Cybersecurity: Global Talent Spotlight

Securing top talent for highly specialized cybersecurity roles has become more challenging than ever for both public and private sector employers. CBRE Consulting formulates talent-based location strategies for companies looking to leverage top talent in both established and emerging markets to help them combat costly cyber threats.

Over the past 10 years, the 115% increase in the U.S. cybersecurity workforce has not nearly kept pace with an 855% increase in job openings for these workers, according to labor analytics company Lightcast. This sizeable supply-and-demand imbalance creates challenges for employers when scaling their cybersecurity workforce, making a thoughtful location strategy essential to any employer seeking to hire and retain this type of talent.

The global cybersecurity industry is expected to grow to $270 billion in 2026 from $170 billion in 2020, requiring a corresponding increase in hiring that will be difficult to achieve in this already hyper-competitive talent market. Seventy percent of the almost 12,000 respondents to a recent International Information System Security Certification Consortium (ISC2) poll said they have a severe shortage of cybersecurity workers.

Figure 1: Top 5 Industry Sectors by Share of Global Cybersecurity Talent Pool, Q4 2023

Figure 2: Top 5 Industry Sectors by Cybersecurity Talent Growth Rate, Q4 2023

The software and information technology industry has the highest share of global cybersecurity talent with 34%, followed by higher education with 5% and banking and telecommunications—both with 3%. Nearly all industries currently employ cybersecurity talent. Sectors with the fastest annual cybersecurity talent growth include e-learning (+55%), non-profit (+50%), renewables & environment (+49%), automotive (+45%) and education (+43%). Many of these industries are rapidly adopting widespread online networks that require enhanced safeguards against cyber threats.

Figure 3: Country Share of Global Cybersecurity Talent Pool, Q4 2023

Just two countries—the U.S. and India—account for nearly half (48%) of the global cybersecurity talent pool. The other three of the top five countries for cybersecurity talent share account for just 13%.

Figure 4: Top 10 Global Cybersecurity Talent Markets (Metro Areas), Q4 2023

The Washington, D.C. metro area is the world’s top market for cybersecurity talent with a 5% global share. If it were a country, Washington, D.C. would be the world’s fourth largest for cybersecurity talent. This heavy concentration is largely attributable to the U.S. federal government and its many security and defense contractors. Other top metro markets are major technology and government centers, including New York, London, Paris, Bangalore and the San Francisco Bay Area.

Figure 5: Top 10 Countries for Cybersecurity Talent Pool Growth, Past 12 Months

While the largest cybersecurity talent pools tend to be in major global gateway markets and technology hubs, the countries with the fastest growing talent supply tend to be in developing economies in the Global South. Among countries with cybersecurity talent pools of more than 10,000, the top five for talent pool growth over the past 12 months were Brazil (+97%), Nigeria (+82%), Pakistan (+82%), Egypt (+76%) and Indonesia (+67%).

Other smaller countries with rapid talent growth rates include Costa Rica, Portugal, Sri Lanka and Peru. Many multinational companies have pivoted their hiring to these emerging markets amid the highly competitive environment in more mature markets. These companies are typically hiring talent to work remotely to realize substantial cost savings.

Figure 6: Ratio of Cybersecurity Talent Supply vs. Demand (Unique Job Postings), Q4 2023

The ratio of cybersecurity talent supply to demand (unique job postings) is a primary indicator of the hiring risk or competitive environment in any talent market. Many of the most competitive markets for cybersecurity talent are more established and mature markets in Asia and Europe. China and Japan, for example, are extremely favorable job markets for workers. Major European markets like Germany and France also have tight talent markets, as do lower cost European countries like Romania and Portugal. These markets are more likely to have increased talent attraction and retention risk that will likely lead to above average wage growth.

On the other hand, many emerging and fast-growing cybersecurity talent markets have less hiring risk due to fewer job openings. Two of the countries with the fastest rates of supply growth (Figure 5)—Nigeria and Bangladesh—also have among the lowest competitive risk. These markets have more employer-favorable labor conditions, making them more attractive for multinational companies to hire remote workers.

While the global supply of cybersecurity talent is growing rapidly, demand is increasing at an even faster pace. Many more companies are employing highly skilled workers who are dedicated to combating cybersecurity threats. The extremely tight cybersecurity talent markets means that companies must develop and implement talent-driven location strategies that go well beyond just the depth of a local talent pool. They must evaluate a growing number of factors that affect cybersecurity talent availability, including competition, cost and the operational environment’s alignment with each company’s broader business practices and objectives.

Latin America Cybersecurity Talent Spotlight

CBRE Expert Insights

“Latin America’s relevance as a source of talent in the Americas has been expanding due to its proximity to the United States and Canada as well as its fast-growing talent pool, cost-effectiveness, infrastructure and tax benefits. As a result, the region has become home to a significant number of multinational companies looking to prioritize the growth of their tech workforces, particularly in software development and cybersecurity. Sao Paulo and Mexico City remain the most scalable markets in the region, however, many emerging markets present opportunities for our global clients to be ‘first movers’ where they can drive cost savings and be positioned as preferred employers.”

Yazmin Ramirez, Director, Mexico City

“In recent years, Latin America has witnessed rapid development within its technology sector. This has come both by attracting new foreign investment and from homegrown start-ups. Cybersecurity has been a major component of this growth. The largest cyber talent clusters are in more established markets such as Sao Paulo, Mexico City, Buenos Aires, Bogota and San Jose. Other emerging locations like Recife and Medellin are growing quickly and offer employers even greater cost savings paired with strong employer of choice potential but with less scalability.”

Renata Piña Huesca, Manager, Mexico City

Asia Pacific Talent Spotlight

CBRE Expert Insights

“While the APAC region has been growing significantly, there continues to be a demand-supply mismatch. Advantages include lower costs and opportunities to hire from diverse talent pools. Countries such as Japan, India and China by virtue of their size are the largest talent markets. Unlike other regions, the bulk of the workforce is comprised of lateral movers across industries (through up-skilling) and fresh graduates.”

Udit Sabharwal, Labor Analytics Lead, Singapore

“Amidst the growing demand for cybersecurity talent driven by rapid digital transformation, the Asia Pacific region has seen growth in talent supply. Several markets in the region are seeing increased government and private sector investments aimed at supporting cyber education and training programs. This is driven by the rise in cyber threats, data breaches and localized data regulations. The state of maturity of the sector can vary significantly between markets. This in turn drives the need to identify the optimal markets to address a company’s unique needs.”

Lynette Lim, Labor Analytics Expert, Singapore

Europe-Middle East-Africa

CBRE Expert Insights

“Countries like France, the Netherlands, and Estonia have established cybersecurity hubs and centres of excellence, often with government backing, to foster innovation and skill development. Clusters of talent can be found in big metropolitan areas, as well as where government security offices are located, such as GCHQ in Cheltenham UK. International organisations also play a role. An example of this is the NATO Cooperative Cyber Defence Centre of Excellence located in Talinn, Estonia.”

Stephen Fleetwood, Head of Location Advisory, London

“Europe’s major hubs of cybersecurity expertise can be found in countries where both government and private sector initiatives foster a thriving community of experts, such as the UK, Ireland, the Netherlands and Germany. Academic institutions, such as Imperial College London and the Technical University of Munich, provide a steady pipeline of talent through specialized programs. Despite these strengths, the demand for cybersecurity professionals across Europe remains high.”

Lisa Steffen, Director, Munich