Cybersecurity talent shortage in India: what employers are getting wrong

Every CISO in India has heard some version of the same complaint from the business: security hiring takes too long, and the candidates who do show up don't have the depth the role needs. New data from the Data Security Council of India (DSCI) confirms this isn't perception — it's structural.

According to DSCI's Indian Cyber Security Skilling Landscape Report 2025-2026, published in association with NASSCOM, 73% of enterprises and 68% of service providers report a limited availability of skilled cybersecurity candidates. This matters to every business leader, not just security teams, because 84% of organizations report that it takes between one and six months to fill cybersecurity roles — time during which systems run under-resourced and risk sits unmanaged.

For CHROs and CISOs building out security functions in 2026, the DSCI findings offer something rarer than another "talent crisis" headline: a structured breakdown of where the gap actually sits, and why the usual hiring playbook isn't closing it.

The hiring timeline problem

The DSCI data breaks down exactly how long cybersecurity hiring takes in India today:

• 44% of organizations fill roles in 1–3 months
• 40% take 3–6 months
• Only 3% manage to fill a cybersecurity role in under a month

That means the overwhelming majority of Indian employers are operating with open security roles for a full fiscal quarter or longer. For a CISO justifying headcount to the board, that's a hard number to defend — and it's precisely why organizations that treat cybersecurity hiring as a specialist search discipline, rather than a standard TA workflow, tend to close roles faster.

It's not a volume problem — it's a capability problem

The most useful part of the DSCI report is that it separates availability from capability. India isn't short on cybersecurity resumes. It's short on candidates who can actually do the work.

63% of enterprises and 59% of providers report limited hands-on practical skills among job candidates, while 53% of enterprises and 66% of providers report a lack of hands-on technical capability within their existing teams. Even more telling: 58% of enterprises and 60% of providers say they lack professionals with cross-domain capability — people who can move fluidly between cloud, application security, and identity systems rather than staying siloed in one discipline.

The constraint isn't a shortage of engineers — it's that security capability demand has compounded faster than real-world experience can be built. The shortage exists because demand has compounded, not grown linearly, while depth of experience still takes years to develop.

This has a direct implication for hiring managers: a job description asking for "5 years of experience across cloud, application, and identity security" is describing a rare, senior-level profile — not a mid-market SOC hire. Misaligned expectations are stretching timelines further than the skills gap alone would justify.

AI has made the gap worse, not better

Every conversation about AI in the workplace tends to assume it eases hiring pressure. In cybersecurity, DSCI's data shows the opposite is happening.

83% of organizations identify AI and GenAI security skills as a critical requirement, and 78% report high demand specifically for AI Security Engineers. At the same time, 62% of surveyed enterprises are running active AI and GenAI projects within their digital environments — which is itself expanding the attack surface these teams need to defend. The result: 57% of providers and 48% of enterprises report difficulty recruiting AI/ML security specialists, making it the single most constrained talent domain in the market.

In other words, the same AI adoption wave that's meant to boost productivity is simultaneously creating a brand-new hiring category — one where almost no experienced candidate pool exists yet in India.

The roles nobody can fill

DSCI's report ranks the specific roles enterprises and providers struggle most to hire for:

• Security Architects — difficulty reported by 49% of providers and 40% of enterprises
• OT/ICS security specialists — 41% of providers and 23% of enterprises
• Advanced threat intelligence professionals — 35% of organizations
• Cryptography and post-quantum security specialists — 30% of providers and 32% of enterprises

Security Architect standing at the top of this list is significant. It's a role that sits above individual tool expertise — architects need to understand business risk, system design, and regulatory exposure simultaneously. That combination is inherently scarce, and it doesn't respond well to volume hiring or job-board sourcing. It responds to targeted, relationship-led search.

Retention is bleeding the pipeline employers already built

Hiring difficulty is only half the story. DSCI's data shows retention is an equally serious drain: 70% of providers and 42% of enterprises report losing cybersecurity talent primarily because employees move to other organizations for higher salaries.

This creates a costly loop — organizations spend months filling a specialist role, invest in ramping that person up, and then lose them to a competing offer before the investment pays off. Notably, only 32% of providers and 8% of enterprises cite insufficient upskilling as a driver of attrition, which suggests compensation benchmarking, not just career development, is the sharper lever most employers are underusing.

What this means for hiring strategy

For HR and security leaders reading these numbers, three shifts stand out:

Stop hiring for tool lists; hire for cross-domain judgment. The gap isn't in candidates who know one platform — it's in people who can reason across cloud, identity, and application layers.

Treat AI security as its own emerging specialization, not an extension of existing security roles. The demand-supply mismatch here is currently the sharpest in the market.

Benchmark compensation before you benchmark job descriptions. With salary-driven attrition this high, a technically perfect hire who's underpaid relative to market will not stay.

Specialist recruitment partners who track compensation trends, map passive candidates in architecture and AI security roles, and understand the difference between resume-keyword matching and genuine cross-domain capability are increasingly the difference between a six-month vacancy and a strong hire in a competitive quarter.

FAQs