Canada’s Cybersecurity Hiring Market Is Recovering. Its Talent Pipeline Is Not.

Originally published in the

Cybersecurity hiring has reached a seven-quarter high, but employers are creating remarkably few entry points for the people they will need to become tomorrow’s experienced professionals.

For years, Canada’s cybersecurity workforce conversation has centred on a familiar problem: we do not have enough experienced people. Governments have invested in training, colleges and universities have expanded cybersecurity programs, certification pathways have multiplied, and employers continue to report difficulty finding qualified talent. Yet new labour market data suggests there may be another side to the problem. We may be contributing to the very shortage we keep trying to solve.

The Canadian Cybersecurity Network’s Q2 2026 labour market research identified 663 cybersecurity job postings during the quarter, the highest level across seven quarters of tracking and an increase of 23.7 per cent from Q1. Hiring has now increased for three consecutive quarters, providing increasingly credible evidence that the cybersecurity employment market is recovering from the weakness observed through much of 2025.

But buried underneath that recovery is a much more consequential number. Just 4.1 per cent of cybersecurity postings were classified as entry level or junior positions, while 68.2 per cent were mid-level. That imbalance gives us a signal worth paying attention to:

“Canada’s cybersecurity hiring market is recovering, but its talent pipeline is not.”

If this continues, Canada could find itself investing heavily in cybersecurity education and skills development while employers systematically underinvest in the first jobs that turn those skills into experienced professionals. That is not simply a hiring issue. It is a workforce development problem that could shape Canada's cybersecurity capacity for years.

The recovery is real, but the headline numbers need context

CCN’s analysis covers 4,977 job postings collected between October 2024 and June 2026, including 3,285 cybersecurity postings. Q2 produced 663 cybersecurity postings compared with 536 in Q1, extending the recovery for a third consecutive quarter.

Steve McMichael, whose research and analysis of Canadian Cybersecurity Jobs data helped underpin the report, sees the increase as encouraging, particularly as artificial intelligence expands both the opportunities and risks facing organizations.

“With the AI wave accelerating risk and opportunity at once, it’s encouraging to see growth in Canadian Cybersecurity Network job board postings: 663 in the second quarter, up 127 over the first and the strongest of our seven quarters, though some of that reflects broader collection rather than pure market growth. AI is expanding what every organization must defend, and boards are not treating security headcount as discretionary,” McMichael said.

TECHNATION sees the same trend extending well beyond traditional cybersecurity roles.

“The latest labour market trends suggest that cybersecurity is no longer a niche technical function but a core capability that organizations across every sector are investing in. As cyber threats to critical infrastructure, supply chains and digital services continue to grow, demand will increasingly extend beyond specialized technical roles to professionals who can integrate security into business operations, risk management and emerging technologies such as AI. Employers and policymakers should prioritize workforce development, AI enabled security tools and practical regulatory frameworks that help organizations of all sizes strengthen cyber resilience,” said Ulrike Bahr-Gedalia, Executive Vice President, Public Policy, TECHNATION.

That distinction is important. The 86.2 per cent increase from Q2 2025 is eye catching, but it should not be interpreted as a pure increase in employer demand. Q2 2025 was the weakest quarter in the dataset, the number of job boards being monitored has expanded, and postings represent advertisements rather than guaranteed unique positions.

The more meaningful development is therefore the direction and composition of demand. Approximately 77 per cent of observed cybersecurity hiring falls into two areas: Protection & Defense and Oversight & Governance. Organizations need people who can defend systems, detect threats, manage incidents and strengthen operational resilience, but they also increasingly need professionals who can govern cybersecurity risk, navigate regulatory expectations, manage third party exposure and demonstrate accountability to executives, boards, insurers and regulators.

That combination tells us something about how cybersecurity itself is changing. The labour market is increasingly reflecting a profession with two powerful centres of gravity: operational defence on one side and governance and accountability on the other. For business leaders deciding where to build capability, those are no longer separate conversations. Organizations increasingly need both.

The 4.1 per cent problem

The most important number in the report may be the smallest one. Entry level and junior positions represented just 4.1 per cent of observed cybersecurity postings in Q2, compared with 68.2 per cent for mid-level roles. There is nothing inherently surprising about employers preferring experienced candidates in a field where poor decisions can create significant financial, operational and reputational consequences. Many cybersecurity positions genuinely require judgement that develops through experience.

The problem is that experience must begin somewhere. A cybersecurity professional with five years of experience in 2031 needs an opportunity to acquire a first year of experience in 2026. If universities, colleges and training programs continue producing candidates while employers overwhelmingly compete for people who already have several years behind them, the pipeline inevitably narrows between education and employment.

That changes the way we should think about Canada's often discussed cybersecurity skills shortage. Some of the shortage is undoubtedly a supply problem, particularly in specialized areas where expertise is scarce. But the data raises another possibility: part of Canada's shortage may increasingly be a pipeline design problem. We cannot continuously demand experienced cybersecurity professionals while collectively creating too few opportunities for inexperienced professionals to become experienced.

The implications extend beyond individual job seekers. If junior hiring remains near current levels for several years, the effect eventually moves through the entire workforce. A thin junior market today becomes a thinner pool of mid-career professionals tomorrow and, eventually, fewer candidates for senior technical and leadership positions. By the time that shortage becomes obvious, correcting it will take years.

That challenge extends beyond hiring more people. It requires building clearer pathways into the profession and equipping the next generation with the skills employers increasingly need. Charles Finlay, Founding Executive Director of Rogers Cybersecure Catalyst at Toronto Metropolitan University, believes Canada's cybersecurity workforce has strong momentum but that sustained investment in early-career talent and AI skills will determine its long-term success.

"I'm encouraged that hiring is up; our industry is strong. But real challenges remain: We need to mark out rewarding career paths for early-career workers, and we need to drive AI skills across our industry. There's lots to be done, but there's no question that cybersecurity is one of the most exciting sectors out there," said Finlay.

The labour market data supports that optimism. It suggests opportunity is expanding beyond traditional technical roles and that Canada's future cybersecurity workforce may come from a much broader range of professional backgrounds.

There is another door into cybersecurity

There is an encouraging development inside the same data. Oversight & Governance represented approximately one quarter of cybersecurity demand in Q2, suggesting that governance, risk and compliance may become an increasingly important pathway into the profession.

Cybersecurity does not always have to begin with a computer science degree or years inside a security operations centre. Professionals working in audit, finance, privacy, compliance, law, enterprise risk and operations often possess skills that are increasingly valuable to modern cybersecurity. They understand controls, accountability, regulatory exposure, business processes and organizational decision making.

That matters as cybersecurity becomes more closely connected to enterprise risk, artificial intelligence, privacy, insurance, supply chains and corporate governance. Organizations increasingly need professionals who can translate technical risk into business decisions. For employers struggling to find experienced cybersecurity talent, part of the answer may therefore involve looking sideways rather than competing harder for the same limited pool of candidates.

It also creates a more realistic path for career changers. Relevant experience acquired elsewhere, combined with targeted cybersecurity knowledge, can expand the talent pool without lowering the standards required to manage serious risk.

The market is sending leaders other signals

Compensation and geography provide additional insight. Ontario represented 62.1 per cent of cybersecurity postings captured during the quarter, although Quebec is likely underrepresented because the underlying job sources skew toward English language postings. The concentration nevertheless reinforces how heavily cybersecurity employment remains centred in a relatively small number of Canadian markets.

Among postings that disclosed usable compensation, the median salary midpoint was $100,000 CAD. Yet only 28.1 per cent provided a usable salary range. In a market where employers regularly say cybersecurity talent is difficult to attract, greater salary transparency is one of the simplest ways to improve the candidate experience and differentiate an opportunity.

The skills data points in a similar direction. CISSP remains the most frequently mentioned security credential, while Azure and AWS feature prominently among technology requirements. The broader message is more important than any individual certification: security knowledge increasingly needs to coexist with cloud fluency, governance capability and an understanding of how businesses operate. The cybersecurity professional organizations need tomorrow may be broader than the technical specialist many still picture today.

Employers need to examine their side of the equation

For years, organizations have asked governments, universities and colleges to produce more cybersecurity talent. That remains important, but employers should now ask themselves a harder question: what are we doing to turn available talent into experienced talent?

That means examining whether supposedly junior positions carry unrealistic experience requirements and whether organizations provide enough internships, co-op placements and genuine early career roles. It also means developing people internally rather than assuming another employer will absorb the cost and risk of training them first. If every organization wants someone else to create experienced professionals, the mathematics of the labour market simply do not work.

Employers should also look more deliberately at adjacent talent. An experienced risk, privacy or audit professional who needs deeper cybersecurity knowledge may sometimes be a better investment than searching indefinitely for a candidate who perfectly matches a long list of requirements. Similarly, an early career professional with strong fundamentals can become considerably more valuable when given structured exposure to real environments, experienced mentors and progressively greater responsibility.

The objective is not to lower the bar. It is to build more deliberate pathways for people to reach it.

What happens next will tell us whether this is structural

One quarter does not establish a permanent shift, which is why the next several quarters matter. We should watch whether cybersecurity postings remain elevated as broader data collection normalizes, whether Protection & Defense and Oversight & Governance continue to dominate demand, and whether emerging AI security and governance work develops into a meaningful employment category.

Above all, we should keep watching that 4.1 per cent. If junior hiring begins to rise, the current imbalance may prove temporary. If it remains near this level for another year, it should be treated as an early warning about the future composition of Canada's cybersecurity workforce.

Other indicators will matter as well. Salary transparency, remote and hybrid work, and growing demand for professionals who can combine security, AI, governance and business risk could all reshape the market. But none changes the basic arithmetic of workforce development: experienced professionals can only exist if organizations create opportunities for people to acquire experience.

Canada cannot hire experience it never creates

Canada needs more cybersecurity professionals, and responsibility for building that workforce is shared among governments, educational institutions, industry associations and employers. Training matters, education matters and attracting experienced global talent matters. But none of those approaches can substitute for organizations creating opportunities where people acquire experience.

The strongest labour markets do not merely consume talent. They create it. If Canadian organizations continue competing intensely for experienced cybersecurity professionals while providing remarkably few opportunities for people to acquire that experience, part of the shortage becomes self-imposed.

The encouraging signal from Q2 is that cybersecurity hiring appears to be recovering. The warning inside that recovery is more important: hiring more people today does not necessarily mean we are building the workforce we will need tomorrow.

The number leaders should watch is no longer simply how many cybersecurity jobs Canada creates. It is how many of those jobs create cybersecurity professionals.

CCN thanks Steve McMichael and Evan Oseen for their research and analysis of data from Canadian Cybersecurity Jobs, Canada’s leading digital trust career platform, which provided the foundation for this article. Thank you as well to Charles Finlay, Founding Executive Director of Rogers Cybersecure Catalyst at Toronto Metropolitan University, and Ulrike Bahr Gedalia, Executive Vice President, Public Policy at TECHNATION andGerald Auger of Simply Cyber, for sharing their valuable insights and perspectives. You can find the full report here.