A talent shortage or a postings shortage? What the security jobs data actually shows

For years, the same sentence has come up in every security conversation: “there are not enough specialists”. Data recently published by Help Net Security tells a more complicated story. In the US, cybersecurity job postings reached, for the first nine months of the year, their lowest level in four years. That is not proof the talent shortage is gone. It is, however, a good reason to look more closely at what we are measuring when we say “shortage”.

What the numbers show

The data comes from CyberSN, a security recruiting and workforce intelligence firm, based on postings collected by JobSpikr and deduplicated:

• 235,786 US postings from January through September 2026, versus 320,210 in the same period of 2025, a 26.4% drop;
• compared with 2024, the drop is only about 4%, because 2025 was an unusually strong year;
• CISO and leadership postings fell 38.9% from 2025’s record;
• the share of governance, risk and compliance (GRC) roles rose from 9.4% in 2023 to 14.8% in 2026;
• the share of technical defense roles (engineers and analysts who run and monitor controls) fell from 47.1% to 41.5%, though it remains the largest category;
• penetration tester postings fell by nearly half against 2025;
• AI security engineer postings tripled, but there are only about 2,400 of them.

What they do not show

Before any conclusion, the limits, because they are large:

• it is US only. There is no figure for the European Union or for Romania;
• postings are not hires. The article says so explicitly: the data measures what employers advertised, not how many people were hired;
• the source is a recruiting firm. Both the data and the only commentary in the article come from CyberSN. That does not make the numbers wrong, but the explanations offered (for example, executive instability stalling security hiring) are opinions, not data-backed conclusions;
• “minus 26%” would be a misleading headline. The big drop comes from comparing against an exceptional 2025. Against 2024, the market is almost flat.

With those limits, the most solid observation is not the total drop but the shift in structure: demand is moving from the people who do security technically toward the people who govern and document it.

The shift toward GRC: plausible here too, but with a trap

We have no data for Romania, so what follows is our reading, not a finding. Regulatory pressure explains the shift toward GRC in the US well, where much of the growth comes from privacy and cybersecurity attorneys. Here, NIS2 and DORA push in the same direction: regulated entities must have policies, risk analyses, reporting and governance approved by management. It is reasonable to expect demand for compliance to grow here as well.

The trap is hiring for documents instead of controls. A GRC function that produces policies, registers and reports without checking that the measures actually work is doing compliance for show: it ticks the requirement, it does not reduce the risk. That is exactly what NIS2 and DORA actually ask you to avoid: being able to prove that a control works, not just that it exists on paper. We wrote at length about that difference in the control that passes the test.

What it means for an organization here

If the US trend is confirmed in Europe, a company in Romania could end up with more people writing policies and fewer actually operating the defense: monitoring, incident response, testing. A few questions are worth asking now, before the market decides for you:

• who operates the controls, not just who documents them? A vulnerability management policy is worth nothing without someone actually running the loop of discovery, prioritization, remediation and re-testing;
• what do you do in-house and what do you outsource, deliberately? Continuous monitoring and periodic testing are hard to cover with a small team. The decision to do them internally or with a partner has to be made deliberately, not left to the roles that no longer get opened;
• how do you prove it works? Good compliance ties each requirement to evidence: logs, test reports, reviews, recorded exceptions.

What we take away

“Talent shortage” is a convenient phrase, but recent data looks more like a market reorganizing itself: fewer postings in the US, more demand for governance and compliance, less for testing and technical defense. None of this carries over automatically to Romania, and the source deserves to be read with open eyes. The useful lesson is a different one: however much the compliance side grows, it is only worth something if it proves real controls. Otherwise, you have hired people to document a defense that nobody operates.

Want to know where your organization stands on the balance between compliance and actual defense capacity? Contact us and we start from an assessment.

Sources

• Help Net Security: The cyber talent shortage? Job postings just hit a four-year low