# Cybersecurity Needs New Talent. It Just Doesn't Want to Be Anyone's First Employer.

Cybersecurity may be one of the easiest fields in tech to start learning. There are free labs, capture-the-flag platforms, home lab guides, certification courses, and endless write-ups from people who documented every step. Nobody is hiding the material.

I'm not complaining about those resources. They're good, and plenty of people have learned real skills from them. I'm questioning what we imply when we point to them. The industry talks as if learning and getting hired are the same thing, and every conversation about a talent shortage quietly assumes that if more people learned the material, the shortage would close.

So people learn it. They finish the labs, build a tool, publish the write-ups, and then discover that the accessible part was education. The first paid opportunity is the part nobody can download. A lab can teach you to analyze a phishing email. It can't give you a manager, a ticket queue, or a reason for a stranger to trust you near a production system.

If a field makes preparation easy and selection hard, has it become accessible? Or has it just made the waiting room bigger?

2. The Experience Paradox

For a job, you need experience. For experience, you need a job. I'm trying to understand how both halves are supposed to be true at once.

Employers have real reasons. Security work touches production systems, and mistakes there are expensive. A junior who misreads an alert or misconfigures a control can do damage, and someone senior has to supervise, which costs time understaffed teams don't have. Those concerns are legitimate.

But that explains why employers want experience. It doesn't explain where the experience comes from. Everyone who has it got it somewhere, which means someone once hired them before they had it. The requirement quietly depends on a previous generation of employers doing exactly what current employers avoid.

The usual answer is "start in help desk or IT first." Maybe. But that admits the real entry point is somewhere else. ISACA's 2025 survey found that almost half of respondents said more than half of their current cyber staff transitioned from roles outside of the field. People were let in sideways. Yet the same report found that fewer enterprises are training non-security staff to move into security roles. The door people used is narrowing.

ISC2's own hiring research concedes that early-career job descriptions often list requirements that beginners realistically can't meet. If the industry's own research says that, who are these postings written for?

3. The Portfolio That Cannot Speak for Itself

Labs, certifications, GitHub repositories, write-ups, tools. This is the standard advice for people without experience: show your work. And it does show something.

The problem is that somebody has to evaluate it. A repository can't tell a reviewer whether you understood what you built or followed a tutorial. A hiring manager with a large pile of applicants can't read two hundred write-ups, and a first-round screener may not be technical enough to judge one. That last part is my interpretation, not a measured fact. But when evidence is expensive to evaluate, filters replace it, and "years of experience" is the cheapest filter there is.

Certifications are cheap to evaluate for the same reason. ISC2 surveyed 929 hiring managers, all of whom had entry- or junior-level staff and had recruited for those roles in the previous two years. 89% said they would hire an entry- or junior-level candidate with an entry-level certification and no other experience. That complicates my own argument, and it should. It suggests the door isn't closed everywhere. But those respondents already hire juniors, and "would hire" is not the same as picking one candidate from a stack of five hundred.

I also won't claim a strong portfolio equals readiness. Doing a lab alone isn't the same as handling an ambiguous alert, an unclear escalation path, or a senior person who's wrong. Hiring managers are right to care about that. The trouble is that nothing in the process lets a portfolio answer the question. So the evidence gets set aside, and experience becomes a stand-in for everything the portfolio couldn't prove.

4. The Ouroboros: A System Feeding on Its Own Requirements

Here's the loop as I see it. Employers want less risk, so they ask for experience. Candidates can't get experience, so they stack certifications and projects to compensate. Beginners now arrive with more credentials, so credentials start to look like a baseline, and postings ask for more. Meanwhile, the people who could have been hired and trained aren't, so few people ever become experienced, and experienced people stay scarce. That scarcity then gets cited as the reason to require experience. That's the Ouroboros: not one villain, but requirements that consume the supply the industry needs.

That last link is interpretation, and I'll say so. But the "shortage" itself is being redefined. In its 2025 study, ISC2 declined for the first time to publish a global workforce gap estimate, because respondents emphasized skills shortages over staff shortages. Skills come from experience. Experience comes from hiring people who don't have it yet. Same loop, different vocabulary.

It's also not just stubborn employers. In the same study, 29% of respondents said they couldn't afford to hire people with the skills needed to secure their organizations, and ISACA found 55% of teams understaffed and 65% with unfilled positions. Teams under that pressure have little time to train someone from zero. There may also be a collective-action problem, though I can't prove it: why train a junior for a year if a competitor can hire them away? Each employer's choice can be rational while the combined result is that nobody is producing new professionals.

Who pays? Candidates pay first, in time, money, and months of rejection. Understaffed teams pay in workload, and organizations pay in risk. I'd argue the people making individual hiring decisions feel the cost least. That's the part I find hardest to look past: a rational-looking decision that costs everyone except the person making it.

5. Breaking the Cycle—or Learning to Live Inside It?

Some changes seem realistic, and none are new. Early-career postings could describe what beginners can actually do, which ISC2's own research urges. Employers could build paid apprenticeships and structured junior roles instead of treating every opening as a senior one in disguise. Practical assessments, like a supervised exercise or a walkthrough where candidates explain decisions in their own project, could replace some resume filtering, because they test what a portfolio can't. Organizations could rebuild internal paths into security. Shared apprenticeship programs across employers might also soften the poaching problem.

For candidates, the options are narrower. Adjacent IT work, internal moves, volunteer or nonprofit security work, and write-ups that explain why you made a decision rather than listing commands may improve your odds. "Improve your odds" is the honest limit. Nothing here guarantees anything, certifications and projects included. Someone can do all of it correctly and still not get hired, and telling them otherwise turns a structural problem into a personal failing.

So are we breaking the cycle or teaching people to survive it? Right now most advice is the second kind, because candidates are the only ones who can act today. But that puts the burden on the participants with the least power.

If an industry depends on new talent but won't hire anyone until they've already been hired somewhere else, who is responsible for the first yes? Employers, training providers, certification bodies, governments, or the candidates themselves? And if the honest answer is "everyone," why does it keep turning out to be no one?

---

Claims to verify before publishing

• ISC2 hiring study quotes and figures: The 929 managers, the 89% certification-only figure, and the early-career job description concession came from secondary coverage (TechRepublic, BestColleges, ISC2's summary page). Check the exact wording and survey scope in ISC2's primary 2025 Hiring Trends report.
• ISACA 2025 figures: The 46% "transitioned from outside the field," 55% understaffed, 65% unfilled, and the decline in training non-security staff all come from ISACA's press release. Confirm the exact wording in the full report.
• ISC2 2025 Workforce Study: The 29% affordability figure and the decision not to publish a gap estimate come from news coverage. Confirm both in the study itself.
• My interpretations, not facts: Screeners being unable to evaluate portfolios, the poaching and collective-action problem, the loop between "shortage" and requirements, and hiring decision-makers feeling the cost least. They're framed as interpretation in the text, but you may want to make that clearer.
• Survey bias: The ISC2 hiring respondents all already hired juniors, so that data can't be generalized to the whole market.

Sources consulted

• ISC2, 2025 Cybersecurity Hiring Trends: https://www.isc2.org/insights/2025/06/cybersecurity-hiring-trends-study
• ISC2, Hiring Trends skills deep dive: https://www.isc2.org/insights/2025/09/cybersecurity-hiring-trends-skills-deep-dive
• TechRepublic coverage of the ISC2 hiring survey: https://www.techrepublic.com/article/news-cybersecurity-hiring-survey-isc2/
• BestColleges coverage of the ISC2 hiring report: https://www.bestcolleges.com/news/report-cybersecurity-job-market/
• ISC2, 2025 Workforce Study overview: https://www.isc2.org/insights/2025/12/a-focus-on-skills-isc2-workforce-study
• MeriTalk coverage of the ISC2 Workforce Study: https://meritalk.com/articles/isc2-report-cyber-experts-say-they-need-skills-more-than-headcount/
• OODA Loop summary of the ISC2 Workforce Study: https://oodaloop.com/briefs/technology/cybersecurity-skills-matter-more-than-headcount-in-the-ai-era
• ISACA, State of Cybersecurity 2025 press release: https://www.isaca.org/about-us/newsroom/press-releases/2025/state-of-cybersecurity-2025-global-press-release