Why Are IT Security Roles So Critical in 2026? What Six Open Positions Tell Us

IT security roles are the people who decide whether a breach stays a ticket or becomes a headline. They patch what attackers are scanning for, control who holds the keys to critical systems, build security into software before it ships, and answer to regulators when something goes wrong.

In October 2026, six of the open positions we are recruiting for at Optiveum sit squarely in this field: a vulnerability remediation expert for a Nordic bank, two identity and access management specialists, a privileged access engineer for a pharmaceutical company, a DevSecOps specialist and a CISO for a logistics operator of national importance. Read together, their job descriptions say a lot about where cyber risk now lives — and why organisations can no longer treat security as a back-office function. Our own recruitment for these roles adds a second lesson: applicants are plentiful, complete matches are not.

Why has IT security become a board-level issue?

Because attacks have become faster, more frequent and more destructive — and because the law now holds management personally accountable for the response.

The threat picture

The 2026 edition of Verizon’s Data Breach Investigations Report, built on more than 31,000 incidents and over 22,000 confirmed breaches in 145 countries, marked a turning point. For the first time in the report’s 19-year history, exploiting software vulnerabilities overtook stolen credentials as the most common way in: 31% of breaches started with an exploit, against 13% with credential abuse.

The same report shows defenders falling behind. Only 26% of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list were fully fixed in 2025, and the median time to remediate rose from 32 to 43 days. Breaches involving a third party climbed to 48%, up from 30% a year earlier.

Poland has felt this directly. On 29 December 2025, coordinated attacks hit more than 30 wind and solar farms, a manufacturing company and a large combined heat and power plant serving almost half a million customers. CERT Polska described the attacks as purely destructive — the first of their kind against the Polish energy sector. In each case the attackers got in through internet-exposed perimeter devices acting as VPN gateways and firewalls. Energy production and heat supply held, largely thanks to fast responses by operators.

The volume is rising too. CERT Polska registered 260,783 unique incidents in 2025, up 152% year on year, from 658,320 reports.

The regulation

• NIS2 / KSC. Poland’s amended Act on the National Cybersecurity System, which transposes NIS2, took effect on 3 April 2026. Entities in scope had until 3 October 2026 to register, have until 3 April 2027 to adapt their systems and procedures, and essential entities face their first cybersecurity audit by 3 April 2028. Estimates suggest the number of covered organisations will grow roughly a hundredfold compared with the 2018 regime.
• DORA (Regulation (EU) 2022/2554), applicable since 17 January 2025, requires banks, insurers and other financial entities to manage ICT risk, test their resilience and control third-party providers.
• Sector rules add their own layer: GxP requirements in pharmaceuticals, for example, demand validated changes and complete audit trails for systems that touch regulated data.

None of these frameworks can be met with tools alone. They require named people who own processes, produce evidence and can explain decisions to an auditor.

Key takeaway: Attackers now move faster than most organisations patch, and regulators now expect proof that someone is in charge of closing that gap. Both pressures land on the same small group of specialists.

Which security roles are companies hiring for right now?

The six security positions currently open at Optiveum cover four layers of defence: fixing weaknesses, controlling access, securing how software is built, and leading the whole programme.

Two patterns stand out. Every one of these clients operates in a regulated sector — banking, pharma or critical infrastructure. And half of the roles are about identity, which reflects a simple fact: once an attacker is inside, what they can reach depends on who they have become.

What do we see in our own recruitment?

Most security applications we receive do not match the brief — and only a small fraction of applicants ever reach a client interview. The pattern repeats across roles, sectors and seniority levels.

• Volume is not the problem. Specialist IAM roles regularly draw dozens of applications within a few weeks. Most come from people with solid general security backgrounds but without the specific platform the client runs.
• Leadership roles filter hardest at the door. For CISO positions, the majority of applicants are screened out at first review, before any call — usually on missing management experience, regulatory exposure or the required certifications.
• The narrowest niches stay silent. Roles built around one platform, such as CyberArk Privilege Cloud, can stay open for days without a single application. These positions are filled through direct sourcing, not job boards.

Key takeaway: The shortage is not of applicants, but of the exact combination of platform, regulation and seniority each client needs.

What do these roles actually protect?

Each role closes a specific door that attackers are known to use. Mapping the job descriptions against current threat data shows why none of them is optional.

Vulnerability remediation: closing the door attackers use most

If exploitation is now the top entry point, the people who turn scan results into fixes are on the front line. The Security Remediation Expert role for a Nordic bank is not about running a scanner. It is about finding where remediation is stuck, analysing complex findings, and persuading system owners across the organisation to act at the right pace.

Two details in the job description are telling. The client wants help designing risk scoring that supports near real-time prioritisation — a direct answer to the growing gap between disclosure and exploitation. And it asks for a deep understanding of AI-related threats, alongside automation skills in Python and Apache Airflow. Security teams are expected to fight automated attacks with automated defence.

Identity and access management: deciding who can reach what

The two IAM roles look quiet on paper: onboarding applications to SailPoint IdentityIQ, cleaning up access groups and service accounts, automating identity lifecycles in One Identity Manager. In practice they remove the excess permissions that turn a single compromised account into a full breach.

The banking role explicitly targets inactive, excessive and unnecessary permissions, and includes mainframe security (RACF) — a reminder that core banking still runs on systems decades old. Every orphaned account removed is one less option for an attacker or a careless insider.

Privileged access management: guarding the keys to the kingdom

Administrator and service accounts are the most valuable credentials in any network. The PAM Operations & Platform Engineer for a pharmaceutical client keeps a CyberArk / Idira Privilege Cloud environment running: password rotation, session management, connector servers, certificates. The role also extends privileged controls to endpoints, workforce passwords and external vendors.

That last point matters. With almost half of breaches now involving a third party, vendor access is no longer an afterthought. The role also includes disaster recovery testing and break-glass exercises, because a PAM vault that fails during an outage can lock out the very people needed to fix it.

DevSecOps: building security into delivery

The DevSecOps Specialist role for a port and logistics software company puts security directly into CI/CD pipelines: scanning code, dependencies, container images, secrets and infrastructure-as-code. The client is clear that this is not about bolting a scanner onto a pipeline. It wants someone who can automate controls without blocking delivery teams, filter false positives intelligently and document decisions for NIS2, KSC and ISO/IEC 27001 audits.

This is security moving left: catching a vulnerable library before it ships is far cheaper than remediating it in production.

The CISO: owning the whole picture

The Information Security Director role in Szczecin ties everything together. It covers leading SOC, CSIRT and security architecture teams; building the information security management system and cyber continuity plans; advising the board on NIS2 and KSC obligations; reporting serious incidents to national CSIRTs; and running penetration tests and supply-chain audits.

Under the new KSC rules, management bodies carry direct responsibility for cybersecurity. A CISO is the person who makes that responsibility manageable — and who translates technical risk into decisions a board can take.

Key takeaway: These roles are not interchangeable. Each one covers a different stage of an attack: entry, movement, escalation and response. Leaving any one unfilled leaves a gap the others cannot cover.

Which skills do employers ask for?

The strongest security candidates combine deep knowledge of one platform with the ability to explain risk to people who are not security experts. Across the six job descriptions, the same requirements keep returning.

Technical depth in a named platform

Clients rarely ask for “security experience” in general. They ask for three to five years with SailPoint IdentityIQ, CyberArk Privilege Cloud or One Identity Manager specifically. Tool-specific experience shortens onboarding from months to weeks, which matters when a regulatory deadline is fixed.

Automation

Python, PowerShell, Bash, SQL, APIs and workflow tools such as Apache Airflow or Power Automate appear in almost every role. With remediation times growing, manual processes simply cannot keep up.

Regulatory fluency

DORA, NIS2 / KSC, ISO/IEC 27001, OWASP and GxP are named directly in the job ads. Candidates are expected to know not only how to fix a problem but how to document the fix so that an auditor accepts it.

Certifications

• CISSP, CISM, CISA or CCISO — explicitly required for the CISO role.
• CyberArk certifications (for example CyberArk Certified Delivery Engineer) — a strong plus for PAM engineers.
• Vendor certifications for SailPoint or One Identity — helpful for IAM roles, though hands-on project experience usually weighs more.

The less obvious skills

• Influence without authority. The remediation expert and the IAM specialist both depend on application owners who do not report to them. Both job ads ask for negotiation and stakeholder management.
• Judgement over metrics. The DevSecOps client wants critical thinking rather than blind reliance on severity scores.
• Trustworthiness. Several roles require a criminal record certificate or a security background check. People with access to the keys must be vetted themselves.

Why are security specialists so hard to hire?

Because the problem is no longer just the number of people — it is the specific skills each role needs. ISC2’s 2025 Cybersecurity Workforce Study, based on more than 16,000 professionals, found that skills gaps have overtaken headcount as the main workforce concern. 95% of respondents reported at least one skills gap, and 88% had experienced at least one significant incident linked to a skills shortage. ISC2 did not even publish a global workforce gap figure that year, because respondents focused on missing skills rather than missing people.

From our searches, several factors make security hiring especially difficult:

• Narrow tool filters. A client needing SailPoint IIQ plus mainframe RACF experience, or CyberArk Privilege Cloud plus GxP, is looking at a very small pool. Many applicants have strong general security backgrounds but not the exact platform.
• Everyone hiring at once. NIS2 in Poland expanded the number of regulated organisations dramatically, while DORA was already driving demand in financial services. Banks, energy companies, logistics operators and public institutions are competing for the same specialists in the same 18-month window.
• Vetting requirements. Criminal record certificates, background checks and in some cases security clearances lengthen the process and exclude otherwise qualified candidates.
• Location constraints. Some roles, such as the CISO position, require full on-site presence in a specific city. As we wrote in our analysis of mandatory hybrid work, every office day narrows the candidate pool considerably.
• New skill demands. ISC2 found AI to be the most frequently cited skills need (41%), ahead of cloud security (36%). Our remediation role already asks for knowledge of AI-specific threats — a profile very few people have built yet.

Our pipeline shows the same pattern: many applications, very few candidates who are ready to present to a client. Clients in regulated sectors understandably will not compromise on core requirements, so the decisive work happens in sourcing — identifying people whose current title hides the right experience.

Key takeaway: Security hiring fails less often for lack of candidates than for lack of the exact combination of platform, regulation and trust a role requires. Precise sourcing beats volume.

Where can organisations find security talent in CEE?

Poland is one of the most practical places to look. The country hosts large shared-service and technology centres for Nordic, Swiss and Western European banks, pharmaceutical groups and logistics companies — exactly the environments where people build hands-on IAM, PAM and vulnerability management experience under regulatory pressure. Polish specialists also work in an unusually demanding threat environment, which shows in the incident volumes CERT Polska reports year after year.

The roles in this article illustrate the range of engagement models available: B2B contracts with hourly rates for international clients, part-time specialist allocations, and permanent or B2B leadership roles for Polish organisations. Many senior candidates already work in English, in distributed teams, and are comfortable moving between clients in the same time zone and legal framework.

At Optiveum, security profiles are part of the specialist IT market we recruit in every day, from platform engineers to CISOs. Over the years we have built a large and fast-growing network of security and cybersecurity specialists, so many searches start with people we already know. If you are building or reinforcing a security function — to meet NIS2 or DORA obligations, or because your last penetration test raised more questions than it answered — it helps to talk to someone who knows where these people currently work. You can read more about our approach to IT recruitment in Poland and IT outsourcing.

Building or strengthening a security team? Book a 30-minute conversation with Marek Wróbel to discuss the profile you need and what the CEE market currently looks like for it.

Are you a security specialist? See our open security roles and apply directly.

Read also

• Cyber Security Engineer Salaries by Country
• Cyber Security Engineer Job Description: Complete Guide
• What Does a Disaster Recovery Governance Lead Do — and Why Can’t Organisations Do Without One?
• How to Vet Foreign IT / Engineering Candidates

Data sources

• Verizon, 2026 Data Breach Investigations Report — as summarised in TechRepublic / eSecurityPlanet, May 2026 (initial access vectors, KEV remediation rates, third-party involvement).
• CERT Polska, Energy Sector Incident Report – 29 December 2025 and Follow-Up Report, August 2026.
• Help Net Security, February 2026 — initial access via exposed perimeter devices.
• CERT Polska, Annual Report 2025; incident figures as reported by GSMonline.
• ITwiz, “Nowelizacja ustawy o KSC zaczyna obowiązywać”, April 2026 — KSC / NIS2 timeline.
• Kluczesoft, NIS2 Polska 2026 guide — estimated growth in covered entities.
• ISC2, 2025 Cybersecurity Workforce Study; figures as reported by SecurityInfoWatch and CSO Online.
• Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2555 (NIS2) — EUR-Lex.
• Role scopes: Optiveum job descriptions for the six positions listed above, October 2026.
• Recruitment observations: Optiveum’s experience recruiting for the six roles listed above, October 2026.