This data coincides with a significant regulatory delay. The European NIS2 Directive, which requires thousands of Spanish companies to strengthen their cybersecurity, had a transposition deadline of October 17, 2024. As of mid-2026, it still has not become law in Spain.<\/p>\n\n\n\n
SMEs, in the crosshairs<\/strong><\/p>\n\n\n\n Of the total incidents handled in 2025, 601% affected small and medium-sized enterprises (SMEs)\u2014organizations that, for the most part, do not have a dedicated security department. The private sector confirms the same trend from another angle: Check Point Research recorded an average of 2,105 cyberattacks per week per Spanish company in June 2026, 101% more than the previous year.<\/p>\n\n\n\n Cybersecurity vacancies, around 30,000 unfilled: a deficit that is not due to a lack of vocation<\/strong><\/p>\n\n\n\n While the threat grows and legal requirements tighten, the market faces a different problem: cybersecurity vacancies in Spain continue to grow, with an estimated deficit of 30,000 unfilled positions and demand increasing between 20% and 20% each year.<\/p>\n\n\n\n And it's not a matter of economic attractiveness. Entry-level salaries in the sector (\u20ac20,000\u2013\u20ac35,000 gross per year) already exceed the national average, and a junior SOC analyst position commands a similar or higher salary.<\/p>\n\n\n\n So why are so many cybersecurity vacancies still unfilled?<\/p>\n\n\n\n \u201cFor two years now, we\u2019ve been seeing the same pattern in the selection processes of our partner companies: the training for these profiles has to be practical and realistic; they must be able to handle an incident from their very first day on the job. That\u2019s the difference between a candidate who gets stuck in the interview stage and one who lands the job. The shortage of specialists is solved by having professionals who have received training aligned with the work environment before even joining the company.\u201d<\/p>\n\n\n\n Jorge Gonz\u00e1lez, Head of Employability at EIP International Business School<\/p>\n\n\n\n Where is the real mismatch?<\/strong><\/p>\n\n\n\n The problem isn't the number of people wanting to enter the sector; it's the type of training available compared to the actual cybersecurity vacancies that exist today. Companies need to fill very specific roles\u2014incident response, regulatory compliance (NIS2, GDPR), cloud security, and OT security\u2014and much of the traditional training remains focused on theory, not on simulating real-world scenarios.
This gap between theory and practice is also reflected in the certifications the market demands. The CISSP has become the benchmark for senior and management positions, while the OSCP leads in offensive environments, such as penetration testing. Both are now standard requirements, not just a way to differentiate oneself on a resume. The market is seeking professionals who have already managed the type of incident they will encounter on their first day of work.<\/p>\n\n\n\n
![\"\"](\"https:\/\/eiposgrados.com\/wp-content\/uploads\/2026\/07\/ciberseguridadeip-1-1024x559.jpg\" "\\"\\"")