Cyber workforce

The Cyber Workforce Playbook, and what it means if you cannot hire a security team.

Home Affairs published the Australian Cyber Workforce Playbook in October 2025 to help organisations build security skills. It is guidance, not a law, and its core idea suits small businesses too: start from the security work that needs doing, then decide what to develop, hire or buy. Here is what it says, what security people cost in 2026, and how to choose.

Workforce figures from Jobs and Skills Australia. Salaries from Robert Half 2026 benchmarks.

Talk about co-managed security Cost a security hire 07 3114 2808

What the playbook says
2026 salary ranges
True cost of a hire

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An experienced engineer mentors a young IT trainee at his laptop in an office on a country town main street. — **Start here**List the security tasks, who does them now, and who covers them when that person is away.

Building skills

Four pathways the playbook describes.

Each can work. None is proof of job readiness on its own.

Vocational education and TAFE

Certificate and diploma study can build networking, systems and security foundations. Compare the actual syllabus, practical exercises and employer placement arrangements rather than treating a qualification title as proof of job readiness.

Applied learning
Check the syllabus
Placements matter

Security hire cost calculator

What does one security hire really cost?

Pick a role and where it sits in the 2026 salary range. Add your own recruitment, training and tool costs.

What one security hire really costs in the first year, using published 2026 salary ranges and your own figures for the rest.

Role

Where in the salary range

Recruitment fee, % of salaryYour own figure. Zero if you recruit directly.Training and certifications per year, A$Extra tools this role needs per year, A$

First-year cost

A$205,025then about A$181,400 a year

Salary	A$157,500
Super at 12%	A$18,900
Recruitment	A$23,625
Training	A$5,000
Tools	A$0

One person covers business hours only. Leave, sick days and after-hours response still need a plan. Salary ranges exclude bonuses and benefits.

Compare with co-managed security

By the numbers

The workforce, by the numbers.

~70,900People in the combined database, systems administration and ICT security occupation group, August 2025. Not a count of cyber specialists alone.
14.2%Projected employment growth for that occupation group from May 2024 to 2029, according to Jobs and Skills Australia.
6.6%National employment growth projection over the same period, provided by JSA as a comparison.
Shield 5The 2023-2030 Australian Cyber Security Strategy pillar supporting sovereign capabilities and the workforce playbook.

Jobs and Skills Australia counts a combined occupation group, not cyber specialists alone or vacant jobs.

2026 benchmarks

What security roles pay in 2026.

Role	Salary range (AUD)	Notes
Network security engineer, Brisbane	$121,200 to $156,550	Robert Half 2026 Brisbane benchmark. Network controls, secure configurations, vulnerability treatment and technical investigation. Define any identity, cloud or OT duties separately.
Cyber security specialist, national	$135,000 to $180,000	Robert Half 2026 national benchmark. A broad title: specify whether the job is detection, engineering, assurance or a combination before comparing salaries.
Cyber security manager, national	$160,000 to $205,000	Robert Half 2026 national benchmark. Delivery priorities, team management, supplier coordination and security reporting. Confirm the hands-on work and decision authority.
Chief information security officer, national	$220,000 to $305,000	Robert Half 2026 national benchmark. Security strategy, executive risk reporting and programme leadership. The role still needs technical delivery and a named business risk owner.

Robert Half 2026 ranges exclude superannuation, bonuses and benefits.

For a small business

Realistic options when you cannot build a security team.

Hire an internal security leadUse when there is enough ongoing work, authority and delivery support for the role. Budget against a defined job description, not a company-size rule. Plan backup coverage before the person takes leave.
Use co-managed ITRetain business and operational knowledge internally while assigning agreed technical work to a provider. Specify tools, monitoring coverage, response authority and evidence delivery in the scope.
Use a virtual CISOAdd security leadership, risk reporting and programme oversight without assuming a full-time appointment. Agree deliverables, decision rights and contact availability; advisory time is not a substitute for incident response cover.
Develop existing staffMap the gap between current and required tasks. Combine relevant study with supervised work, protected learning time and a way to demonstrate competence on the systems the business uses.
Create a supervised entry pathwayConsider a trainee or junior role when a qualified supervisor and appropriate tasks are available. Confirm provider and incentive requirements rather than assuming funding or a minimum business headcount.

Watch for

Common workforce mistakes.

Making one person the entire security functionSeparate engineering, monitoring, incident coordination, governance and risk approval. One employee may cover several tasks, but leave, after-hours coverage and independent review still need a plan.
Treating cyber security as an IT-only responsibilityHR owns employment changes, finance owns payment controls, operations owns safe service delivery and leaders accept business risk. Give each function a defined security responsibility.
Outsourcing without documenting accountabilityAssign implementation, monitoring, escalation and approval separately. A provider can perform the work; your organisation still needs to understand and manage its own obligations.
Buying training without checking skillsCourse attendance and a certificate are not evidence that a person can perform the required task. Combine learning with supervised exercises, feedback and a recorded competence review.
Assuming location alone proves suitabilityCheck contract, clearance, privacy, support-access and data-handling conditions. Australian location is not proof of competence, and an offshore restriction must come from the actual requirement.

Our view

Keep the decisions in-house. Buy the coverage.

For most small and mid-sized businesses, the useful split is simple. Keep the decisions inside: who approves access, who accepts risk, who signs off payments. Buy the coverage you cannot staff: 24/7 monitoring, specialist engineering and incident response.

Co-managed IT and a virtual CISO sit in between. They let an internal IT person or manager stay in charge while the provider supplies depth, after-hours cover and someone to step in when that person is on leave.

Planning

A workforce plan in six steps.

Step 1List the tasks
Monitoring, access, backups, patching, incidents, reporting.
Step 2Find the gaps
Missing skills, single points of failure, no after-hours cover.
Step 3Decide each one
Develop, hire or buy, with how competence is shown.
Step 4Write down who decides
Delivery, approval, escalation and risk acceptance.
Step 5Practise
An incident handover and an access change, with the backup person.
Step 6Review
As systems, staff and obligations change.

Cannot staff it all? Here is how to fill the gap.

Co-managed IT, a virtual CISO and 24/7 monitoring.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about the Cyber Workforce Playbook.

What is the Australian Cyber Workforce Playbook?

It is an October 2025 guidance publication developed through the Executive Cyber Council workforce working group and published by Home Affairs. It supports Shield 5 of the Australian Cyber Security Strategy and covers workforce design, skills-first development, priority roles, emerging technologies and inclusion. It is guidance, not a certification or a new staffing law.

How large is the Australian cyber security workforce?

Jobs and Skills Australia counts a combined database, systems administration and ICT security occupation group, which is not a count of cyber specialists alone or a measure of vacant positions. Its 2026 Occupation Shortage List shows the remaining shortage concentrated in governance, architecture, advice and penetration testing roles, while cybersecurity engineers, operations coordinators and analysts came off the list.

Can a small business use the playbook without hiring a security team?

Yes. Start by assigning necessary tasks, internal decision-makers and backup coverage. Develop existing staff where supervision is available and buy specialist capacity where needed. The right model depends on the work, information and obligations, not an arbitrary employee-count threshold.

How should we budget for a security hire?

Define the role, location and responsibilities before choosing a salary benchmark. Robert Half publishes 2026 salary ranges excluding superannuation, bonuses and benefits. Add applicable super, recruitment, training, tools and coverage costs separately rather than applying an unsupported universal overhead percentage.

What should stay internal when we outsource security?

Keep named business owners for risk decisions, access approval, priorities and supplier oversight. Agree who implements controls, monitors alerts, can contain an incident and provides evidence. Outsourcing technical work does not remove the organisation's own legal and contractual duties.

How do we measure whether our workforce plan is working?

Check whether required tasks have competent owners, backup coverage and evidence of completion. Review access changes, restore tests, alert escalation and incident exercises alongside learning progress and workload. Training attendance or the number of hires alone does not establish effective coverage.

Next step