NIS2 and IT Hiring: What the New EU Directive Means for Your Team
The EU NIS2 directive is now enforceable. If your company has 50+ employees or EUR 10M+ revenue in a covered sector, you need dedicated cybersecurity staff. Here is what you need to know.
Who Is Affected?
NIS2 covers 18 sectors including energy, transport, banking, healthcare, digital infrastructure, ICT services, and manufacturing. The threshold is 50+ employees OR EUR 10M+ annual revenue. This captures thousands of mid-size companies that were never regulated before.
What NIS2 Requires
- !Risk assessment and security policies (documented)
- !Incident handling and reporting (24h initial, 72h full report)
- !Supply chain security assessments
- !Vulnerability management and disclosure
- !Management body accountability (board-level responsibility)
Roles You Need to Hire
Board-level accountability requires a named responsible person
Implement and maintain technical security controls
Governance, Risk, Compliance — documentation and audits
24h incident detection and response capability
Non-Compliance Penalties
Essential entities: up to EUR 10M or 2% of global turnover. Important entities: up to EUR 7M or 1.4%. Management can be held personally liable. These are not theoretical — enforcement has begun.
Critical: Board members can face personal fines and temporary bans from management positions. NIS2 is not just an IT issue — it is a board-level governance requirement.
Timeline: When to Act
Gap assessment — identify what NIS2 requires vs. what you have
Hire or appoint a CISO / Security Lead as the accountable person
Implement incident response plan and reporting procedures
Build security team (engineer + GRC + SOC coverage)
Supply chain assessments, regular audits, staff training
Why NIS2 Security Talent Is Hard to Find
The global cybersecurity talent gap exceeds 3.5 million positions. In the EU alone, NIS2 creates demand for an estimated 100,000+ new security roles. The problem: experienced CISOs and GRC specialists were already scarce before NIS2.
This is where multi-market sourcing becomes critical. A CISO in Turkey costs 40-60% less than in Germany while bringing the same certifications (CISSP, CISM) and often more hands-on experience from emerging-market threat environments. Remote-first security teams are not just possible — they are increasingly the norm.
Security-Personal fuer NIS2 gesucht?
Wir finden CISOs, Security Engineers, and GRC specialists across 4 markets. Erfolgsbasiert.
Kostenlose Erstberatung