The wider UK labour market is quiet, but cyber security is one of the pockets that keeps moving. Recruiters describe the overall picture as 'low hire, low fire', with weaker recruitment and vacancies below pre-pandemic levels Low Pay Commission Report 2025, GOV.UK. Yet specialist tech roles are the exception. The 2026 tech recruitment outlook points to clear demand hotspots for AI, data, enterprise applications and cyber security Computer Weekly (tech recruitment outlook 2026).
There's genuine volume behind that. Vacancies in professional, scientific and technical activities saw the largest volume increase of any sector in late 2025, up by 5,000 ONS – Vacancies and jobs in the UK: November 2025. And IT business analysts, architects and systems designers, a 193,000-strong group, now sit among the occupations in critical demand Occupations in demand 2025, Explore Education Statistics, GOV.UK. Cyber roles, including penetration testing, live squarely inside that specialist demand.
The cyber workforce is growing, but not fast enough to meet demand. There are roughly 143,000 people in the UK cyber security workforce, with growth accelerating from 2% in 2022 to 5% in 2024 Cyber security skills in the UK labour market 2025 - GOV.UK. That's progress, but the gap is real: 70% of cyber firms reported at least one hard-to-fill vacancy AI Labour Market Survey 2025 (Gardiner & Theobald), GOV.UK / publishing.service.gov.uk.
Two other forces shape who you can post for. First, AI has reshaped the talent pipeline: UK entry-level job postings have dropped 30% since ChatGPT launched techUK – What's actually happening with entry-level and graduate jobs?, and the tech sector cut graduate jobs by 46% in a year The Register. That thins the junior end just as demand for AI skills climbs nearly 200% in a year, with London taking 80% of AI-related postings The Register (Accenture data). Second, employers are building talent differently: apprenticeships have risen from 3% of AI hires in 2020 to 19% in 2025 GOV.UK / DSIT – AI Labour Market Survey 2025 report. Growing your own pen testers is becoming a mainstream route, not a fallback.
Start with the work, not the wish list. Pen testing spans web application, network, cloud, mobile and social engineering. Post for the type of testing you actually need, name the environments and tooling, and describe the reports and remediation advice you expect. Recognised certifications help you filter, but hands-on evidence, a walkthrough of a past engagement or a practical assessment, tells you far more about real skill.
Be realistic about the pipeline. With the junior end squeezed and mid-to-senior cyber talent in short supply, consider a mix: an experienced tester to lead, plus an apprentice or junior you develop over time. Most cyber roles are filled from the resident UK workforce rather than through international recruitment GOV.UK - Professionals in IT and engineering, so your local reach and speed of response matter. Move quickly when you find the right person, write a clear scope, and keep your interview process short and practical.
When cyber talent is this scarce, reach and speed win. We search a database of 15 million candidates and manage recruitment end to end, from a ranked shortlist to a booked interview, so you can focus on assessing skill rather than chasing applications. Our recruitment agent manages recruitment end to end for 8% on a successful hire, with no monthly fee and no upfront cost, through Reed.ai. Start building your pen tester shortlist today.
