Cybersecurity Hiring: Are Technical Skills Still Enough?

For years, cybersecurity recruitment has centred on technical capability. Certifications, platform knowledge, cloud security experience, and incident response expertise have traditionally been the main benchmarks for hiring. However, current workforce research indicates that this model is changing.

The current challenge is no longer defined only by a shortage of technical professionals. Increasingly, organisations are identifying skills gaps within existing teams, particularly in areas linked to human judgement, communication, and decision-making.

For HR leaders, recruitment managers, and executives hiring cyber professionals, the question is shifting from how many cyber professionals are available to whether the workforce has the capabilities needed to manage cyber risk in today’s business environment.

Research Points to a Broader Skills Gap

The latest global cybersecurity workforce research from ISC2 indicates that the issue extends beyond headcount. Their workforce study highlights that employers are increasingly prioritising competencies such as problem-solving, collaboration, communication, and strategic thinking alongside technical skills.

This is significant for those involved in recruitment and workforce planning. Technical knowledge remains essential, but it is no longer viewed in isolation. Modern cyber roles increasingly sit at the intersection of technology, governance, business operations, and executive risk management.

This change reflects the broader business environment. Organisations are operating with cloud-first systems, distributed workforces, third-party integrations, and growing AI adoption. In this context, cyber professionals are increasingly expected to interpret complex risk scenarios rather than simply respond to technical alerts.

Similarly, research from SANS Institute suggests that the more pressing challenge is what teams are able to do in practice rather than the number of roles filled. The focus is shifting toward capability development in areas such as AI oversight, risk interpretation, and workforce readiness.

Recent studies from ISC2 suggest that employers are increasingly prioritising a broader capability mix alongside technical expertise. Their workforce research highlights growing emphasis on:

• critical thinking
• communication
• collaboration
• problem-solving
• strategic risk awareness

These findings indicate that cyber hiring is moving beyond certifications and tool familiarity alone.

This is particularly relevant as organisations operate within:

• cloud-first environments
• distributed workforces
• third-party vendor ecosystems
• increased AI adoption
• more complex regulatory frameworks

In this setting, cyber professionals are increasingly required to interpret risk in context rather than respond only to technical alerts.

Why the Human Element Is Now Central

Cybersecurity has historically been viewed as a technical discipline. However, many recent incidents have demonstrated that risk often emerges through the human layer rather than the technology stack alone.

Phishing attacks, credential misuse, unsafe AI tool usage, poor escalation decisions, and communication failures during incidents all point to human capability as a critical factor.

Research into cybersecurity culture and workforce behaviour shows that technical controls are less effective when organisations do not develop the workforce skills needed to support sound judgement and secure behaviour.

Research into cyber culture and workforce behaviour indicates that technology controls alone are insufficient when workforce capability is underdeveloped.

Examples include:

• phishing and credential misuse
• poor access control decisions
• unsafe use of AI tools
• delayed escalation during incidents
• communication breakdowns across teams

This is changing how organisations approach recruitment and workforce planning.

This is particularly relevant for hiring managers. A candidate may have strong technical credentials but still face challenges in areas such as judgement, communication, or prioritisation under pressure. These are now increasingly recognised as operational risk factors.

Skills Requiring Stronger Development

Critical Thinking

Critical thinking is becoming a central workforce requirement because cyber incidents rarely present complete information at the outset.

Professionals are often required to assess conflicting signals, identify patterns, distinguish genuine threats from false positives, and determine business impact within tight timeframes.

For example, a security analyst reviewing multiple alerts from an AI-driven monitoring platform must decide which issues warrant escalation. This decision cannot rely solely on technical output. It requires contextual judgement, awareness of business systems, and the ability to assess potential operational consequences.

This is why critical thinking is increasingly appearing in hiring frameworks and role descriptions.

Cyber incidents rarely present complete information at the outset. Professionals are often required to:

• assess incomplete data
• distinguish real threats from false positives
• identify patterns across systems
• prioritise business impact

This requires analytical reasoning rather than reliance on technical tools alone.

Communication and Risk Translation

A recurring issue identified in workforce studies is the gap between technical findings and executive understanding.

Cyber professionals are now frequently expected to explain risks to HR, legal teams, finance leaders, and boards. This requires more than technical vocabulary. It requires the ability to translate complex findings into business language.

For recruitment teams, this means assessing whether candidates can communicate the operational and financial implications of cyber threats rather than simply describe the technical details.

Cyber professionals are now frequently expected to communicate with:

• HR teams
• legal and compliance
• executive leadership
• board stakeholders
• operational managers

The requirement is not only technical accuracy, but the ability to translate cyber findings into business consequences.

AI Oversight and Human Validation

With increased use of AI-driven monitoring tools, the workforce increasingly needs the ability to review and validate outputs.

AI is changing the cybersecurity workforce at pace. Automated detection, threat modelling, and response tools are increasingly common.

However, research indicates that overreliance on automation can create new risks. False positives, missed anomalies, and poor AI assumptions still require human review.

As a result, hiring managers are increasingly looking for professionals who can validate outputs, challenge automated recommendations, and apply sound judgement.

This includes:

• identifying false positives
• challenging automated recommendations
• validating threat prioritisation
• recognising unsafe assumptions

Research suggests that AI oversight is becoming a growing workforce capability requirement.

Case Studies From Current Workforce Research

One of the more notable examples cited in workforce research is the skills-based workforce model implemented by Bayer. Rather than relying purely on traditional role structures, the organisation moved toward a capability-led model focused on workforce skills development across its global operations.

This case study is particularly relevant for HR and recruitment teams because it demonstrates how cyber workforce planning is increasingly shifting from job-title hiring to competency-based hiring.

Another example comes from the Cyber Security Agency of Singapore, which has developed structured cyber workforce training pathways at scale. This reflects a broader trend toward formal skills frameworks rather than role-based assumptions

This is relevant for recruitment leaders because it reflects a shift from job-title hiring to competency-led workforce design.

These case studies indicate that workforce development is increasingly being approached through formal capability frameworks.

What This Means for Hiring Leaders

For managers, HR teams, and recruitment professionals, the implications are clear.

Cyber hiring frameworks may need to evolve beyond technical screening alone.

Interview processes, job descriptions, and workforce development plans increasingly need to assess:

For HR, recruitment teams, and hiring managers, cyber recruitment frameworks may need to expand beyond technical screening.

Areas increasingly being assessed include:

• critical thinking
• communication capability
• decision-making under pressure
• collaboration
• AI oversight
• business risk awareness

This reflects the broader shift from purely technical hiring to capability-led workforce planning.

Who is responsible for updating cyber professionals’ skills in the workplace?

Research suggests this responsibility is shared across multiple stakeholders, rather than resting with the individual employee alone.

1) Employer / organisation leadership

The strongest responsibility sits with the employer because workforce capability directly affects organisational risk exposure.

The ISC2 study reports that 90% of organisations are taking some action to address skills deficiencies, including:

• budget allocation for professional development
• internal training
• cross-functional training
• protected learning time during work hours
• AI and cloud capability development

This places responsibility on:

• CIO / CISO
• HR and learning teams
• workforce planning leaders
• line managers

In practical terms, if the business introduces:

• new cloud architecture
• zero trust frameworks
• AI security tools
• governance requirements

then the employer is responsible for ensuring the workforce can safely operate within that environment.

2) Direct managers and cyber team leaders

Managers are responsible for translating workforce capability gaps into operational development plans.

This includes:

• identifying skill gaps in teams
• assigning training priorities
• mentoring less experienced staff
• exposing staff to incident reviews
• rotating responsibilities across risk areas

The research shows that hiring managers increasingly prioritise problem-solving, communication, collaboration, and strategic thinking, which means managers must also assess and develop these skills post-hire.

3) HR and talent acquisition

HR and recruitment teams are increasingly responsible for ensuring job frameworks reflect current skills needs.

This includes updating:

• job descriptions
• competency frameworks
• interview criteria
• performance reviews
• career progression pathways

For example, if role descriptions continue to focus only on certifications and technical tooling, they may fail to capture emerging workforce requirements such as AI oversight or risk communication.

4) The individual cyber professional

Research also supports shared responsibility with the individual cyber professional.

Because the threat landscape changes rapidly, continuous professional development is considered a core expectation in cyber roles.

This includes maintaining currency in:

• cloud security
• AI governance
• regulatory risk
• communication capability
• leadership skills

The ISC2 study notes that many professionals are independently pursuing new qualifications and strategic skills development.

Research-based summary

The evidence suggests that responsibility is not solely on the cyber professional.

A more accurate workforce model is:

• organisation → funds and enables development
• manager → identifies and coaches capability gaps
• HR / recruitment → updates competency frameworks
• employee → maintains professional currency

The discussion now revolves around What skills are needed? to Who is accountable for keeping the workforce current?.

References

1. ISC2
   2025 ISC2 Cybersecurity Workforce Study
   Focus: global workforce trends, skills shortages, hiring priorities, AI and cloud skills, communication and problem-solving.
2. Ullah, F., Ye, X., Fatima, U., Akhtar, Z., Wu, Y., Ahmad, H. (2025)
   What Skills Do Cyber Security Professionals Need?
   Analysis of 12,161 job ads and 49,002 Stack Overflow posts.
   Key finding: communication and project management were among the most important soft skills.
3. Goupil, F. et al. (2022)
   Towards Understanding the Skill Gap in Cybersecurity
   Focus: correlation between workforce demand and academic curricula.
4. Nkongolo, M., Mennega, N., van Zyl, I. (2023)
   Cybersecurity Career Requirements: A Literature Review
   Systematic literature review on technical and professional requirements in cyber roles.
5. Miranda, J.P.P., Tayag, M.I., Canlas, J.D. (2025)
   Cybersecurity skills in new graduates: a Philippine perspective
   Focus: critical thinking, communication, adaptability, and graduate readiness.\

Follow @UBIS CyberSecurity Careers in Australia

Search or Advertise with UBIS Cyber Jobs

Visit our website for more wwwubis.com.au

View Jobs Here

#CyberSecurityJobs #CyberWorkforce #CyberSecurityHiring #HRLeadership #RecruitmentStrategy #CyberTalent #CriticalThinking #AIWorkforce #CyberSkills #HiringManagers