The hiring manager at a regional bank's cybersecurity team reviewed forty-three applications in a single week. Thirty-one of those applicants held at least one recognized certification — CompTIA Security+, CEH, CISSP, or a combination of several. Of those thirty-one, she called back four.
The certifications had not disqualified anyone. They had simply stopped being the thing that qualified you.
What the hiring manager was looking for — and what she found in those four callbacks — was evidence that candidates had done something real. Not labs they had completed in a controlled course environment. Not multiple-choice questions about port numbers or encryption algorithms. Evidence of judgment under realistic conditions: the ability to investigate an alert without a walkthrough, to make a decision about escalation with incomplete information, to configure a detection rule and explain why they chose those specific parameters.
This is the shape of the cybersecurity skills gap in 2026, and it is more specific than the phrase "skills gap" usually implies. The problem is not that there are not enough cybersecurity professionals. The problem is that the pipeline for producing them has optimised for generating certification holders rather than practitioners — and the market has noticed.
This article is about what that shift means for career development, what employers are actually measuring in 2026 hiring processes, and how practitioners at different career stages need to think about the gap between their credential portfolio and their demonstrated capability.
The Certification Economy and Why It Stopped Correlating With Capability
Certifications served a specific function when they were designed: they were signals in a market where employers had no other way to evaluate whether a candidate had baseline knowledge of a technical domain. Before platforms like GitHub made project work verifiable, before cloud environments made real-world labs accessible, and before security operations centres became common across organisations of all sizes, a certification was the closest proxy available for "has engaged with this material seriously."
That function has not disappeared entirely. Certifications still signal baseline vocabulary, demonstrate that a candidate invested time in the domain, and satisfy HR gatekeeping requirements at organisations that have minimum credential requirements built into job requisitions.
What they no longer signal reliably: that a candidate can do the job.
The mechanism behind this deterioration is straightforward. As the cybersecurity job market expanded rapidly through the 2010s and early 2020s, the certification industry expanded with it. Preparation courses became more systematised, practice exams became more predictive of actual exam questions, and the time required to pass most mid-tier certifications dropped significantly. CompTIA Security+ pass rates with commercial preparation courses are now high enough that the certification is better understood as a vocabulary test than a capability test.
This is not a criticism of certifications as a category. It is an observation about what the signal means when the signal has been gamed at scale. When a certification is achievable by enough people through rote preparation that it no longer distinguishes practitioners from non-practitioners, the market finds other signals.
The market in 2026 has moved to demonstrated capability — specifically, the ability to show work in environments that are harder to simulate through memorisation.
What the Data Actually Shows About the 2026 Skills Gap
The framing of a "cybersecurity skills gap" as a shortage of certified professionals is analytically incomplete. Multiple workforce reports from 2024 and 2025 show something more nuanced: there is a shortage of practitioners at the mid-career level (three to seven years of experience) who can operate independently in detection and response roles, but there is simultaneously an oversupply of entry-level candidates with certifications and limited practical experience.
The disconnect is not between supply and demand in aggregate. It is between the supply the pipeline produces and the demand the market has.
The specific roles that have proven hardest to fill consistently are not entry-level analyst positions. They are:
- Tier 2 SOC analysts who can investigate alerts without scripted playbooks and make escalation decisions with judgment rather than rigid criteria
- Detection engineers who can write SIEM correlation rules, evaluate their own rules for false positive rates, and iterate on detection logic based on real attacker behaviour
- Threat hunters who can form hypotheses about attacker presence in an environment, design hunts that test those hypotheses, and interpret ambiguous results
- Incident responders who can manage an active incident with partial information, coordinate between technical and non-technical stakeholders, and make containment decisions under time pressure
What all of these roles share is that they require judgment under conditions of uncertainty and incomplete information. This is precisely what certification examinations cannot test — because the exam format requires questions with correct answers, and good security judgment often involves making defensible decisions with no clearly correct answer available.
The Four Capabilities Hiring Panels Actually Test in 2026
Understanding what the market wants is only useful if you understand how the market evaluates whether you have it. The interview and assessment processes at organisations that have matured their security hiring have moved significantly from the "walk me through the OSI model" format to structured evaluation of practical capabilities.
The four capabilities that appear most consistently in 2026 security hiring assessments are:
Capability 1: Alert triage and investigation without scaffolding.
The standard evaluation: you are given a real or realistic SIEM alert with supporting log data and asked to investigate. No walkthrough. No hint structure. You have access to the data and a set of tools, and you are expected to work through the investigation at the speed and with the judgment of a practicing analyst.
What distinguishes candidates who pass this assessment from those who fail is not technical knowledge — most candidates at this level have comparable foundational knowledge. It is the ability to form a hypothesis about what the alert represents, design queries that test that hypothesis, interpret the results, and communicate their reasoning as they go.
Candidates who have only studied for certifications typically approach this assessment by trying to remember what the correct procedure is. Candidates who have spent time in real or realistic environments approach it by thinking about what the alert might mean and what information would help them determine whether their hypothesis is correct.
Capability 2: Detection logic construction and evaluation.
The standard evaluation: you are given a description of an attacker technique — for example, lateral movement via Windows Management Instrumentation — and asked to write a SIEM detection rule that would catch this technique while minimising false positives. Then you are asked to evaluate your own rule: where would it fail? What legitimate activity might it catch? What variations of the technique would it miss?
This assessment distinguishes candidates who understand detection logic structurally from those who know that detection is a concept. Writing a rule that catches something is the easy part. Understanding the tradeoffs involved in how you write it — the sensitivity/specificity tension, the attacker adaptations that would evade your rule, the legitimate business processes that would generate false positives — is the practitioner skill.
Capability 3: Threat landscape contextualisation.
The standard evaluation: you are told that you are working as a security analyst for a healthcare company, and you are asked to describe what specific threat actor techniques are most relevant to your organisation. What tactics do the most active threat groups targeting healthcare use? What would their initial access look like? What defensive controls would most effectively address the highest-probability techniques?
This assessment tests whether a candidate can connect abstract security concepts to specific, contextualised risk. Candidates who have studied threat intelligence as an academic subject can describe threat actors at a general level. Candidates who have engaged with threat intelligence as a practitioner can answer the contextualised version: for this type of organisation, with this type of data, facing this type of adversary, what matters most and why.
Capability 4: Communication under pressure.
The standard evaluation: you have just finished an investigation and found evidence of a compromise. The senior security manager needs a status update in two minutes. Explain what you found, what you think is happening, and what you recommend doing next — in language that is technically accurate but accessible to someone who will not understand the technical details.
This capability is evaluated in almost every senior-level assessment and is increasingly evaluated even at entry and mid levels. Security teams operate in organisations where technical findings need to be translated into business decisions. Practitioners who cannot communicate clearly under pressure — who default to technical jargon when precision is needed, or who under-communicate when the situation requires directness — create risk as much as they reduce it.
Why the Portfolio Gap Is Harder to Close Than It Looks
The natural response to understanding what hiring panels are testing is to pursue the practical experience that addresses those capabilities. The difficulty is that the route to practical experience in security has historically required getting hired first — a circular dependency that entry and mid-career professionals frequently encounter.
This is the portfolio gap: the space between what a candidate can demonstrate through certifications and what a hiring panel needs to see to make an offer.
The ways most candidates try to close this gap fall into two categories: things that work and things that feel productive but do not produce demonstrable capability.
What feels productive but does not close the gap:
- Accumulating additional certifications (CEH after Security+, then CISSP, then OSCP) without applied practice between certifications
- Watching cybersecurity training videos or completing structured courses without doing unguided work afterward
- Participating in Capture the Flag competitions but not documenting or publishing writeups that demonstrate methodology
- Setting up a home lab but working through vendor-provided guided scenarios exclusively
- Studying threat intelligence reports without attempting to operationalise the intelligence into detection rules or hunting queries
Each of these activities has value. None of them closes the portfolio gap because none of them produces work that demonstrates capability to a hiring panel. The problem is not the activity — it is that the candidate has done the work but has no evidence that is interpretable by an outside evaluator.
What actually closes the portfolio gap:
- Writing up CTF challenge solutions in enough detail that a reader can follow your reasoning — and publishing them where they are findable
- Building detection rules for MITRE ATT&CK techniques in a home lab environment and documenting both the rule logic and your evaluation of the rule's limitations
- Completing incident response tabletop exercises and documenting your decision-making process and the reasoning behind each decision
- Taking threat intelligence about a specific threat actor and producing an original analysis that maps their techniques to a specific simulated organisation's environment
- Contributing to open-source security projects — detection content repositories, threat intelligence platforms, tooling improvements
The distinction between the first category and the second is not the difficulty of the work. It is whether the work produces an artefact that demonstrates your reasoning to someone who was not there when you did the work.
The Certification That Still Differentiates: OSCP and Why It Is Different
Not all certifications have experienced equal signal degradation. The Offensive Security Certified Professional (OSCP) has maintained its differentiation in the market — not because it is newer or more prestigious, but because its examination format cannot be passed through memorisation.
The OSCP examination requires candidates to compromise a set of machines in a timed, isolated network environment, producing a penetration testing report that documents their methodology. There are no multiple-choice questions. There are no partial credit for knowing what you would do theoretically. You either compromise the machines using techniques you can actually execute, or you do not pass.
This format is why OSCP signals differently from most other certifications: it is a direct demonstration of capability under conditions that cannot be gamed through rote preparation. You can study all the techniques. You still have to be able to apply them under time pressure against systems you have not seen before.
The practical implication for career development: certifications that include practical examinations — where the examination itself is a capability demonstration rather than a knowledge test — retain their differentiating power. Certifications that are exclusively knowledge-based have experienced the most signal degradation.
This creates a tiered view of the certification landscape in 2026:
Tier 1 — Practical examination required (high differentiation):
- OSCP (Offensive Security Certified Professional)
- GPEN (GIAC Penetration Tester)
- GWAPT (GIAC Web Application Penetration Tester)
- GCIH (GIAC Certified Incident Handler — partial practical component)
Tier 2 — Knowledge-based but well-respected in context (moderate differentiation):
- CISSP — respected for managerial and architectural roles, less useful as a practitioner signal
- CISM — appropriate for governance and program management roles
- AWS Security Specialty — demonstrates cloud security knowledge in AWS contexts specifically
Tier 3 — Widely held, good baseline but limited differentiation (low differentiation at hiring level):
- CompTIA Security+
- CEH (Certified Ethical Hacker)
- CompTIA CySA+
The important nuance: Tier 3 certifications are not useless — they satisfy HR requirements and demonstrate baseline domain engagement. They have simply become insufficient as primary differentiators at the hiring stage.
The Home Lab Problem: Most Are Configured to Produce Comfort, Not Capability
The home lab has become the standard advice given to aspiring security professionals who want to build practical experience. The advice is correct in principle. The execution by most practitioners is fundamentally misconfigured for the goal of closing the portfolio gap.
The most common home lab configuration involves a virtualisation environment running a handful of pre-configured vulnerable machines from a platform like Hack The Box or TryHackMe, which the practitioner works through following the guided learning paths. This is valuable as an introduction and as a way of building technical familiarity with specific tools and techniques.
It does not replicate the conditions under which practitioner capability is actually demonstrated, for three reasons:
Reason 1: Guided scenarios have known answer structures.
When you work through a guided HTB room or TryHackMe path, there is a correct sequence of steps that leads to the flag. You may struggle to find it, but the struggle is bounded — you know you are looking for a specific type of answer in a specific type of location. Real investigations do not have this property. Real investigations might have no answer at all — the alert might be a false positive, the intrusion might not have resulted in further compromise, the threat might not be present in the environment.
Reason 2: Guided scenarios do not produce documentation artefacts.
After completing a guided scenario, the typical practitioner has gained experience but has not produced anything that demonstrates that experience to an outside evaluator. A completed lab in a training platform is visible to the platform but not portable or evaluable by a hiring manager.
Reason 3: Guided scenarios do not require you to define the problem before solving it.
In guided scenarios, the problem is pre-defined: compromise this machine, find this flag, exploit this specific vulnerability. In real security work, defining what you are actually investigating is often the hardest and most important part. What does this alert actually represent? Is this behaviour malicious or legitimate? What hypothesis should I be testing?
The home lab configuration that actually builds demonstrable capability looks different:
- Spend the majority of unguided time in the lab, not following a guided path
- Document every investigation as a writeup, including dead ends and false starts — the reasoning matters as much as the conclusion
- Build detection rules for techniques you encounter and publish the rules with your analysis of their limitations
- Create an environment that mirrors a plausible real organisation's architecture — not just a collection of isolated vulnerable machines — so that lateral movement and persistence techniques can be practised in context
The Employer Perspective: What SOC Managers Say They Cannot Find
The language that practitioners use to describe the skills gap and the language that hiring managers use to describe the same phenomenon are strikingly different, and the difference illuminates what is actually missing.
Practitioners describing the gap say: "I need more experience. I need someone to give me a chance. The certifications say I know this material."
Hiring managers describing the gap say: "I need someone who can sit down with a messy alert and work through it without needing me to explain each step. Someone who makes decisions and can explain their reasoning. Someone who has clearly been in the middle of something hard and figured it out."
These are not the same complaint viewed from different angles. They are describing different things. The practitioner is focused on access to environments that would produce experience. The hiring manager is focused on evidence of judgment and independence.
What SOC managers specifically report as the most acute shortage in 2026:
The ability to distinguish signal from noise without a playbook.
In a corporate SOC, the ratio of benign alerts to actual security events is often 99:1 or higher. The analyst who can reduce this noise efficiently — who can look at 200 alerts in a shift and identify the 3 that warrant deep investigation and the 197 that can be closed with confidence — is extraordinarily valuable. This capability is built through exposure to large volumes of real or realistic alert data and develops through repeated judgment about what matters and what does not. It cannot be acquired through study.
The ability to write and maintain detection logic.
Many organisations have inherited SIEM deployments with detection rules that were configured years ago by people who no longer work there. These rules have never been reviewed against current attacker techniques, have high false positive rates, and cover a fraction of the MITRE ATT&CK framework. The analyst who can evaluate existing detection coverage, identify gaps, write new rules, test them against realistic data, and iterate on their logic is addressing one of the highest-priority operational needs in most security teams.
The ability to investigate without an internet connection.
This sounds unusual but it reflects a specific failure mode that hiring managers have learned to screen for: candidates who, when faced with an unknown tool or technique during an investigation, immediately search for the answer online rather than reasoning from what they know and what they can observe. In a real incident response scenario, internet access may be restricted. More importantly, the ability to reason from observables rather than pattern-match from documentation is what distinguishes an analyst from a skilled searcher.
The India Market Specifically: Where Demand Is Concentrated
The cybersecurity skills gap discussion is often framed around Western labour markets. The India market in 2026 presents a specific and somewhat different picture that practitioners based in India need to understand.
India's cybersecurity workforce has grown significantly over the past decade, driven by the growth of the IT and BFSI (Banking, Financial Services, and Insurance) sectors, the expansion of global capability centres (GCCs) operated by multinational organisations, and the increasing maturity of domestic cybersecurity regulation under CERT-In directives and RBI guidelines.
The demand concentration in India in 2026 is specifically in:
Global Capability Centres (GCCs) of multinational corporations: These organisations need practitioners who can operate at global standards while being cost-effective compared to equivalent roles in Western markets. GCCs increasingly run Tier 2 and Tier 3 SOC functions, detection engineering, and threat intelligence operations. The skill requirements are equivalent to those of the parent organisation's security team — not a diminished version of them.
BFSI sector compliance and security operations: RBI's cybersecurity framework, SEBI's increasing security requirements for regulated entities, and IRDAI directives have created significant demand for security professionals who understand both the technical requirements and the regulatory context. This is a compound skill requirement: not just security capability, but security capability understood through a specific regulatory lens.
Product security at Indian technology companies: Companies like Zomato, Razorpay, Zepto, and others operating at scale have developed security programmes that are competitive with global standards. These organisations need practitioners who can work in rapid-iteration product environments — people who understand how security integrates with DevOps and cloud-native infrastructure, not people who apply traditional security frameworks to modern stacks.
The salary differentials in India for practitioners who close the capability gap — who can demonstrate the practical capabilities described earlier in this article — are significant. The gap between a certified but capability-undemonstrated analyst and a demonstrably capable mid-level practitioner in terms of compensation can be two to three times the base salary of the former.
Building a Capability Portfolio From Zero: The 12-Month Path
The most practical question for practitioners who understand the gap is how to close it within a realistic timeframe. The following is a specific twelve-month capability development pathway oriented toward demonstrable practitioner capability, not certification accumulation.
Months 1-2: Foundation and environment setup
The first two months are not about learning new material — they are about building the infrastructure for demonstrable learning.
- Set up a home lab environment that includes a SIEM (Elastic or Splunk free tier), at minimum one Windows Active Directory domain, one Linux web server, and an attacker machine running Kali Linux
- Create a public GitHub repository or a blog that will serve as the portfolio artefact repository — every subsequent piece of work goes here
- Complete a structured technical course on a specific domain (web application security, network analysis, or detection engineering) to establish baseline vocabulary — but treat this as preparation, not the work
Months 3-5: CTF and offensive technique exposure with documentation
- Participate in at least three Capture the Flag events (TryHackMe, HackTheBox, PicoCTF) or work through a curated set of unguided challenges
- For every challenge completed, write a detailed methodology writeup — not a walkthrough, but a documentation of your reasoning, the hypotheses you formed, the dead ends you explored, and how you ultimately solved the problem
- Publish every writeup publicly — the visibility does not matter initially, the fact of publication produces artefacts evaluable by a hiring panel
Months 6-8: Detection and response focus with MITRE ATT&CK
- Select ten techniques from MITRE ATT&CK and, for each one:
- Execute the technique in your home lab environment against your own infrastructure
- Capture the logs that the technique generates
- Write a SIEM detection rule that would catch the technique
- Evaluate the rule: what legitimate activity might it catch? What variations of the technique would it miss?
- Document the technique execution, the detection rule, and your evaluation as a single artefact
- This produces ten detection engineering writeups that demonstrate exactly the capability that SOC managers say they cannot find
Months 9-10: Threat intelligence operationalisation
- Select a threat actor group that targets an industry sector you are interested in (healthcare, financial services, technology)
- Using publicly available threat intelligence (MITRE ATT&CK groups, vendor reports, CISA advisories), produce an original analysis that:
- Maps the threat actor's known techniques to the specific defensive environment of a simulated organisation
- Identifies the three highest-priority detection improvements for this specific scenario
- Recommends specific detection rules or hunting queries to address each gap
- Publish this as a detailed writeup
Months 11-12: Incident response tabletop and communication
- Complete at least two incident response tabletop exercises — either organised events or scenarios you construct yourself based on real breach case studies
- For each tabletop, document your decision-making process: what information did you have at each decision point? What did you decide? Why? What would you have done differently?
- Practice the communication component specifically: take your technical findings from any investigation and write two versions — a technical version for a security peer and a non-technical version for a board-level audience
By month twelve, you have a portfolio that includes: published CTF writeups demonstrating investigative methodology, ten detection engineering artefacts demonstrating rule construction and evaluation, original threat intelligence analysis, and documented incident response decision-making. This portfolio directly addresses the four capabilities that hiring panels evaluate in 2026.
The Mid-Career Transition Problem: Different Gap, Same Diagnosis
Everything described so far about the skills gap has a specific amplification for mid-career professionals attempting to transition into cybersecurity from adjacent fields — IT operations, software development, compliance, audit, or risk management.
Mid-career transitioners often underestimate the size of the capability gap because they correctly identify skills that transfer — understanding of how networks and systems work, experience with regulated environments, familiarity with risk frameworks — and assume these transfers provide more of a head start than they actually do.
The skills that transfer in a cybersecurity context:
- Network and systems operations experience: transfers well to understanding attack surfaces, less well to understanding attacker methodology
- Software development experience: transfers extremely well to application security and secure code review, moderately well to detection engineering
- Compliance and audit experience: transfers well to governance, risk, and compliance (GRC) roles, does not transfer to technical security operations roles
- Risk management experience: transfers well to understanding risk context, does not transfer to hands-on investigation
The category mistake that mid-career transitioners frequently make is positioning themselves for technical security operations roles (SOC analyst, detection engineer) when their background more naturally positions them for security engineering, GRC, or product security roles. This is not a lesser career path — GRC, cloud security architecture, and application security roles are well-compensated and in high demand. It is simply a different path, and the portfolio required to demonstrate capability looks different.
Mid-career transitioners who are targeting technical operations roles specifically should expect to spend the twelve-month portfolio development period while continuing to work in their current role — and should accept that the transition timeline is longer than for candidates without prior careers to maintain.
What Strong Candidates Do Differently in 2026 Interviews
Understanding the capability evaluation and building the portfolio are the preparatory steps. The hiring process itself — specifically the interview and technical assessment — requires a specific approach that differs from how most candidates prepare.
The candidates who perform best in 2026 security interviews share several specific behaviours:
They think aloud deliberately and structurally.
When given a technical challenge — an alert to investigate, a detection rule to evaluate, a scenario to respond to — strong candidates narrate their reasoning as they work through it. Not as a performance, but because they have practised working through problems by explaining their thinking to themselves. This narration serves two functions: it helps the interviewer understand whether the candidate is approaching the problem correctly even before they reach a conclusion, and it demonstrates the analytical process that distinguishes practitioners from people who have memorised solutions.
They acknowledge uncertainty directly rather than hiding it.
When strong candidates encounter something they do not recognise — a specific tool, an unfamiliar log format, an attacker technique they have not seen before — they say so immediately and describe how they would approach it. "I haven't seen this specific format before, but based on these characteristics I would start by investigating this field because..." is a significantly stronger answer than a confident wrong interpretation.
Interviewers conducting technical assessments are specifically watching for whether candidates will bluff or acknowledge uncertainty. A candidate who acknowledges not knowing something and demonstrates a sound approach to working with unknowns is more trustworthy in a production environment than a candidate who answers confidently and incorrectly.
They connect technical findings to business impact without being prompted.
After investigating a scenario, strong candidates contextualise their technical findings in business terms. "This finding represents exfiltration of data from the finance server, which would affect our regulatory reporting obligations under..." is more valuable communication than "I found evidence of data moving to an external IP on port 443." The business context is not an embellishment — it is often the most important part of the communication.
They have something specific to show when asked "tell me about a project you worked on."
The most differentiating interview moment in 2026 is the portfolio walkthrough. Strong candidates can say: "Here is a detection rule I wrote for T1059.001 — PowerShell command execution. Here is the lab environment I tested it in. Here is my evaluation of where it fails. Here is the variation of the technique that would evade my rule, and here is how I would improve the rule to catch it." This is a specific, verifiable demonstration of the capability that the hiring panel is evaluating.
The New Training Paradigm: What Good Security Education Looks Like in 2026
The skills gap is not solved by the market alone. It is also a supply-side problem in security education — and understanding what distinguishes education that closes the capability gap from education that produces certification holders is important for practitioners choosing where to invest their development time and money.
Good security education in 2026 has the following observable characteristics:
Unguided challenge environments alongside guided instruction.
The course structure includes components where learners must investigate, build, or analyse without a prescribed solution path. These components produce the investigative judgment that guided learning cannot. Good programmes include regular unguided work and evaluate it based on reasoning quality, not correctness of answer.
Real scenario exposure rather than fabricated classroom examples.
Scenarios, case studies, and lab environments derived from actual incidents and real-world configurations produce the contextual familiarity that abstract instruction cannot. The practitioner who has worked through a case study based on a real SOC incident — understanding the alert volume, the ambiguous data, the time pressure, and the escalation decisions — has developed intuitions that the practitioner who has only studied the concepts has not.
Output-oriented assessment with external evaluability.
Assessment formats that produce work — reports, detection rules, investigation writeups, incident timelines — rather than test scores create the portfolio artefacts that the market uses to evaluate candidates. The best security education produces learners with something to show, not learners with a new score to display.
Practitioner mentorship alongside instructional content.
Understanding what the actual work looks like from someone who does it — not just someone who teaches it — closes the gap between theoretical knowledge and operational context. Practitioners who have worked in SOC environments, conducted penetration tests for real clients, and responded to real incidents can answer questions that instruction alone cannot: What do you actually do when you cannot figure out what the alert means? How do you make the call on whether to escalate? What does a real incident response feel like at 2am on a Tuesday?
The quality indicator for security education is whether it produces artefacts or scores. Artefacts are evaluable by hiring panels. Scores are not — because enough scores have been achieved through paths that do not indicate capability.
Closing: The Capability Gap Is Closeable — But Only With the Right Evidence
The cybersecurity skills gap in 2026 is real, specific, and consequential. But it is not the vague, structural problem that "skills gap" language suggests. It is a specific mismatch between the evidence of capability that the market needs to see and the evidence that the standard development pathway produces.
The gap closes when practitioners understand exactly what hiring panels are evaluating — judgment under uncertainty, detection logic fluency, threat contextualisation, and communication under pressure — and build development programmes oriented toward producing evidence of those capabilities rather than accumulating credentials that proxy for them.
This article has described what the gap looks like and how to close it. The adjacent challenges that follow — the ones that practitioners at the edge of this understanding inevitably start asking about — go deeper into the specific domains that hiring panels evaluate.
How do you build detection rules for the specific MITRE ATT&CK techniques that are most relevant to your target industry's threat landscape? What does a real Tier 2 SOC investigation look like — the actual thought process from alert receipt to escalation or closure — and how do you develop that judgment without having worked in a production SOC? How do you produce threat intelligence analysis that is operationally useful rather than descriptively accurate?
These questions require more than theoretical study. They require working through realistic scenarios under the guidance of practitioners who have done this work in production environments.
Meritshot's Cyber Security programme is built around exactly this development model. The curriculum places learners in realistic scenarios from the first week — alert investigations derived from real SOC data, detection engineering exercises evaluated for logic quality not just correctness, threat intelligence analysis grounded in specific industry contexts. The mentorship layer connects learners with practitioners who have worked in BFSI security operations, GCC security teams, and product security organisations across India's technology sector. The assessment model is output-oriented: by the end of the programme, learners have the portfolio artefacts that the 2026 hiring market actually evaluates — not just the certification score that the hiring manager will assume is present but will not depend on.
If this article clarified what the capability gap actually is and why closing it requires a different development approach, Meritshot is where that approach becomes a structured, mentored, output-oriented programme.
