Canada’s cybersecurity crisis isn’t a lack of talent — it’s a lack of experience #CanadaFinance

As cyber threats grow more sophisticated, Canada is racing to secure its digital infrastructure. From ransomware attacks on hospitals to phishing campaigns targeting critical infrastructure, the demand for cybersecurity talent has never been higher. But a new national report reveals a sobering reality: the problem isn’t that Canadians aren’t interested in cybersecurity — it’s that we’re not preparing them to actually do the work.

The Canadian Cybersecurity Job Market Overview and Global Comparison (Q1 2025) offers an in-depth look at more than 10,000 job postings across the country. It confirms what many in the industry already know: while the market is booming with opportunity, employers are struggling to find skilled professionals who can hit the ground running. The biggest shortage? Mid-to-senior level talent with practical, hands-on experience.

Canada doesn’t have a cybersecurity interest problem — it has a hands-on experience problem. If we want real talent, we need to stop selling theory and start building skills through immersive, employer-connected programs that begin in classrooms and end on the front lines.

Most headlines point to a talent shortage in tech. But the Canadian Cybersecurity Network (CCN) report points out a more nuanced issue: the gap isn’t at the level of enrolment or even technical education — it’s in real-world readiness. Many post-secondary programs are focused on expanding headcounts and revenue, rather than cultivating skills aligned with industry needs.

While job seekers may graduate with theoretical knowledge, employers are increasingly demanding cloud security fluency, DevSecOps integration and real-time incident response expertise. These aren’t easily taught in a lecture hall. As the report outlines, over 95 per cent of cyber job postings analyzed were for full-time roles, and the vast majority required several years of experience — a threshold most graduates simply can’t meet without practical opportunities.

Top roles advertised across the country include security analysts, cloud security engineers and governance, risk and compliance (GRC) professionals. Employers also emphasize certifications like CISSP and experience with tools like Splunk, AWS, or ISO 27001 compliance standards.

But even entry-level listings often ask for two to five years of experience. The result? Thousands of eager but underprepared graduates — and thousands of unfilled jobs.

Canada’s estimated cyber workforce gap is between 25,000 and 30,000 positions today — and that number is expected to grow to 100,000 by the end of 2025. But unless education providers and employers find ways to bridge the experience divide, those roles will remain vacant or outsourced to countries that have more agile training pipelines.