About Our Inside IR35 Cybersecurity Contract Roles
What does a cybersecurity contractor do?
Cybersecurity contract work spans across a wide range of specialist disciplines to help organisations protect their systems, data, and operations from cyber threats. The cybersecurity contracting market encompasses penetration testing, security architecture, cloud security, application security, security operations, GRC, identity and access management, threat intelligence, and incident response, among other specialisms. Contractors are brought in when organisations need specific expertise they do not hold permanently, when a security programme requires additional resource, or when an incident or audit finding demands rapid specialist engagement.
The skills required vary enormously by specialism. Technical security contractors, such as penetration testers and security engineers, need deep hands-on expertise with attack techniques, security tooling, and the ability to identify and exploit vulnerabilities across a range of system types. Security architects need the ability to design security controls into complex enterprise and cloud environments. GRC professionals need strong knowledge of regulatory frameworks, risk management methodologies, and compliance standards such as ISO 27001, NIST, and CIS Controls. Across all cybersecurity disciplines, the ability to communicate risk clearly to non-technical stakeholders, including boards and senior executives, is increasingly valued as cybersecurity has become a board-level agenda item. Relevant certifications including CISSP, CISM, OSCP, and CREST qualifications are well regarded and frequently required across the market.
What is the market like for cybersecurity contractors?
The Cybersecurity contract market is one of the most active and resilient segments of the UK technology contracting market. Demand is driven by the persistent and evolving threat landscape, increasing regulatory requirements including NIS2, DORA, and the FCA's operational resilience framework, and the structural shortage of permanent cybersecurity professionals across UK organisations. The market has remained strong despite broader technology hiring slowdowns, as cybersecurity spend is largely non-discretionary for organisations handling sensitive data or operating critical infrastructure. Specialist areas including cloud security, application security, and OT security are experiencing the strongest demand growth, while rates across the market remain at a premium to comparable technology disciplines.
What does Inside IR35 mean?
IR35 is UK tax legislation that determines whether a contractor is genuinely self-employed or working in a manner that resembles employment. When a contract is classified as inside IR35, income tax and National Insurance are deducted at source, typically via an umbrella company or agency PAYE. Headline day rates on inside IR35 engagements are generally higher than equivalent outside IR35 roles to account for the tax and employment cost structure.
Inside IR35 determinations are made where the working arrangements are considered to resemble employment, based on factors including the level of client control, the absence of a genuine right of substitution, and the presence of mutuality of obligation. Since April 2021, the end client is responsible for making this determination for medium and large private sector organisations. Many employers in financial services, government, and professional services assess the majority of their contractor engagements as inside IR35.
On QualityContracts.co.uk, approximately 49% of roles with a stated IR35 status are classified as inside IR35, making it the most common arrangement across the contract market. The proportion varies by sector and role type. Each listing on this page displays its IR35 status where provided by the hiring organisation.
What cybersecurity roles are usually Inside IR35?
Cybersecurity leans inside IR35 at around 70% of contracts across contracts with a declared IR35 position. The operational dimension of security work, monitoring threats, managing SIEM platforms, responding to alerts, and maintaining security controls, embeds contractors in the client's security operations centre or information security team. Financial services and government, where cybersecurity is driven by regulatory mandates and the threat landscape demands continuous coverage, account for the majority of inside IR35 cybersecurity work.
How much do cybersecurity contractors usually earn when working Inside IR35?
Contract rates for cybersecurity roles typically range from £500 to £900 per day, depending on the scope of the role, required expertise, and the delivery expectations of the engagement. Inside IR35 rates are typically 15% to 30% higher than equivalent outside IR35 roles to account for tax and national insurance deducted at source by the fee-payer.
How many Inside IR35 cybersecurity vacancies are there on Quality Contracts?
Over the past twelve months, we have tracked over 390 cybersecurity contract roles across the site. Around one third of the roles currently listed on the site fall Inside IR35. Data reviewed up to September 2026.