants to admit they have.