Demand for Cybersecurity Professionals: What the Hype Hides
You will often read that cybersecurity has millions of unfilled jobs. The demand is real, but the headlines blur three separate things: how many people are needed, which skills are missing, and how hard it is to get a first job. This guide separates them. It shows what U.S. government projections say, what a large employer survey found, why a big number of openings does not mean an easy entry, and how to test demand in your own area before you spend money on training.
The short answer
Demand for cybersecurity professionals is growing faster than for most jobs, according to U.S. Bureau of Labor Statistics projections. Employer surveys also report widespread skills gaps.
But demand is not even. Employers say they lack specific skills such as cloud and AI security, and some report budget cuts and layoffs at the same time. A beginner with no experience may find fewer doors open than the headlines suggest.
So the useful question is not “is there demand?” but “demand for which role, at what level, in my area?” The rest of this guide helps you answer that.
Three kinds of evidence, and what each measures
| Evidence | What it measures | Limits |
|---|---|---|
| Government projections (BLS) | Expected job growth and openings for one defined occupation over ten years | A projection, not a fact. Covers one job title. U.S. only. |
| Employer and professional surveys (such as ISC2) | What security teams and leaders say about skills, budgets and hiring | Self-reported. Run by organizations that also sell training or credentials. |
| Job-posting trackers (such as CyberSeek) | How many ads are posted compared with the number of workers | Ads are not hires. One job can be posted many times or left open for months. |
No single source settles the question. When three imperfect sources point the same way, you can be more confident. When they diverge, read the details.
What the government projections say
The BLS covers this field mainly under information security analysts. Its latest figures:
- Employment in 2025: 192,900 jobs.
- Projected growth, 2025 to 2035: 21 percent, or 40,600 jobs. BLS calls this much faster than the average for all occupations.
- Projected openings: about 14,100 a year, on average.
- Median pay, May 2025: $129,180. The lowest 10 percent earned less than $75,090 and the highest 10 percent more than $199,850.
A quick check: 40,600 ÷ 192,900 is about 21 percent, which matches the stated growth rate. Annual openings of 14,100 are about 7 percent of current employment. BLS counts openings that come from growth and from workers who leave the occupation or retire, so some openings go to people who already work in the field.
On industries, BLS says the largest employers of these analysts are computer systems design (22 percent), finance and insurance (17 percent), management of companies (9 percent), information (9 percent), and consulting (6 percent).
This covers one title. Security engineers, compliance specialists and managers may be classified elsewhere, so the full field is larger than this number suggests. For more on pay and credentials, see our guide to information security management certificates.
What employers report
The ISC2 2025 Cybersecurity Workforce Study, summarized in a Security Info Watch report published in December 2025, drew on more than 16,000 cybersecurity professionals and decision-makers worldwide. Reported findings include:
- 95 percent reported at least one skills gap on their teams.
- 59 percent called those gaps critical or significant, up from 44 percent in 2024.
- 88 percent said they had at least one incident or operational problem linked to a skills shortage.
- 36 percent reported budget cuts, and 24 percent reported layoffs.
- 41 percent named AI as their most pressing skills need, and 36 percent named cloud security.
Notice the mix. Employers say they need skills, and some are cutting budgets and staff in the same period. That combination fits a picture of demand for particular skills, not a simple “hire anyone” shortage.
Keep the source in mind. ISC2 is a professional body that also runs certifications, and the figures are reported by respondents, not measured. We read the secondary report, not the full study, so check the study itself if you need exact wording.
A worked example: why openings are not the same as easy entry
This example is made up. It uses the real BLS figure of about 14,100 openings a year and then adds guesses to show why the headline does not tell a beginner much.
Suppose only some openings are open to people with little experience, and 20,000 people a year are trying to enter the field. The table shows openings per entrant for three guesses about the entry-level share:
| Share of the 14,100 openings open to beginners (guess) | Entry-level openings | Entrants (guess) | Openings per entrant |
|---|---|---|---|
| 10% | 1,410 | 20,000 | 0.07 |
| 25% | 3,525 | 20,000 | 0.18 |
| 40% | 5,640 | 20,000 | 0.28 |
What it shows: even at 40 percent, there would be about 0.28 entry-level openings per entrant, a little more than one for every four. A field can have strong overall demand and still be hard to enter.
What it leaves out: the entrant and entry-share numbers are guesses, not data. Some entrants are already working in IT and move up, and BLS openings are for one occupation only. We did not find reliable public data on entry-level hiring in this field, so treat the real answer as unknown and test it locally (section 7).
Roles, education and credentials
This list is our reading of common roles, not an official classification:
| Role | What it involves | Typical starting point |
|---|---|---|
| Security or SOC analyst | Watches alerts, investigates suspicious activity | Often reachable from help desk or IT support |
| Governance, risk and compliance | Policies, audits, risk assessments | Often reachable from audit, legal or IT roles |
| Cloud security | Secures cloud accounts and configurations | Often needs cloud or systems administration experience |
| Identity and access management | Who can reach what, and proving it | Often reachable from systems administration |
| Incident responder or penetration tester | Investigates breaches or tests defenses | Usually needs prior security or technical experience |
| Security manager | Runs the team, budget and program | Experience first |
On education, BLS says analysts typically need a bachelor’s degree in a computer science field, though some enter with a high school diploma plus training and certifications. It adds that many employers prefer candidates with an information security certification, and that experience in a related field, often IT, can be required.
Some industry credentials also require work experience before they are fully awarded. Check each issuer’s rules. For what happens when a breach is found and why those skills matter, see our guide to breach detection.
How to test demand where you live
Before you pay for training, collect your own data. It takes about two hours.
- Pick two target roles from the table above.
- Read 20 recent postings for each in your area or for remote roles you could take. Use a mix of employers.
- Tally what they ask for: years of experience, certifications, degrees, tools and clouds.
- Count how many say entry-level or accept less than two years. This is your local entry-share.
- Look at the gaps. If most want three years and a certification you do not have, plan an IT step first.
- Repeat in three months. Postings change.
A job-posting tracker such as CyberSeek can give you a regional picture of postings and workers. Check its current figures yourself, as we did not rely on them here.
Common mistakes
- Quoting “millions of jobs” as if they were open to beginners. Most are not.
- Training in a skill nobody near you hires for. Check postings first.
- Treating a certificate as a job offer. It helps. It does not replace experience.
- Skipping the IT foundation. Networks, operating systems and cloud basics underpin most security roles.
- Trusting salary claims from course sellers. Use BLS and real postings.
- Ignoring the non-technical roles. Compliance and risk work is a legitimate way in.
Learn more
If you want structured learning, online providers such as Coursera and Udemy list information security courses at several levels. We may earn a commission if you sign up, at no cost to you. We are not affiliated with any university. Compare the syllabus with the postings you collected in section 7, and check the update date. For more guides, see our information systems security hub.
Frequently asked questions
Is there really a shortage of cybersecurity professionals?
There is strong demand for particular skills, and employers report widespread skills gaps. But some also report budget cuts and layoffs, so it is not a simple shortage of people. Entry-level access may be tighter than the headlines suggest.
How fast is cybersecurity job growth?
BLS projects 21 percent growth for information security analysts from 2025 to 2035, much faster than average, with about 14,100 openings a year.
How much do cybersecurity professionals earn?
BLS reports a median of $129,180 for information security analysts in May 2025. The lowest 10 percent earned less than $75,090 and the highest 10 percent more than $199,850. Pay varies with role, place and experience.
Do I need a degree to work in cybersecurity?
BLS says analysts typically need a bachelor’s degree in a computer science field, though some enter with a high school diploma plus training and certifications. Many employers prefer a security certification.
What are the most in-demand cybersecurity skills?
In the ISC2 2025 study as reported, respondents named AI (41 percent) and cloud security (36 percent) as their most pressing needs. Check postings in your area for what employers near you ask for.
Can I get in with no IT experience?
It is possible but can be harder. Many people start in IT support, systems administration or audit and move into security. Test the local market using section 7.
Browse certificate, course and degree programs side by side.