Not every security professional is hard to find. The real shortage is a much narrower combination.

Security work has moved off the network and into the cloud. What clients ask for now is people who can secure increasingly complex cloud and digital environments, rather than traditional network security. Alongside that, AI security has gone from a niche requirement to something companies are actively thinking about, particularly around data leakage, AI governance and securing internal AI tools. The urgency behind both is not abstract. Thailand's national cyber agency has compiled more than 221 million leaked account records linked to Thailand, and after a run of high profile attacks, organisations here are starting to take the problem seriously in a way they were not eighteen months ago. Capability is not keeping pace evenly, though. The same agency's annual assessment found government agency scores falling from 65 to 59 per cent in a year, while critical infrastructure operators rose to 89 and regulators to 91.

Which is why the single most common mistake in a brief is asking for one person who can do everything. Briefs still arrive looking for someone to cover SOC and penetration testing through to cloud security, compliance, architecture and governance. Cyber security has become far more specialised than that, and compliance in particular has become its own discipline rather than a line in someone else's job description. Companies need to be clearer about the actual risk they are hiring someone to solve, rather than looking for an unrealistic all-rounder.

The hardest combinations to find are narrower than the shortage talk suggests. Cloud security, security architecture, DevSecOps, application security and identity and access management remain particularly difficult, especially combined with English strong enough to operate with regional or senior stakeholders. Increasingly clients also want people who understand AI-related security risks, which makes an already limited pool smaller again. The depth of the senior certified layer in Thailand gives a sense of the scale: as at May 2025, 431 people in the whole country had passed the CISSP certification exam, up from 385.

When a strong candidate says no, it is usually not about money. It is about the role not offering enough progression, technical challenge or influence within the business. The best security professionals increasingly want to work somewhere security is taken seriously and where they have the authority and the resources to actually improve it. Salary still matters, but candidates are looking just as closely at the maturity of the security function, the reporting line, the technology environment and how much the role can genuinely change. Flexible working, training and certification budgets, and the chance to work on regional or complex security programmes all make a real difference.

Where the people actually are. The strongest talent tends to come from banks and financial services, large technology companies, telecommunications businesses, consultancies and multinationals with mature security environments. In Thailand those organisations offer exposure to the scale, regulation and complexity that smaller companies struggle to replicate, which is what builds the experience clients are then trying to buy.

What we tell hiring managers. Decide which security risks genuinely matter most before writing the job description, and prioritise those capabilities rather than assembling a long technical checklist. Be more open to adjacent backgrounds: someone with strong fundamentals and the ability to learn is often a better hire than someone who happens to match every tool on the list. And the thing worth knowing before you start is that the shortage is not universal. Despite constant talk about a global cyber security talent gap, not every cyber professional is hard to find. The real scarcity is people who combine strong technical capability with commercial judgement, communication skills and the ability to hold their own with senior stakeholders.