POST Atlas Market Note.

The collapse many candidates expected never arrived. Nor did the recovery many hoped for. What's happened instead is that hiring has become more selective. Employers are still spending on cloud, security and platform capability, but the bar for what counts as a credible candidate has risen across almost every job family we track.

Two shifts sit underneath the headline. The cyber shortage has moved up the ladder, away from entry-level analyst seats and toward people who can run an incident, harden a cloud estate, or take ownership of a control framework end to end. And architecture interview loops appear to have hardened, with operating history weighted more heavily as a filter, often at mid-career.

The story being told to career changers and graduates has not caught up with either shift.

Entry-level cyber is oversubscribed. Mid-level and senior cyber roles are harder to fill than they were two years ago. Both things are true at the same time, and the gap between them is the story.

On the entry side, SOC analyst pipelines remain full. Graduate schemes, cyber academies, bootcamp graduates and self-taught Sec+ holders are all competing for the same junior seats, and employers have responded by raising the operational bar. A first cyber job in 2026 routinely asks for prior helpdesk or NOC time, not just a certification stack.

On the senior side, the picture inverts. Incident response leads, cloud security engineers, GRC specialists who can actually read a control framework rather than recite one, and detection engineers who write rather than tune are all in short supply. MSSPs have absorbed some of the demand, but only the L1 and L2 layers. The shortage above that has not been automated away and is not being filled by the entry-level pipeline.

The role has split in two and the market has not agreed on what to call each half. One track is operator: someone who runs production workloads, owns the on-call rota, lives in the console and the ticketing queue, and is judged on uptime. The other track is platform: someone who writes Terraform daily, owns the CI/CD pipeline, debugs Kubernetes, and is judged on what other engineers can ship because of it.

Most postings still say cloud engineer. Most interviews now test for the platform half. That mismatch is where careers stall.

The operator track is not disappearing, but the salary ceiling has flattened and the title has lost prestige. The platform track has absorbed most of the senior cloud hiring. The salary movement has gone with it. A cloud-curious sysadmin who has not made the jump to code is in the weakest position in this market: too senior to be hired as junior, not technical enough for the platform interviews.

The architect interview has changed shape. Where a strong mid-2024 candidate could expect a three or four stage loop ending in a design exercise, the same candidate in mid-2026 should expect the loop to have lengthened, often by an additional stage or two, with at least one stage now focused on operating history. Who ran the migration. What broke. What it cost. Who escalated to you and why.

Design ability has become table stakes. The differentiator is whether the candidate has stood in front of a steering committee with a failing programme and explained it.

Internal promotions appear to be absorbing a meaningful share of senior architecture seats this year. External hiring still happens, but the loops are longer, the bar is higher, and the gap between an internal promotion and an external hire at the same grade has widened.

This was an overstatement in 2022. It is materially false in 2026.

Sec+, CySA+, CCSP, even CISSP for the people who shouldn't have taken it yet, none of these credentials reliably convert to a first cyber role on their own. What they prove is direction. What employers now hire on is operational exposure: a year on a helpdesk where you triaged real alerts, six months on a NOC where you escalated real incidents, time spent close enough to production to have broken something and fixed it.

The advice to skip the operational years and go straight to cyber was always optimistic. In a market where employers can pick from a pile of candidates who hold certs but haven't worked an incident, it has stopped working entirely.

The Market Note is read off public evidence and POST interpretation. Public evidence in this edition draws on UK Government cyber skills reports, ONS labour market data, DSIT publications, NCSC guidance, Tech Nation, and the recruiter market guides from Hays, Robert Walters and Harvey Nash. Interpretation is POST's own.

Confidence ratings are coarse on purpose. High means the shape of the call is well supported by multiple converging sources. Medium means the shape is supported but the magnitudes are not. Low means the shape is the author's read and the evidence is thin.

Every finding carries a falsification condition. The point is to be allowed to be wrong without being allowed to be vague. The next edition, the Atlas Report 2027, will revisit each of these conditions explicitly.