The Next Generation of Cybersecurity Experts: Skills and Pathways

Ask a UK security leader what worries them most, and the answer is rarely a new strain of malware. It’s finding people. The next generation of cybersecurity professionals is arriving in a market that looks healthy on paper. In reality, it offers fewer genuine entry points, tougher regulation, and rising expectations around AI.

This guide uses the latest UK and Irish data to show what that generation needs to know and how employers can bring them in. We’ll cover the skills that matter now, the new laws reshaping security roles, and routes that don’t depend on a degree. We’ll also look at why experienced staff are burning out, and set out a practical hiring blueprint for security leaders.

What Defines the Next Generation of Cybersecurity Professionals?

Next-generation cybersecurity professionals combine hands-on technical skill with AI fluency, cloud and identity knowledge, and the ability to explain risk in plain business terms. They’re hired for what they can demonstrably do rather than years served, and they work under a tightening UK and Irish regulatory regime.

In practice, five capabilities set them apart:

• AI-assisted security operations: using AI tools to sort alerts, while knowing how to test and audit AI systems themselves.
• Cloud and identity-first defence: securing users, devices and workloads wherever they sit, not just inside an office network.
• Threat intelligence and open-source research: understanding who is likely to attack, why and how.
• Governance, risk and compliance: turning legal duties into working controls and clear written reports.
• Incident response under pressure: staying calm, keeping records and communicating well when things go wrong.

None of these replaces core networking and systems knowledge. They sit on top of it. The rest of this guide explains how the job market and the law are shaping each one.

The UK and Ireland Cyber Workforce in Numbers

Headline claims about a global shortage of millions tell UK readers very little. National data gives a more useful picture: a workforce that keeps growing, while specific skills stay stubbornly hard to find.

More People, Same Gaps

The Department for Science, Innovation and Technology’s Cyber Security Skills in the UK Labour Market 2025 report was published in September 2025. It estimated that around 143,000 people worked in cybersecurity roles across the UK economy. That was 5% more than the year before. The annual workforce gap stabilised at about 3,800 people, well down from 11,100 in the 2023 report.

The shortfall hasn’t vanished, though. It has moved. Around half of UK businesses (49%) reported a basic technical skills gap, such as setting up firewalls or detecting malware. Another 30% had gaps in advanced areas like penetration testing and forensic analysis. Charities and small firms were hit hardest. For a sector-by-sector look at what drives these figures, our breakdown of the cybersecurity skills gap in the UK goes into more detail.

The Entry-Level Experience Paradox

Here’s the uncomfortable part. The same DSIT report counted 32,370 core cyber job postings across the UK, a 33% fall on the previous year. Graduate numbers kept climbing all the while. Recruiters describe demand clustered around mid-career, hands-on specialists, which leaves newcomers chasing a small pool of junior roles that still ask for prior commercial experience.

ISC2’s 2025 Cybersecurity Workforce Study shows how narrow the traditional route remains. Some 56% of respondents entered the field through IT, while just 3% came in through an internship or apprenticeship. Among under-30s, the picture is shifting, with 38% arriving through routes other than IT or a cyber degree. That younger cohort of cybersecurity professionals is far more varied than most hiring filters assume.

Ireland and Northern Ireland

Across the island of Ireland, research commissioned by Cyber Ireland and NI Cyber in 2025 identified 632 cybersecurity firms employing around 10,659 people. Recruitment pressure is real here too. Eurostat’s 2024 survey on cyber skills found that almost one in four Irish companies (24%) had difficulty hiring staff with cybersecurity skills.

Firms on either side of the border that serve both UK and EU customers need staff who understand two regulatory regimes. That leads straight into the biggest change to security job descriptions in years.

How New Laws Are Rewriting Security Job Descriptions

Regulation used to sit with legal and compliance teams. New reporting deadlines are pushing it onto the desks of junior analysts and on-call engineers, and that changes what employers look for when they hire.

The Cyber Security and Resilience Bill

The Cyber Security and Resilience (Network and Information Systems) Bill updates the UK’s 2018 NIS Regulations. It cleared the House of Commons in June 2026 and finished its Lords committee stage in September 2026. It had not received Royal Assent at the time of writing. Once it’s in force, in-scope organisations must notify a significant incident within 24 hours. A fuller report must follow within 72 hours. Managed service providers and data centres come into scope for the first time.

For cybersecurity professionals, that 24-hour clock changes daily work. Someone on call at 2 am needs the judgement to decide an incident is reportable. They also need the logs to back that decision up and the writing skills to explain it to a regulator. Readiness for statutory incident reporting is becoming an entry-level skill rather than a senior one. Teams building those habits from scratch will find our guide to workplace cybersecurity a useful starting point for logging and staff reporting.

NIS2 and Cross-Border Teams

In the EU, the NIS2 Directive sets similar expectations for essential entities, including accountability for supply chain security. Ireland’s National Cyber Security Bill, which will give NIS2 effect in Irish law, had not been enacted when this article was written.

Security staff at firms serving both markets increasingly need to map a single incident against two sets of rules. Being able to do that confidently is a practical advantage for anyone job hunting in Belfast, Dublin or Cork.

The Skills Next-Generation Cybersecurity Professionals Need

The job has moved from guarding a network perimeter to protecting identities, data and AI systems spread across cloud services. The table below contrasts the older analyst profile with what employers increasingly expect now.

Discipline	Older analyst profile	Next-generation profile
Perimeter	Firewalls around an office network	Zero Trust and identity-first controls across cloud and remote users
Monitoring	Manual log review in a SIEM	AI-assisted triage with human judgement on escalation
Automation	Occasional scripting	Python and infrastructure-as-code checks as routine work
Communication	Technical reports written for IT	Plain-English risk briefings for boards and regulators
Proof of skill	Degree and years of service	Labs, capture-the-flag results, portfolios and professional registration

Each row describes a skill set rather than a job title, so one person may move across several of them over a career.

AI Literacy on Both Sides

AI has become a daily tool rather than a talking point. DSIT found that 53% of UK cybersecurity businesses used AI in their day-to-day operations, and 65% expected demand for AI skills to grow. Yet only 42% had given staff any AI training. CIISec’s most recent State of the Security Profession report found that 54% of respondents believe criminals will gain more from AI than defenders will.

The useful skill isn’t simply asking a chatbot to draft a detection rule. It’s knowing when the output is wrong, and how to test AI systems for prompt injection, data leakage and model abuse. ISC2 found that 22% of respondents are already learning how to audit the security and integrity of AI systems. Some 73% expect AI to create demand for more specialised skills.

Cloud and Identity-First Defence

With staff, data and applications spread across cloud platforms, the office network is no longer the main boundary to defend. Among ISC2 respondents focused on cloud skills, half (50%) named cloud architecture and secure design as the top need. Platform and infrastructure security followed at 41%. Identity and access management came up for 35%.

For newcomers, that points to learning how identity providers, conditional access, and least-privilege permissions work. It also means spotting risky settings in infrastructure-as-code templates before they go live. Knowing the types of hackers who hunt for these weaknesses, from opportunists to state-backed groups, explains why small misconfigurations matter so much.

Translating Risk Into Business Language

Technical skill gets you shortlisted. Communication gets you hired. In ISC2’s study, the top five skills hiring managers prioritised were all non-technical. They were problem-solving (29%), collaboration (24%), communication (22%), willingness to learn (20%) and strategic thinking (16%).

The best junior analysts can brief a finance director in two minutes without jargon. They say what happened, what it could cost, and which decision is needed. Our list of key cyber definitions is a handy reference for anyone practising that kind of translation.

Routes Into Cybersecurity Beyond a Degree

A computing degree is one way in, but treating it as the only way shuts out capable people and does nothing for security. The UK now has formal ways to recognise skills gained through apprenticeships, bootcamps, self-study and career changes.

Professional Registration Through the UK Cyber Security Council

The UK Cyber Security Council received its Royal Charter in 2022 and holds the UK Cyber Security Professional Register. In April 2026 it made the Associate Cyber Security Professional title a permanent option. The title is aimed at people ready for, or working in, their first cybersecurity role. Council chief executive Giles Grant said many people with the right skills “struggle to prove it to employers”. The Associate title was designed to tackle exactly that. Title holders must complete 75 hours of continuing professional development over three years to stay on the register.

Title	Post-nominal	Typical career stage
Associate	ACSP	Building knowledge and experience, often under supervision
Practitioner	PraCSP	Applying skills independently and effectively
Principal	PriCSP	Leading teams, projects or specialist work
Chartered	ChCSP	Influencing organisations, standards and the wider profession

Registration sits alongside certifications rather than replacing them. What it adds is one shared benchmark for cybersecurity professionals who arrived by very different paths.

CyberFirst, Apprenticeships and Student SOCs

The National Cyber Security Centre’s CyberFirst programme reaches young people well before university. It includes school activities, a girls’ competition, a university bursary with paid summer placements and a degree apprenticeship. In England, the Level 4 Cyber Security Technologist and Level 6 Cyber Security Technical Professional apprenticeships let learners earn while they train.

Apprenticeships remain a small route, but the people who take them rate them highly. In ISC2’s study, 69% of those who entered through an internship or apprenticeship would recommend that path, the highest rate of any entry route. Some universities go further by running student security operations centres, where learners monitor live networks under supervision before they graduate.

Proof of Skill Without a Job Title

For self-taught candidates and career changers, a portfolio does the job a CV can’t. A practical 90-day portfolio could include:

• A documented home lab with a small network, a firewall, and a free SIEM, written up so someone else could rebuild it.
• Completed challenges on platforms such as TryHackMe or Hack The Box, with short notes on what you learned from each.
• A public GitHub repository holding one or two small security scripts, such as a log parser or phishing URL checker.
• A written post-incident review of a public breach, explaining causes, impact, and lessons in plain English.
• An entry-level certification, followed by the Associate title once you’re eligible.

Five items done well will impress a hiring manager far more than twenty half-finished online courses.

Burnout Is a Leadership Problem

You can’t close a skills gap while experienced people are quietly heading for the exit. Stress among cybersecurity professionals is well documented, and most of its causes sit with how teams are run rather than with the individuals themselves.

What the Data Says About Stress

CIISec’s 2023/24 survey found that 55% of security professionals were kept awake at night by work stress, and 22% were classed as overworked. ISC2’s global study paints a similar picture. Some 47% of the cybersecurity professionals it surveyed often felt overwhelmed by their workload. Another 48% felt exhausted trying to keep up with new threats and technologies.

Loyalty to employers is fragile too. While 75% of ISC2 respondents expected to stay with their current organisation for the next year, that fell to 66% over a two-year horizon. Every departure takes knowledge with it and piles more work onto whoever is left behind.

Practical Fixes for Security Operations Leaders

Burnout among cybersecurity professionals is often treated as a personal resilience issue. It’s better understood as a design flaw in how alerts, rotas and blame are handled. Leaders can make a real difference with a few changes:

• Tune detection rules and use automation to cut low-value alerts before they reach a person.
• Phase junior analysts onto the on-call rota gradually across their first six months.
• Protect a few hours a week for research and training, so learning isn’t squeezed into evenings.
• Run blameless post-incident reviews that focus on fixing processes, not assigning individual fault.
• Track overtime and out-of-hours call-outs as a team health measure, not just a cost line.

None of these cost much. Each one tells your team that their wellbeing is part of your security plan.

A Hiring Blueprint for Security Leaders

If the pipeline is narrow, part of the fix sits with hiring managers. Changing how you assess candidates, and who you consider, widens the pool faster than waiting for the market to change on its own.

Swap CV Filters for Practical Tests

A skills-based funnel shows you what candidates can actually do. One workable approach has four stages:

1. Aptitude and logic screening, which tests reasoning without assuming previous job titles.
2. A short virtual lab or capture-the-flag challenge completed within a set time.
3. A risk translation exercise, where the candidate explains a technical finding to a non-technical manager.
4. A structured apprenticeship or mentored first six months for everyone you hire.

This model pairs well with the Associate title, which the Council introduced partly to give employers more confidence when recruiting for entry-level roles.

Cross-Skill Staff and Widen the Pool

Your next analyst may already work for you. ISC2 found that 22% of organisations are cross-training employees from outside the security team to cover skills shortages. People from IT support, software testing and development often bring strong troubleshooting habits, and turning them into cybersecurity professionals can be quicker than external hiring.

Diversity is the other underused source of talent. Women made up just 17% of the UK cybersecurity workforce in DSIT’s 2025 report, falling to 12% in senior positions. Across the wider UK workforce, the figure is 48%. The government has announced a TechFirst skills programme in response. It aims for a significant rise in the number of women, ethnic minorities and disabled people in cyber roles by 2029. Clear job adverts, flexible working and returner schemes all help. For boards that still need convincing, our explainer on why cybersecurity matters sets out the business case plainly.

The next generation of cybersecurity professionals will be shaped as much by employers and lawmakers as by the candidates themselves. Some organisations will test for skill, train the people they already have and protect their teams from burnout. Those employers will be far better placed to hire cybersecurity professionals when the new reporting duties arrive.

Do you work in security, train new analysts or want to break into the field? Tell us in the comments what has helped you most, or what’s getting in the way. Your experience helps us keep this guide useful for the next wave of people starting out.

Frequently Asked Questions

These short answers cover the questions people search for most often when researching cybersecurity careers and where the profession is heading.