Cybersecurity Jobs: Demand vs. Layoffs

The headlines in 2024 and heading into 2025 have been dominated by “Tech Winter” narratives and major reduction in force (RIF) announcements from industry giants like Google, Amazon, and Microsoft. For Information Security (InfoSec) professionals, the picture is complex. While you operate within the tech sector, your role is distinct. Security is rarely a nice-to-have feature; it is a mandatory operational requirement. This article breaks down the friction between widespread tech layoffs and the persistent, critical shortage of cybersecurity talent.

The State of the Market: A Tale of Two Trends

To understand the current landscape, you have to look at two contradictory data points that are occurring simultaneously.

First, the broader tech pullback. Companies that over-hired during the pandemic have corrected course. We have seen widespread layoffs impacting sales, recruiting, and general software development roles.

Second, the relentless cyber threat landscape. Ransomware attacks, such as the high-profile incidents involving Change Healthcare and CDK Global, have forced boards of directors to double down on security spending. You cannot lay off the guards while the bank is being robbed.

The Workforce Gap Persists

According to the 2024 ISC2 Cybersecurity Workforce Study, the global cybersecurity workforce gap has reached a record high of 4.8 million professionals. This measures the difference between the number of skilled workers available and the number needed to secure organizations effectively.

Even as general IT roles face scrutiny, the demand for specialized security talent outstrips supply. Data from CyberSeek indicates that for every 100 cybersecurity job openings in the United States, there are only roughly 72 qualified candidates available to fill them. In contrast, general software engineering often sees a surplus of applicants per role.

Which Roles Are Safe? Which Are Vulnerable?

Not all cybersecurity jobs are insulated equally. The “demand” is not a blanket safety net for everyone. The market has shifted from hiring anyone with a pulse to hiring specific, high-value specialists.

High-Demand “Safe” Zones

These roles are currently seeing salary increases and aggressive headhunting, even amidst layoffs:

  • Cloud Security Architects: With organizations migrating to AWS, Azure, and Google Cloud, professionals who can secure hybrid environments are critical.
  • GRC (Governance, Risk, and Compliance) Specialists: New SEC regulations requiring public companies to disclose material cyber incidents have made GRC pros essential for legal survival.
  • Identity and Access Management (IAM) Engineers: As “Zero Trust” becomes the standard architecture, IAM is the new perimeter.
  • OT (Operational Technology) Security: Protecting critical infrastructure (energy, manufacturing, water) is a massive growth area where very few people have experience.

Vulnerable Positions

  • Entry-Level SOC Analysts (Tier 1): This is the area most threatened by automation and AI. Tools like Microsoft Security Copilot can now handle initial triage and log analysis that used to employ thousands of junior analysts.
  • Generalist “Cyber” Roles: If your resume lists a little bit of everything but no deep specialization, you are at higher risk. Companies are looking for specific problem solvers, not generalists.

Salary Expectations in the Current Climate

Despite the cooling in broader tech pay, cybersecurity retains a premium. According to recent data from the Bureau of Labor Statistics (BLS) and industry salary surveys from Robert Half, the financial outlook remains strong.

  • Information Security Analyst: The median pay hovers around $120,000 annually.
  • Security Architect: Senior roles frequently command $160,000 to $190,000.
  • CISO (Chief Information Security Officer): In major metro areas, total compensation packages often exceed $250,000 to $300,000.

However, the “signing bonus” culture of 2021 has cooled. While base salaries remain high, equity packages (RSUs) are being scrutinized more closely as stock valuations fluctuate.

Industries Hiring Outside of "Big Tech"

If you are worried about stability, you might want to look outside of Silicon Valley. The 2024 layoffs were heavily concentrated in pure-play software companies. Other sectors are aggressively hiring security talent because they are digitizing rapidly.

  1. Defense and Aerospace: Companies like Lockheed Martin, Raytheon, and Northrop Grumman have massive backlogs of work and strict government compliance requirements (CMMC). They offer high job security, though they often require security clearances.
  2. Healthcare: After the Change Healthcare ransomware attack, hospital networks and insurance providers like UnitedHealth Group are investing heavily to prevent the next catastrophe.
  3. Financial Services: Banks like JPMorgan Chase and Bank of America have cybersecurity budgets that rival the GDP of small nations. They rarely cut security staff because the financial risk of a breach is existential.

The Impact of AI on Job Security

Artificial Intelligence is the wildcard in the 2024⁄2025 job market. It acts as a double-edged sword for InfoSec professionals.

The Threat: AI is automating routine tasks. Writing scripts, parsing logs, and basic vulnerability scanning are becoming automated. This raises the bar for entry-level candidates. You can no longer rely on basic tasks to justify a salary.

The Opportunity: AI is creating new attack vectors. “Prompt injection,” “model poisoning,” and “deepfake social engineering” are new threats that require human defenders. We are seeing the rise of AI Security Engineers, a role that did not exist three years ago but now commands top-tier salaries.

Strategic Advice for 2025

To immunize your career against layoffs, you must move away from “ticket closing” and toward “risk reduction.”

  • Get Certified: The CISSP (Certified Information Systems Security Professional) remains the gold standard for management. For hands-on roles, the OSCP (Offensive Security Certified Professional) proves you have practical skills, not just book knowledge.
  • Learn Business Language: The security pros who get laid off are often the ones who say “no” to everything. The ones who get promoted are the ones who say “Yes, and here is how we do it securely.”
  • Focus on Hybrid Skills: A network engineer who knows Python is valuable. A compliance officer who understands Cloud architecture is unstoppable.

Frequently Asked Questions

Is there really a 0% unemployment rate in cybersecurity? No, this is a myth. While the unemployment rate is significantly lower than the national average (often cited around 1% to 2%), professionals do face layoffs. However, their time-to-hire for a new role is typically much shorter than in marketing or sales.

Are entry-level cybersecurity jobs disappearing? They are not disappearing, but the definition of “entry-level” is changing. Employers now expect “entry-level” candidates to have internships, certifications (like Security+), and hands-on lab experience. The days of getting hired with zero experience are largely over.

Should I be worried about AI replacing my security job? AI will likely replace tasks, not entire jobs, for mid-to-senior professionals. It will act as a force multiplier. However, if your primary job function is monitoring a dashboard and clicking “resolve” on low-level alerts, you are at risk. You need to upskill into engineering, architecture, or threat hunting.

Do I need a degree to survive a layoff cycle? Experience generally trumps degrees in cybersecurity. However, during a tight labor market, HR filters may become stricter. A Bachelor’s degree helps pass automated HR screens, but a portfolio of projects and high-level certifications (CISSP, CISM) are often more valuable to the hiring manager.