Water companies face the toughest cyber security recruitment challenge in UK CNI. Salary constraints, remote sites, and rising regulation create a hiring gap that is getting worse.
← Back to Insights
Ask most people which CNI sector struggles most with cyber security recruitment and they’ll say defence or nuclear. The clearance requirements, the long hiring timelines, the restrictive working environments. It makes intuitive sense.
They’d be wrong. Right now, the sector we find hardest to place into is water.
Water companies in England and Wales are under pressure from every direction simultaneously. Ofwat is tightening operational performance expectations. The Environment Agency is increasing scrutiny on environmental compliance. DEFRA’s Storm Overflows Discharge Reduction Plan has created a wave of infrastructure investment. And sitting underneath all of that, often as an afterthought, is a cyber security obligation that’s growing faster than the teams tasked with meeting it.
The NIS Regulations already designate water companies as operators of essential services. The Cyber Security and Resilience Bill will tighten those obligations further. Water companies will need to evidence security capability across both their IT and OT estates – and in water, the OT estate is vast, geographically distributed, and often running on infrastructure that was designed decades before anyone used the word “cyber.”
The security teams at most water companies are small. Some of the smaller regional operators have one or two people covering the entire function. When one of those people leaves, the gap is immediate and the impact is significant.
This is where it gets difficult. Water is a regulated industry with regulated returns. The companies can’t simply decide to pay 30% more for a Security Architect because the market has moved. Salary bands are structured, approval processes are slow, and the culture around compensation tends to be conservative.
Meanwhile, their security professionals are being approached by energy companies, defence primes, and consultancies offering £15k–£20k more for equivalent roles. An OT Security Engineer at a water company on £70k knows they could earn £85k–£90k at a transmission network operator or a nuclear site. The work is similar. The pay is not.
We’ve had candidates tell us they love working in water. They like the teams, they find the OT environments interesting, they believe in the public service element. And then they leave anyway, because the salary differential becomes impossible to ignore once it reaches a certain point.
The water companies that retain their security staff tend to do it through flexibility, training investment, and genuine progression pathways rather than matching the market on base salary. But that only works for so long, and it doesn’t solve the problem of attracting new hires in the first place.
Water infrastructure is where the water is. That sounds obvious, but it has real implications for recruitment.
Treatment works, pumping stations, and reservoirs are not typically in city centres. They’re in semi-rural locations, often a significant drive from the nearest major town. For a sector that already can’t compete on salary, adding a 45-minute commute to a site in the middle of nowhere is a genuine barrier.
Remote and hybrid working helps for the IT security side. It doesn’t help for the OT roles that require physical presence at operational sites. And those are precisely the roles that are hardest to fill – the people who need to understand SCADA systems, PLCs, and telemetry networks in live water treatment environments.
Defence and nuclear have the same site-based challenge, but they offset it with higher salaries and the appeal of clearance-level work. Water doesn’t have either lever.
Here’s something that’s changed in the past eighteen months. Water companies aren’t just competing with other CNI operators for security talent. They’re competing with the consultancies and systems integrators that water companies themselves are hiring to support their compliance programmes.
A water company engages a consultancy to help with NIS compliance. That consultancy needs OT security people to deliver the work. They recruit them from the same small pool. Some of those people were previously at water companies – or would have been, if the consultancy hadn’t got there first.
The talent effectively moves up the value chain, from operator to service provider, because the service provider can pay more and offer varied project work. The water company ends up paying a day rate for expertise it could have employed permanently at a fraction of the cost, except it couldn’t attract the person at the salary it was offering.
It’s a cycle, and it’s getting worse.
There’s no single fix, and we’re wary of prescribing solutions from the outside to an industry that knows its own constraints. But three things stand out from the conversations we’re having.
First, water companies that hire well tend to grow their own. They take people with IT security backgrounds and invest in OT training, or they take engineers with operational technology experience and build the security knowledge on top. The expectation that you’ll find someone who already has both skill sets, at a water-sector salary, is increasingly unrealistic.
Second, the sector would benefit from talking about itself differently. Water has genuinely fascinating OT environments – complex, large-scale, safety-critical, nationally important. The problem is that nobody outside the sector knows that. When a security professional thinks about CNI, they think of energy grids and nuclear plants. They don’t think about the distributed SCADA network that keeps clean water flowing to eight million people. That’s a branding problem as much as a salary problem.
Third, speed matters more here than in almost any other sector, precisely because the pool is so small. When a suitable candidate appears, the window is measured in days. Water companies that run five-stage processes with three-week gaps between rounds are losing people to organisations that move in half the time.
The sector that provides the most essential service of all is the one finding it hardest to protect itself. That should probably worry more people than it does.
Counteroffers solve the wrong problem almost every time. Here is what candidates and employers both get wrong – and the conversation that should happen instead.
After reviewing hundreds of cyber security CVs, five career decisions consistently separate future CISOs and Heads of Security from those who plateau at mid-level.
Trusted by security leaders at
"I can't recommend Gyles and the team at Foundations enough. We struggled to find a suitable candidate for 5 months, Foundations found 3 perfect candidates in 24 hours."
Manager of EMEA & APAC Network Engineering, Equinix
