Insights from 200 quarterly conversations with security professionals reveal what really drives career moves in cyber security – and it is rarely what employers assume.
← Back to Insights
“I’m not actively looking, but if the right thing came along…”
We hear that sentence, almost word for word, probably fifteen times a week. It’s become the default opener for security professionals in 2026. Nobody says they’re job hunting. Everybody says they’d listen.
That gap between “not looking” and “would listen” is where most of the market actually lives. And what people say in that gap, when they’re being honest with a recruiter rather than polished with a hiring manager, tells you more about the state of cyber security hiring than any salary survey.
We speak to roughly 200 security professionals every quarter. Not applicants responding to job ads. People in roles, doing work, making decisions about whether to stay or go. Here’s what we’re hearing right now.
This is the one that keeps coming up. A security professional was hired to do one thing, whether that’s building out a SOC, leading an OT security programme, or running vulnerability management, and twelve months later they’re spending half their time on compliance paperwork, vendor management, or explaining to the board why the budget they were promised isn’t coming.
It’s not that these people can’t do the broader work. It’s that they were hired on a specific promise, and the promise shifted. The frustration isn’t about workload. It’s about feeling misled.
If you’re a hiring manager reading this: the biggest retention risk in your security team right now probably isn’t salary. It’s the distance between what someone was told the role would be and what it actually is eighteen months in.
Nobody’s leaving a role they love for an extra £8k. That was true two years ago and it’s true now. But something has shifted in how candidates talk about compensation.
What we’re hearing more of: “I found out what the contractor sitting next to me is earning.” That conversation – the one where a permanent employee discovers the day-rate equivalent of what the interim beside them takes home – is behind more market activity than any recruiter outreach.
In OT security and GRC, the contractor market has pulled away from permanent salaries significantly. We’re seeing day rates of £650–£800 for OT security consultants. A permanent OT Security Engineer on £85k does the maths and starts asking questions. Not necessarily about going contract. But about whether their employer values them at the right level.
The organisations that are handling this well aren’t necessarily paying more. They’re being transparent about why permanent compensation looks different from contract, and what the trade-off actually includes. The ones losing people are the ones pretending the gap doesn’t exist.
Here’s something we didn’t expect to be talking about this much: security clearance as a retention problem.
Candidates with active DV clearance know exactly what that clearance is worth. They also know that once they leave a cleared role, the clock starts ticking on their clearance lapsing. That creates a strange dynamic where people stay in roles they’ve outgrown because the clearance is too valuable to risk, and employers assume loyalty when really it’s lock-in.
We’re speaking to DV-cleared professionals who haven’t updated their CVs in years. Not because they’re happy, but because the perceived cost of moving is too high. When they finally do move, it tends to be abrupt. No long courtship, no pipeline. They make a decision and execute it inside a couple of weeks.
If you’re building a team that requires cleared staff, you probably have less visibility on your retention risk than you think. The people most likely to leave are the ones who seem least likely to.
This comes up constantly with mid-senior candidates. They want roles where they’re building a capability, not managing a steady state. The appeal of a greenfield security function, or a new OT security programme, or a SOC build-out from scratch is enormous. Often disproportionate to the salary on offer.
We’ve seen candidates take lateral moves or even slight pay cuts to join organisations where they get to build. The pull of “you’ll be the first dedicated security hire” or “we need someone to design this from the ground up” is real.
The flip side is that once something is built, those same people get restless. If you hired a builder and the building is done, don’t be surprised when they start looking at the next construction site. That’s not disloyalty. It’s who they are.
The thing we notice most isn’t a specific complaint. It’s an absence. Almost nobody we speak to talks about their employer’s mission or purpose as a reason to stay. Five years ago, especially in CNI, “critical national infrastructure” was a genuine draw. People wanted to protect things that mattered.
That still resonates in interviews and on paper. But in candid conversations about why someone is thinking about leaving? It rarely comes up. The reasons are almost always practical: progression, compensation, the quality of the team around them, and whether the role matches what they signed up for.
That might be uncomfortable if you’ve built your employer brand around mission. It doesn’t mean mission doesn’t matter. It means it’s not enough on its own. It gets people interested. It doesn’t keep them.
We’re not going to wrap this up with a ten-point action plan. But there are two things worth sitting with.
First, the market is moving even though it doesn’t look like it’s moving. Most of the activity is invisible – passive candidates having quiet conversations, doing the maths on contractor rates, weighing up whether their clearance is an asset or a chain. By the time someone updates their LinkedIn headline, the decision was made months ago.
Second, the gap between what organisations think their people care about and what those people actually tell us is wider than it’s been in years. That’s not a criticism. It’s an observation from the only vantage point where people are genuinely candid – talking to a recruiter, off the record, about what they’d move for.
If you’d like to know what we’re hearing specifically in your sector or at your level, that’s a conversation worth having.
Counteroffers solve the wrong problem almost every time. Here is what candidates and employers both get wrong – and the conversation that should happen instead.
After reviewing hundreds of cyber security CVs, five career decisions consistently separate future CISOs and Heads of Security from those who plateau at mid-level.
Trusted by security leaders at
"I can't recommend Gyles and the team at Foundations enough. We struggled to find a suitable candidate for 5 months, Foundations found 3 perfect candidates in 24 hours."
Manager of EMEA & APAC Network Engineering, Equinix
