As cybersecurity roles become more specialised and AI changes security operations, organisations face growing pressure to find experienced professionals and develop capabilities internally. Nandini Tandon, Co-Founder and Chief People Officer at Indusface, says a combination of external recruitment, structured reskilling and practical experience can help employers address the talent challenge.
The difficulty extends beyond finding candidates with cybersecurity qualifications. Employers also need professionals who can identify vulnerabilities in live environments, understand how systems operate and respond effectively to real-world threats.
“The biggest challenge is finding professionals who can combine cybersecurity knowledge with practical experience,” Tandon says. “Certifications provide a useful foundation, while hands-on exposure has become increasingly important.”
Specialist roles are raising the bar for employers
Cybersecurity covers multiple disciplines, including application security, cloud security, security operations, incident response, and governance, risk and compliance. Professionals need the right combination of technical depth, domain knowledge and business understanding to work effectively across these areas.
Competition is particularly intense for senior and specialised talent. Fortinet’s 2026 Global Cybersecurity Skills Gap Report found that 51% of respondents identified senior-level cybersecurity skills as their greatest need, while 49% faced challenges securing approval for additional cybersecurity talent.
The figures highlight two distinct pressures: finding professionals with the required expertise and obtaining organisational approval to expand security teams.
Tandon believes external recruitment remains necessary, particularly for senior positions, but organisations should complement it with internal capability building.
“Organisations need a hybrid talent strategy,” she says. “They can bring in experienced specialists where deep expertise is required immediately, while creating structured pathways for existing employees to move into cybersecurity roles.”
Internal mobility can widen the talent pipeline
Employees working in adjacent technical functions may already possess foundations that can be developed into cybersecurity expertise. Software engineering, IT operations, cloud infrastructure and data functions offer potential routes into security roles.
ISACA’s 2025 State of Cybersecurity research found that 46% of respondents said more than half of their current cyber staff had transitioned from roles outside cybersecurity.
For employers, internal mobility offers a way to broaden recruitment beyond candidates already working in dedicated security positions. It also creates opportunities to build on employees’ existing technical knowledge.
Tandon says the transition is feasible when organisations provide structured learning and practical exposure.
“Software engineers already understand application architecture and development workflows. IT operations professionals bring knowledge of infrastructure and systems. Cloud specialists understand distributed environments, while data professionals can transition into areas such as threat intelligence, detection and security analytics.”
The challenge is to turn these existing capabilities into applied security skills. Tandon emphasises focused training, mentorship, hands-on experience and clear progression paths as essential elements of the process.
AI is changing the skills security teams need
AI is influencing both the work performed by cybersecurity professionals and the expertise employers seek. Tandon expects AI to take on repetitive activities, including initial detection, alert triage and parts of investigation workflows, while increasing the importance of human judgement and contextual decision-making.
“Threat hunting, incident response strategy, security architecture and interpreting AI-generated signals will become increasingly important,” she says.
Professionals will also need to understand how AI systems work, assess the reliability of their outputs and recognise when human validation is necessary.
These changes could affect early-career roles as well. Tandon expects entry-level professionals to spend less time on manual monitoring and more time validating AI-generated findings, investigating anomalies and developing analytical judgement.
Fortinet’s 2026 research found that 91% of respondents were already using or experimenting with AI-powered cybersecurity solutions. Meanwhile, 60% identified finding cybersecurity talent with specific AI experience as a leading recruitment challenge.
The figures point to a workforce requirement extending beyond conventional security knowledge. Employers will increasingly need professionals who combine core cybersecurity expertise with AI fluency, analytical thinking and sound decision-making.
What makes reskilling programmes effective?
Internal development requires more than training courses. Tandon says organisations need to treat capability building as a structured business priority, supported by learning pathways, mentorship and opportunities to work on real security challenges.
She identifies several elements that can strengthen internal cybersecurity talent development:
Structured learning: Defined pathways help employees develop the technical and security-specific knowledge required for new roles.
Practical experience: Real-world exercises help employees connect theoretical learning with vulnerabilities, threats, detection and remediation.
Mentorship: Guidance from experienced professionals helps employees apply their knowledge and develop sound judgement.
Clear progression: Career pathways show employees how they can build expertise and advance within security teams.
Continuous development: Ongoing learning helps teams respond to changing technologies and emerging threats.
Tandon also stresses the importance of leadership commitment. As cybersecurity requirements evolve, organisations need to sustain investment in employee development rather than treat reskilling as a one-off intervention.
HR, business leaders and educators have complementary roles
Building a sustainable cybersecurity workforce requires coordination between employers and educational institutions, according to Tandon.
HR teams can establish career-transition pathways alongside conventional recruitment and use skills-based hiring to identify candidates with relevant technical foundations. Business leaders can support these efforts through investment in continuous learning, mentorship and practical training.
Educational institutions, meanwhile, can bring cybersecurity closer to mainstream technology education by incorporating labs, simulations, application security exercises and cloud security projects into engineering, computer science and IT curricula.
The World Economic Forum’s Future of Jobs Report 2025 identifies networks and cybersecurity among the fastest-growing skills globally, alongside AI and big data and technological literacy. It also estimates that 59% of the global workforce will require training by 2030 as skill requirements change.
The outlook reinforces the need for workforce development to keep pace with technological change. For organisations, the task is to combine specialist recruitment with internal talent development, giving employees the practical experience and continuous learning opportunities needed to respond to evolving security demands.
