The global shortage of qualified cybersecurity professionals is on track to reach 1.8 million unfilled positions by 2022, according to a new report from (ISC)², the International Information System Security Certification Consortium. The figure represents a 20% increase on earlier projections and reflects the accelerating pace of cyber threats outrunning the industry’s capacity to develop and retain qualified professionals.

Asia Pacific is expected to bear the largest regional shortfall, with an estimated 2.1 million cybersecurity professionals needed in the region by 2022 against a projected workforce of less than 800,000. Singapore, with its Smart Nation ambitions and status as a regional financial hub, faces a particularly acute version of the challenge.

The scope of the problem

The cybersecurity talent gap is not merely a technology recruitment issue — it is an HR challenge with direct business risk implications. Organisations understaffed in cybersecurity face greater exposure to data breaches, ransomware, supply chain attacks and regulatory non-compliance. In Singapore’s financial sector, MAS-regulated entities are required to maintain minimum cybersecurity headcount and capability standards, raising the stakes for HR teams that cannot fill critical roles.

The shortage is compounded by high attrition within the profession itself. Cybersecurity professionals report significant burnout — stemming from 24/7 on-call demands, alert fatigue from security tools and the psychological burden of defending against relentless threat actors — leading to voluntary departure rates significantly above the technology sector average.

What HR teams can do

Several strategies are gaining traction among Singapore employers seeking to build and retain cybersecurity capacity:

• Grow your own — Partnering with Singapore’s Institutes of Higher Learning and sponsoring employees through cybersecurity certifications (CISSP, CEH, OSCP) builds capability over time and creates loyalty.
• Broaden the hiring funnel — Removing degree requirements and focusing on demonstrated skills, certifications and aptitude assessments opens the talent pool significantly.
• Address burnout structurally — Rostering, on-call rotation policies and mental health support tailored to the cybersecurity function’s unique stresses are essential retention tools.
• Build government partnerships — Singapore’s Cyber Security Agency has developed joint programmes with employers to create pathways for mid-career professionals and national servicemen with cybersecurity training.