DevSecOps professions, linked to governance or risk management and compliance, are experiencing renewed interest thanks to new European legislation.
The top 5 most sought-after professions in the cybersecurity remains unchanged since 2019. Architects, consultants, engineers, analysts and cybersecurity experts continue to appear at the top of the most requested profiles in job offers in the sector, according to the study 2025 of the National Information Systems Security Agency (Anssi) dedicated to cybersecurity professions. But behind these job titles lies a more nuanced reality. “The titles in the job offers do not necessarily correspond to very clear professions,” explains Aurélie Bauerhead of the Anssi training center.
“For example, the cybersecurity engineer is sought by 15% of job offers, but it is not really a profession. In fact, many employers do not know anything about cybersecurity. They then indicate this catch-all job title to say that they are looking for a bac +5 who knows about cybersecurity.” This generic name can in fact cover very different professions linked to information system security, incident detection, compliance and risk management, or even to DevSecOps. And among all these different functions, some are more popular than others.
GRC and DevSecOps ride the regulatory wave
The European legislative big bang in terms of cybersecurity, particularly with the adoption of the NIS 2 directive and the Dora regulation, is pushing many companies to recruit professionals in governance, risk management and compliance (GRC), specifies Guillaume Collardco-founder of the CSB School cybersecurity school. These texts in fact require thousands of financial and critical organizations, as well as their suppliers, to strengthen their level of cybersecurity. They must therefore comply with them thanks to consultants, information systems security managers (CISOs), and auditors, capable of contributing to their implementation in organizations.
“Thanks to NIS 2 and Dora, there is strong demand for professions linked to GRC. Companies need it. The proof: they are increasingly seeking support from external CISOs to comply with these regulations and are asking us for training on NIS 2, Dora, ISO 27001, and other standards,” confirms Ylan Elkeslassytraining director at Sysdream, a subsidiary of ESN HubOne which specializes in cybersecurity training. So much so that the salaries of GRC profiles are catching up with those of technical profiles, observes Eva Nabussetcybersecurity recruiter. Thanks to data from the recruitment firm she runs, Rehackt, she estimates, for example, that a senior multi-reference GRC consultant (NIS 2, Dora, GDPR, etc.) can currently be paid between 70,000 and 110,000 euros gross per year.
Another regulation that boosts certain professions: the cyber resilience act (CRA). This European regulation, applied gradually since 2025, requires manufacturers and distributors of products containing digital elements (software, connected objects, applications, etc.) to ensure security by design and throughout their life cycle. This is why the profession of DevSecOps is benefiting from renewed interest in the cybersecurity job market, according to Eva Nabusset. And for good reason, it is the profession that allows cybersecurity to be integrated into the development and operation of software. “It’s a popular profession because of the CRA. We also see that training related to DevSecOps is increasingly in demand,” confirms Ylan Elkeslassy. According to the Rehackt firm, the salary of a DevSecOps engineer is currently between 50,000 and 80,000 euros gross per year.
Favor niche professions
Even if these professions are on the rise, we must not lose sight of the fact that the cybersecurity market remains relatively elitist. The sector suffers more from a shortage of highly qualified talent than from a simple lack of labor, recalls Vincent PoulbèreCEO of Sysdream. He therefore advises instead to favor specialized professions, requiring skills with high added value, and which are increasingly sought after in industrial sectors.
“For example, we know that there is a very significant need for experts in the field of OT. It is therefore better to choose the profession based on this type of sector, which we know is recruiting, and to specialize in it. The value of a cybersecurity profession currently lies in its very specific expertise, like that of security architects”. The security architect designs the overall security structure of an information system or an industrial environment. In industrial cybersecurity, its role is growing as industrial machines gain connectivity. Other specialized professions in the industry are rare and sought after, such as the OT-oriented SOC analyst or the engineer responsible for managing OT vulnerabilities. “In addition, the best paid are those who have these highly specialized jobs and with a very high level of expertise.” Enough to encourage talents to aim for excellence.
