{"id":2330,"date":"2025-03-13T06:00:00","date_gmt":"2025-03-13T06:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2330"},"modified":"2025-03-13T06:00:00","modified_gmt":"2025-03-13T06:00:00","slug":"hiring-privacy-experts-is-tough-heres-why","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2330","title":{"rendered":"Hiring privacy experts is tough \u2014 here\u2019s why"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The demand for privacy professionals<\/a> is soaring, but hiring an expert in this field is proving to be a significant challenge. According to ISACA\u2019s State of Privacy 2025 survey<\/a>, 73% of organizations indicate that \u201cexpert-level\u201d privacy professionals are the most difficult to hire. The results reflect the insights of more than 1,600 privacy professionals worldwide. The reasons behind this shortage are complex, spanning unrealistic job expectations, budget constraints, and the evolving nature of privacy itself.<\/p>\n

What do privacy professionals do?<\/h2>\n

Responsibilities vary widely depending on the organization\u2019s structure and industry, making hiring difficult due to the diversity of roles within the privacy field. Safia Kazi, ISACA principal, privacy professionals practices, explains how some privacy professionals are legal and compliance-focused, such as ensuring whether an organization is adhering to regulations like GDPR<\/a>, conducting privacy impact assessments, developing privacy policies, and advising on what data can and cannot be collected, used, or shared. Others, she says, can take on more technical roles, working in data science, where they assess which data qualifies as personal information, build privacy-enhancing technologies, or design systems that minimise data collection.<\/p>\n

There are also privacy professionals who can be embedded in software development teams, Kazi says, pointing to how they could be responsible for integrating privacy by design principles into products and systems from the ground up. Privacy expertise is increasingly expected in user experience and user interface design, where professionals ensure that privacy choices are clear and free from deceptive patterns. \u201cFor the most part, people fall into one or potentially both technical or legal and compliance privacy,\u201d she says.<\/p>\n

The nature of privacy work also varies by country, which adds another layer of complexity. \u201cThe privacy space is largely underpinned by legislation, which varies from country to country. Cybersecurity, on the other hand, tends to revolve around technology, and as a result is more agnostic and universal,\u201d Michael Trovato, managing partner at IIS and former EY cybersecurity lead partner, says. \u201cYou can take a cybersecurity expert in Australia and the US, and they would have similar conversations about cybersecurity,\u201d but when it comes to discussion about privacy, it\u2019s quite different and there\u2019s a real disconnect, he adds.<\/p>\n

Why it is difficult to hire privacy experts<\/h2>\n

Finding a highly skilled privacy professional can feel like chasing a unicorn, Kazi describes. \u201cYes, privacy is important, but they want somebody who\u2019s a lawyer, an expert in technology, knowledgeable about user interface and user experience, and ideally, they know a lot about ethics and are an AI expert as well. And yet, the position does not pay very much. That\u2019s a serious challenge,\u201d she says.<\/p>\n

Adding to the problem, 43% of organizations report their privacy budget is underfunded, and 48% expect budget cuts in 2025. A key issue is that many organizations conflate privacy with security, assuming that funding one automatically covers the other. Kazi warns against this misconception, especially when cybersecurity professionals are just as \u2013 if not more \u2013 burned out and understaffed.<\/p>\n

\u201cSome organizations think, \u2018Well, we\u2019re funding security, and privacy is basically the same thing, right?\u2019 And I think that\u2019s really one of my big concerns,\u201d she says.<\/p>\n

This blending of responsibilities is reflected in training practices, according to Kazi, who notes how many organizations combine security and privacy training, which isn\u2019t inherently problematic, but it carries risks. \u201cOne of the questions we ask in our survey is, \u2018Do you combine security training and privacy training?\u2019 Some organizations say they do not necessarily see it as a bad thing, but you can \u2026 be doing security, but you\u2019re not doing privacy. And so that\u2019s what\u2019s highly concerning is that you can\u2019t have privacy without security, but you could potentially do security well without considering privacy.\u201d<\/p>\n

As Trovato emphasizes, \u201ccybersecurity people tend to be from Mars and privacy people from Venus\u201d, yet he also observes how privacy and cybersecurity professionals are often grouped together, adding to the confusion about what skills are truly needed. \u201cThe people having the discussion about privacy tend to be over here in the security space and so they just make confidentiality equal privacy, but of course that\u2019s not privacy,\u201d he says.<\/p>\n

\u201cPrivacy includes how are we using data, how are you collecting it, who are you sharing it with, how are you storing it \u2014 all of these are more subtle component pieces, and are you meeting the requirements of the customer, of the regulator, so it\u2019s a much more outward business focus activity day-to-day versus we\u2019ve got to secure everything and make sure it\u2019s all protected.\u201d\u00a0<\/p>\n

What CISOs need to know about hiring privacy talent<\/h2>\n

Even when companies find qualified privacy professionals, retaining them is another challenge. The ISACA report found that 63% of privacy professionals say their role is more stressful now than five years ago. Rapid technological evolution (63%), compliance challenges (61%), and resource shortages (59%) were cited as key stressors.<\/p>\n

Given these challenges, how can organizations successfully hire privacy professionals? Kazi suggests that companies need to take a more strategic approach.<\/p>\n

\u201cWhat organizations need to do is figure out their biggest need with this privacy role. Do we need somebody who knows our applications really well? If that\u2019s the case, there might be someone at your organization who has helped develop or acquire those, and perhaps you can provide them with on-the-job training and encourage them to obtain some privacy-related certifications,\u201d she says. \u201cThat way, they have the technical expertise you\u2019re looking for, and you can teach them the privacy aspect. This way, you\u2019re not posting a job and potentially spending a long time trying to find the right person. I think looking internally can be really helpful.\u201d<\/p>\n

Greater internal collaboration is also crucial \u2014 not just for improving privacy operations but for attracting and retaining talent. ISACA\u2019s report found that only one-third of privacy professionals regularly work with product and business development teams.<\/p>\n

\u201cMake sure that you are facilitating privacy by design as soon as possible,\u201d advises Kazi. \u201cIf you\u2019re embarking on a new initiative, invite someone from the privacy team to the kick-off meeting so they\u2019re included. Ultimately, this ensures that privacy is better embedded into projects, and the privacy team\u2019s work becomes much easier because they\u2019re not coming in at the last minute saying, \u2018We can\u2019t do this\u2019 or \u2018We need to revise this\u2019. Instead, their work is more integrated and aligned with other business objectives.\u201d<\/p>\n

Trovato agrees, pointing out that there is an opportunity for privacy professionals to help build out what he dubs as the \u201coperational aspects of privacy\u201d. He says that privacy professionals should not just be seen as compliance enforcers but should be going beyond policies and frameworks to influence leadership, culture, and organizational resilience \u2014 and ensure privacy is integrated in both business processes and broader security efforts.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The demand for privacy professionals is soaring, but hiring an expert in this field is proving to be a significant challenge. According to ISACA\u2019s State of Privacy 2025 survey, 73% of organizations indicate that \u201cexpert-level\u201d privacy professionals are the most difficult to hire. The results reflect the insights of more than 1,600 privacy professionals worldwide. […]<\/p>\n","protected":false},"author":0,"featured_media":2312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2330","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2330"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2330"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2330\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/2312"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}