Record headcount, closed entry: the cybersecurity job market is splitting in two

Part one of a three-part series for working practitioners. The number of people doing this work is at or near a record, and joblessness among technology workers runs below the national average. Yet newcomers send out two hundred applications and hear nothing back. Both pictures are real, and the gap between them is why the market stopped making sense to the people living in it. Here is what is happening, and what the last two technology busts say about whether the door reopens.

Two stories about the cybersecurity job market are going around, and on the face of it they cannot both be true. The first is the one the industry has told for a decade: that it is desperate for people, with a shortage figure everyone learned to quote, a field sold to a generation as the safest bet in technology. The second is the one you hear from everyone trying to get in, or to move up: the home lab built on weekends, the certification earned at night, two hundred applications sent, and silence on the other end. Both describe the same labor market. Working out how they can both be true is worth an hour of your time before betting on a career move in the next two years, and it is the work of this series.

The short answer is that the field is dividing, not shrinking. By one measure, the count of heads, employment has never been higher and is still climbing. By the measure that matters to a newcomer, the door has narrowed to a crack. The whole is healthy; the distribution is not. Almost all of the fear, and nearly all of the bad advice, lives in the gap between those two facts.

A word about the numbers, before we use any

There is a fair objection to raise before we go further, and it deserves an honest answer rather than a footnote. Why trust government data at all right now? The federal statistical agencies are under visible political pressure. The head of the Bureau of Labor Statistics was fired in 2025 after a weak jobs report the administration called "rigged," with no evidence offered. The agency's budget has been cut in real terms for years, some inflation prices have gone uncollected for lack of staff, and the survey behind the unemployment rate has had thousands of households dropped from its sample. The monthly payroll figures now get revised by enormous margins after the fact. If you have the sense that the official numbers are shakier than they used to be, you are right.

So this article does two things with that. It does not pretend a single government number settles anything, and it does not lean on one. Every load-bearing claim here is checked against private hiring data that has no political master: CompTIA, Indeed, Robert Half, the industry's own workforce surveys. When the federal series and the private trackers point the same way, the conclusion does not depend on trusting any one source. And where the government figure is the politically sensitive one, note which it is: nobody fires a commissioner over the obscure occupational series for information-security analysts. The heat is all on the headline monthly payrolls. A fifteen-year trend in a niche occupation is a far more robust thing than a single embarrassing print.

One more honesty, because it matters more than any of this. "Employment is at a record" can read like a lie to someone whose rent has outrun their raise and whose feed is a wall of layoffs. It is not meant to. A healthy headcount is not a healthy life, and the official numbers have a way of reporting prosperity that working people are not living: real pay has been slipping, and the headline unemployment rate can fall for the grim reason that people stop being counted rather than the good one that they found work. That squeeze is real, and Tuesday's piece takes the measurement apart in full. Hold the distinction in mind here: the question this article asks is narrow, whether the cyber field is shrinking and whether the way into it is closing, and the answer to that does not depend on trusting any rosy macro number. The cost-of-living crush and the state of the cyber field are both true at once. This article keeps them apart so neither hides the other.

The number that should settle one argument

Start with the simplest question: is the field shrinking? It is not. The U.S. Bureau of Labor Statistics has counted "information security analysts" as a distinct occupation since 2011, and in its household survey the number of people working full-time in that role rose from 45,000 in 2011 to a record 251,000 in 2025. In fifteen years it has fallen exactly once, in 2018, and stood still exactly once, in 2020. Then came the years everyone remembers as brutal: 2022 to 2025, mass tech layoffs, "the market is dead" on every forum. Over exactly that stretch the occupation grew from 156,000 to 251,000, a 60% jump in the years the field was supposedly falling apart. This one series does not capture the whole cybersecurity labor market, which also runs through governance, legal, engineering, product security, and management. But it is the longest-running federal count of the occupation's core, and the right place to test whether the field is shrinking.

One caution, since the trade press mangles this constantly. That household survey is a different instrument from the BLS establishment survey, which counts payroll jobs formally coded to the occupation and put the number nearer 183,000 in 2024, against the household survey's 232,000 for the same year. The roughly 50,000-person gap is not an error; it is the predictable difference between people who call themselves security analysts and the payroll slots coded as such. Use one for the trend and the other for the level, and don't let anyone wave a single number around as proof of anything. Either way, the line goes up.

The second number that cuts against the panic is unemployment. Among people already working in technology, security included, joblessness has run between roughly 3% and 4% from late 2025 into 2026, below the national rate of 4.3% to 4.4% in every one of those months. That technology figure comes from CompTIA's analysis, not the government, which is the point: the private read and the federal read agree. For degreed professionals the rate sat at 2.8% this spring on Robert Half's count, and recruiters call them the most sought-after hires on the market. What that means, given the data covers technology broadly and not security alone, is that if you already hold a technology or security job, you are less likely than the average American to be out of work against your will. The same was true through the dot-com bust and the crash of 2008, as we will see.

So the field is not dying, and the people in it are mostly not out of work. The distress is real all the same. It is just landing somewhere the headline numbers never look.

Where the pain really is

First, job postings. They have fallen hard from the bubble peak: indexed against early 2020, U.S. security postings topped out in January 2022 and sat about 36% below that high by early 2026, on Indeed's tracker. There is a comparison that softens it. Over the same window, software development, IT systems, and data and analytics all dropped below their pre-pandemic levels, while security stayed above its own, the only major tech category still posting above where it began the decade. But "less bad than software development" is cold comfort at eleven at night, refreshing a job board that has nothing for you.

Second, and this is the real crisis, the one the big numbers hide completely: the entry tier is closing, and a clear majority of open roles want mid-level or senior people. Behind that is the two-hundred-application story you can find on any practitioner forum: people who did exactly what the careers-advice industry told them to do, checked every box they were handed, and hit a wall. The competition at the bottom is ferocious at the very moment the headlines promise abundance.

Third, the field is losing people from the top while the bottom stays dry. Set layoffs aside entirely and burnout and attrition still run high; a real share of practitioners say they are thinking about leaving the field for good. An organization that struggles to keep its seniors and will not hire its juniors will look permanently short-staffed no matter how many people are on its payroll.

The shortage and the rejection are the same market

Start with that shortage figure. It was never a count of open jobs. It measured a perceived staffing need, the gap between how many people surveyed organizations say they need and how many they have, added up across the world. Used as a pile of vacancies waiting to be filled, which is how it usually traveled, it helped sell a decade of hopefuls a field with the door wide open. And the objections were not only the quiet kind: in a late-2024 open letter, the practitioner Ira Winkler accused ISC2 of pushing "a false narrative of a plentiful job market." The charge was polemical, but it named what a lot of job-seekers had already concluded for themselves: the number had drifted away from the market they were living in. The most-quoted figure in cybersecurity had become too blunt an instrument for the market it was meant to explain.

None of this means the divide is imaginary. Take the headline number away and it is still there in the harder evidence: postings down from their peak, an entry-level door that has all but closed.

And here is the cruel joke at the center of it: whatever real shortage those surveys were circling, it was never at the entry level. The people the market is short of can architect cloud controls, build detections instead of just watching them, run an incident for real rather than a tabletop drill, and reason about regulatory and supply-chain risk. The people flooding in are hoping for their first alert-triage seat. The two barely overlap. The experienced people any shortage points to are, almost by definition, already employed and not looking. The real scarcity is proven senior capability; the glut is unproven enthusiasm; and the single number that averaged the two, the one so many people took as a promise, described neither.

So a real scarcity at the top and a real glut at the bottom sat beneath one badly used number, both true the whole time. Figuring out which end of that divide you are standing on is worth more than almost everything else being written about this market.

When was it like this before?

If you want a clean precedent, there isn't one. Cybersecurity as a distinct occupation has never been here before. It has only existed in the official statistics since 2011; in that time its employment has fallen exactly once, and it has never weathered a sustained technology downturn as a grown-up, separately counted profession. The two-month pandemic recession of early 2020 was too brief and too distorted by policy to teach us much. This is its first real test.

So we borrow the precedents from the wider technology labor market, which has been through this twice. They fit because back then security was not its own category yet; it lived inside IT, and IT's story is the closest thing to a map we have.

The dot-com bust of 2001 to 2004 is the better guide, because, like now, it was a bubble deflating, not a financial system seizing up. After the Nasdaq peaked and crashed, tech employment fell hard: the sector shed nearly a fifth of its workforce between the 2001 peak and the 2004 trough. IT unemployment, which had sat near 1% in the late 1990s, climbed to roughly 6% by 2003. And yet even at that worst point, tech unemployment never reached the national rate. Technology workers, then as now, came through their own bad year in better shape than the workforce came through the same one. Within the decade, employment recovered and passed its bubble peak.

The 2008 recession was a financial crisis, not a sector bubble, and it hit tech more gently than it hit the rest of the economy. It points the same way: across both the 2001 and the 2007-to-2009 downturns, unemployment for technical workers never once climbed above the rate for the workforce as a whole. It rose in the bad years, but it always stayed under the national line.

So the two busts rhyme, and for technology labor markets as a whole that is reassuring. A bubble or a shock inflates expectations. The correction roughly doubles tech unemployment off a very low base. Joblessness stays under the national rate the whole way through. And within a few years employment climbs back past its old peak. The current reading, tech-occupation unemployment in the 3-to-4% band against a national 4.3 to 4.4%, fits that part of the old pattern.

Will it recover?

Judged on the cycle alone, the answer is yes. The underlying demand has not gone anywhere: the official projection has the occupation growing about 29% between 2024 and 2034, against roughly 3% for jobs overall, and history says the cyclical part of any slump rights itself within a few years.

But you have to split the question in two, and this is where the series turns. The field will recover. The old on-ramp may not. This downturn carries something the dot-com and 2008 corrections did not: a structural change that will not reverse when the economy does. When dot-com demand came back, the work came back with it, in much the same shape, because nothing had fundamentally remade it. There is no reason to expect the entry-level job to come back in its old shape now, because the work it was made of is being absorbed by software, not paused by a slump. That is what part two is about.

One market, split in two

So take the panic seriously, but do not let it lie to you. The cybersecurity job market is not collapsing; it is dividing, and that division explains nearly everything. Employment is at or near a record, the people already in technology are mostly not out of work, and the field has strong reasons to keep growing. And at the same time, the entry tier has narrowed to a crack and the celebrated shortage turns out to be a shortage of proven capability, not bodies. The whiplash a newcomer feels, desperate demand on one side and dead silence on the other, comes from one market that has split in two.

Most of what feels like an unprecedented collapse is, on the cyclical side, an ordinary tech correction of the kind that has twice ended in recovery. What is new is structural, and it is remaking the bottom of the field even as the top keeps hiring. Part two pulls that apart: the three forces bearing down on cybersecurity at once, and where they are pushing it over the next two years.

There is a thread worth carrying with you into the rest of the week. If the market has split into proven capability that gets hired and unproven hope that does not, then the old advice, collect the credentials and wait to be recognized, is answering the wrong question. The useful question now is how to prove you can do the work. That is where this series is headed.

Source notes

U.S. Bureau of Labor Statistics, Current Population Survey, Employed full-time, information security analysts (series LEU0257861000A, 2011–2025), via FRED, Federal Reserve Bank of St. Louis; and BLS Occupational Outlook Handbook and Occupational Employment and Wage Statistics (establishment count ~182,800 in 2024; ~29% projected growth, 2024–2034, against ~3% for all occupations).

On the reliability of federal data: the August 2025 firing of the BLS Commissioner after a disputed jobs report; multi-year real-terms budget cuts and sample reductions at BLS; and large benchmark and monthly revisions to payroll employment (BLS Current Employment Statistics, 2026). The article relies on private corroboration for this reason.

CompTIA Tech Jobs Report, analysis of BLS data (technology-occupation unemployment ~3.3–4.0% across late 2025–early 2026, below the national rate); Robert Half, April 2026 jobs report (degreed-professional unemployment 2.8%); U.S. BLS Employment Situation, April 2026 (national unemployment 4.3%).

Indeed Hiring Lab job-postings tracker (U.S. security postings ~36% below the January 2022 peak but above the February 2020 baseline; the only major technology category still above baseline).

Ira Winkler, open letter to the ISC2 Board, October 2024, criticizing the workforce-gap messaging for implying a far more open job market than the data supported (as reported by Infosecurity Magazine).

Dot-com and 2008 analogs: Federal Reserve Bank of St. Louis (technology-sector workforce down ~17.8% from 2001 peak to 2004 trough; recovery within the decade); Commission on Professionals in Science and Technology (IT-worker unemployment ~6% in 2003, ~1.2% in 1997); Bay Area Council Economic Institute (technical-occupation unemployment never exceeded the national rate across the 2001 and 2007–2009 recessions).

National Bureau of Economic Research, business-cycle chronology (the COVID recession dated February to April 2020, the shortest U.S. recession on record).

Aramis assesses cybersecurity candidates against NICE Framework Work Roles. This is the first of a three-part series, with an epilogue, on the divided job market and what to do about it; part two examines the forces driving the split, and part three turns to the decisions a practitioner has to make.

P.S. The series prologue, "Cyber's Career Chasm," is here: https://www.linkedin.com/pulse/cybers-career-chasm-project-aramis-dkuoc. Subscribe to Skill:Signal:Trust for each morning's edition, and follow Aramis on LinkedIn for the full series.