Stop Calling It a Skills Shortage
Every conference I attend, someone says it. Every industry report repeats it. Theres a cybersecurity skills shortage. Millions of unfilled positions. Crisis mode. Existential threat.
I dont buy it.
We dont have a skills shortage. We have a hiring problem.
The Math Doesnt Add Up
Yes, ISC2 says theres a global cybersecurity workforce gap of around 4 million. That number gets quoted everywhere. But look at the other side. Thousands of people are earning Security+, CISSP, and other certifications every month. Boot camps are full. Cybersecurity degree programs are overflowing. Career changers are flooding into the field.
So where are all these people going? Why arent they filling those 4 million positions?
Because the job postings are absurd.
Entry Level With 5 Years Experience
Look at any job board right now. “Entry level SOC analyst. Requirements: 3 to 5 years experience, CISSP preferred, expertise in 15 different tools, must know cloud, must know OT, must know application security.” For $65,000.
Thats not an entry level position. Thats a wishlist from someone who doesnt understand the market.
In aviation, we dont expect new pilots to have 5,000 hours before their first job. We train them. We build them up. We accept that competence takes time and investment. Somehow, cybersecurity forgot this.
Companies Wont Train
The same companies crying about talent shortages refuse to invest in developing talent. They want fully formed security professionals to appear out of thin air, ready to hit the ground running on day one, requiring zero onboarding and zero training budget.
Then they complain they cant find anyone.
Meanwhile, smart people with career change potential get filtered out by automated resume screeners looking for keywords they dont have yet. Help desk veterans who would make excellent analysts never get interviews because they lack a specific certification that takes three months to earn.
The Real Problem
The “skills shortage” is really three problems pretending to be one.
Unrealistic job requirements. HR teams copying and pasting requirements without understanding what the role actually needs.
Unwillingness to train. Treating new hires as expenses instead of investments.
Salary mismatch. Wanting senior talent at junior prices. The Bureau of Labor Statistics puts median security analyst salaries at $120,000, but plenty of companies think they can hire experienced professionals for $70,000 and then wonder why positions stay open.
What Actually Works
The companies I see building strong security teams do things differently. They hire for aptitude and attitude, then train for skills. They create junior roles that actually function as on ramps. They promote from within IT. They partner with training providers to upskill existing employees.
They stop waiting for perfect candidates who dont exist and start building the teams they need.
