When evaluating candidates for cybersecurity roles, managers prioritize those with experience, according to a new report.
The hiring trends report by ISC2, a nonprofit organization for cybersecurity professionals, suggests that 90% of recruiters consider candidates with prior IT work only.
“Relevant experience and certifications that validate foundational competence carry additional weight in the hiring decision-making process, potentially outweighing a degree alone when competing for cybersecurity roles,” the report reads.
Certifications are seen more as “nice to have,” but there are key exceptions. The following three hold the most weight and could help you land a cybersecurity job:
- Certified in Cybersecurity (CC) by ISC2
- CASP+
- Security+ from CompTIA
When it comes to certifications, not everything makes sense. For example, nearly 40% of hiring managers require CISA (ISACA) for entry-level positions. However, for a person to get that certification, they need a minimum of five years of cumulative, paid experience in cybersecurity. Go figure.
“This gap in what security managers require from early-career talent versus what these groups can realistically achieve creates a significant barrier to entry, which could potentially discourage otherwise qualified and capable candidates from applying for foundational cybersecurity roles,” the report 2025 Cybersecurity Hiring Trends reads.
It turns out that for some roles, soft skills are valued even more than technical ones. Here are the top five skills that hiring managers declare they value the most:
- Teamwork
- Problem solving
- Analytical thinking
- Data security
- Cloud security
“Hiring managers are looking for collaborative, adaptable thinkers who can tackle complex problems in the cybersecurity landscape, rather than just technology specialists,” the report said.
Early-career cybersecurity roles are typically filled within a month to three months at most. However, finding a senior specialist may take as long as nine months.
“Many security managers have already begun tapping into ‘non-traditional' talent pools and embracing non-technical, non-IT, and foundational certified candidates. However, there is room to expand these efforts further, leveraging transferrable skills from other industries to build a more sustainable and resilient cybersecurity workforce,” the report concluded.
Your email address will not be published. Required fields are markedmarked