American banks face growing cybersecurity talent shortage
NEW YORK, UNITED STATES — The financial services industry struggles with a worsening shortage of cybersecurity professionals, with demand far exceeding supply. Banks face particular difficulties as they compete against tech firms for the limited pool of qualified candidates in today’s competitive job market.
Recent Cyberseek figures reveal 1,251,007 cybersecurity workers currently employed across the U.S., yet 457,398 positions remain unfilled nationwide. Within the finance and insurance sector specifically, about 117,138 cybersecurity professionals (roughly 9% of the total cybersecurity workforce) are employed, while the sector faces 40,308 vacant positions.
Looking ahead, the Bureau of Labor Statistics forecasts 33% growth for “information security analyst” roles from 2023-2033 – much faster than average occupational growth rates. This growth translates to approximately 59,100 new positions over the next decade, adding to the existing 180,700 jobs.
Changing workplace dynamics
The shifting preferences of cybersecurity professionals regarding work environments have complicated recruitment efforts for banks. Mark Nicholson, who leads Deloitte’s cyber practice for financial services, observes that banks have lost some of their traditional recruiting advantages as remote work options expand in other industries.
“Twenty years ago, banks were able to attract top talent coming out of universities, as those new professionals wanted to work on Wall Street,” Nicholson told American Banker. “Today, that may be less the case as workplace and corporate cultural trends swing continued toward remote or hybrid work and increased work hour flexibility — both of which we know cyber professionals appreciate.”
Widening cybersecurity talent gap
The shortage of cybersecurity talent continues to worsen. Research from the International Information System Security Certification Consortium (ISC2) identified a North American cybersecurity workforce gap of 542,687 in 2024, reflecting a 4% increase from the previous year.
Debra Taylor, acting CEO of ISC2, linked economic conditions to this expanding gap: “As economic conditions continue to impact workforce investment, this year’s Cybersecurity Workforce Study underscores that many organizations are putting their cyber teams under significant strain, risking burnout and attrition as job satisfaction rates fall.”
A National Science Foundation (NSF) report suggests the talent shortage might not stem from insufficient graduates but rather from “other factors, such as an unclear pipeline and lack of clear data about the skills, knowledge, and credentials needed in the workforce.”
Outsourcing: A strategic response to the talent crisis
As this skills shortage intensifies, financial institutions increasingly explore outsourcing as a practical solution. Gartner anticipates security services spending will climb 15.8% to reach $86.1 billion by 2025, highlighting a fundamental shift in how banks approach their cybersecurity challenges.
Many institutions now partner with managed security service providers (MSSPs) to gain access to experienced cybersecurity experts they would struggle to recruit and retain in-house. This strategy enables banks to secure round-the-clock protection at levels that would prove challenging to achieve with internal teams alone.
“The existing tools enterprises have had have become insufficient because of the increased attack surface that has come from the migration of more IT functions to the cloud,” explains Craig Robinson, research vice president of security services at IDC.
Some banks have taken outsourcing further by engaging virtual Chief Information Security Officer (vCISO) services for executive-level guidance while maintaining focus on their core banking operations.
Smaller institutions like Forcht Bank demonstrate how strategic outsourcing allows community banks to implement robust cybersecurity measures comparable to larger organizations while substantially reducing both costs and internal IT staffing demands.
With global demand for cybersecurity professionals projected to exceed 3.5 million unfilled positions by 2025, the severity of this talent shortage becomes increasingly apparent. As cyber threats grow both more sophisticated and costly — with cybercrime damage expected to reach $10.5 trillion annually — organizations must develop creative approaches to talent acquisition and retention in this fiercely competitive landscape.
