NIS2 moved security from a technical concern to a documented management responsibility. That shift changed which people organisations need, not just how much security work there is.
Start a conversationThe directive requires demonstrable governance: risk management, supplier oversight, incident reporting within tight deadlines. That is GRC work. But reporting an incident within 24 hours assumes you can detect it, which is detection engineering. Organisations that hire only for the first requirement discover the gap during their first real incident.
GRC specialists who can write a policy exist. GRC specialists who can translate a technical control into an auditable statement and back are rare. On the technical side, the shortage is not in tooling knowledge but in people who can tune detection so an on-call team is not drowning in false positives.
Split the role before you post it. Decide whether you need evidence for the auditor or capability against an attacker, then hire deliberately for each. And check availability early: in this niche, a good candidate is usually in a conversation with two other organisations already.
A Dutch utility needed a SOC that understood operational technology, not just IT alerts.
Case: a Business Continuity Management consultant for a large insurerA large insurance company had searched for months for a BCM consultant who fitted a medior budget.
How to read a specialist IT market before you open a vacancyMost hiring delays are decided before the job posting goes live.