Cyber security vacancies stay open twice as long as other tech roles

Time-to-hire for UK cyber security roles has stretched well beyond the technology average, with financial services and public sector employers competing for the same small pool of certified practitioners.

Contract rates have risen faster than permanent salaries, pulling experienced people out of permanent roles and deepening the gap for employers who cannot match day rates.

Employers making progress broaden their criteria: hiring infrastructure engineers with strong fundamentals and funding certification internally.

In technology, the practical consequence is that briefs written a year ago no longer match the market. Roles defined as broad, generalist engineering attract volume without depth, while narrowly specified senior roles attract almost nobody through advertising alone. We usually recommend splitting the requirement: define the two or three capabilities that genuinely cannot be trained, then treat everything else as developable.

Across the UK, we are seeing employers run smaller, more deliberate searches: fewer roles open at once, tighter shortlists, and more willingness to train for the last twenty per cent of a specification.

If you are hiring in technology right now, the practical takeaway is to shorten your process and be explicit about what is genuinely non-negotiable. Fewer, better matched candidates almost always beat a longer list — and in a market moving this quickly, speed of decision is itself a competitive advantage.