Ask any CTO at an endpoint security company what slows their roadmap, and the answer is rarely ideas or funding. It is people who can write, debug and ship production kernel code. Kernel engineers are among the scarcest specialists in software, and demand for them has grown as attackers target the kernel and platform vendors raise the bar for anything that runs there.
This post looks at the evidence on the talent gap, what it costs, and how security product companies in the US and Europe are closing it through offshore teams and specialist partners.
A skills gap, not just a headcount gap
The ISC2 2025 Cybersecurity Workforce Study, based on 16,029 professionals, marked a turning point. For the first time, ISC2 did not publish a global workforce gap estimate (its 2024 study had put the gap at 4.8 million), because respondents emphasized specific skills needs over headcount. The findings are stark:
- 95% of respondents reported at least one skills need.
- 59% reported critical or significant skills needs, up from 44% in 2024.
- 88% said their organization experienced at least one significant cybersecurity consequence because of a skills shortage, and 69% experienced more than one.
ISC2's leadership summarized the shift plainly: the most pressing concern for cybersecurity teams is now skills, not headcount. Kernel and systems engineering is an extreme case of exactly that problem.
Why kernel engineers are so hard to find
Kernel development combines skills that rarely appear in one person:
- Deep OS internals: Windows I/O manager, memory manager and object model; Linux kernel subsystems, eBPF and LSM; macOS system extensions and the Endpoint Security framework.
- Systems languages and debugging: C and C++, increasingly Rust, plus kernel debuggers such as WinDbg, crash dump analysis and race-condition hunting.
- Security domain knowledge: attacker techniques, anti-tamper design and BYOVD defense.
- Release discipline: Microsoft driver signing and attestation, HVCI compatibility, hardware compatibility testing and staged deployment.
Universities produce few graduates with this profile, and the learning curve is long because mistakes crash machines rather than throw exceptions. The 2024 CrowdStrike outage, which crashed an estimated 8.5 million Windows devices, has made employers even more cautious about hiring juniors into kernel roles without senior oversight.
What kernel talent costs in the US and Europe
United States
Salary data shows the premium. Glassdoor reports an average US salary for a Kernel Developer of $201,737 per year as of July 2026, with a typical range of $158,044 to $262,158, based on 34 submitted salaries. ZipRecruiter's data, which reflects a broader set of postings, puts the average for Windows kernel developers at $134,970, so treat any single figure with caution: compensation varies widely by employer, clearance requirements and location. Employer-posted ranges at large technology firms for Windows OS and driver-focused roles commonly run from about $135,000 to over $300,000 in base pay.
United Kingdom and Europe
In the UK, ITJobsWatch reports a median advertised salary of £70,000 for Senior Embedded Software Engineers in the six months to 29 September 2026, up from £60,000 a year earlier, with the 10th to 90th percentile spanning £55,000 to £90,000. That is a proxy, since kernel-specific UK data is thin, but the year-on-year rise signals tightening supply for low-level skills.
The hidden cost of an open role
Salary is only part of the cost. Add recruiter fees, benefits, equity, tooling and the months of lost roadmap time while a role stays open. A senior kernel position left vacant can delay a sensor release by quarters, which in a market growing at double digits is the most expensive cost of all. That is the same market where kernel depth has become a competitive advantage.
How offshoring and partnering are closing the gap
India's GCC landscape
Global companies are increasingly sourcing deep engineering talent in India, and not only for cost. The Zinnov-nasscom India GCC Landscape Report FY2026 counts 2,117 global capability centers (GCCs) in India, with about 110 new GCCs established between early 2024 and late 2025. Zinnov reports that mid-market GCCs, more than 480 centers employing over 210,000 professionals, have a 1.5 times higher share of talent in AI, cloud, cybersecurity and data science. According to Zinnov's Mega GCC Report 2025, mega GCCs make up just 5% of India's GCC count but employ nearly 50% of the total workforce, with around 43% of that workforce in engineering and R&D.
Three sourcing models
For a cybersecurity product company, the options look like this.
Own GCC
Maximum control and long-term scale, but it takes time, entity setup and a local leadership team, and it does not solve the scarcity of senior kernel specialists on day one.
Specialist engineering partner
A ready team of kernel engineers who already understand drivers, signing and testing, engaged under your IP and security controls. Faster to start and easier to scale up or down.
Hybrid
An in-house architecture core in the US or Europe, extended by a partner team that later transitions into your own GCC if you choose.
Regulatory context on both sides
For US and European buyers, the partner must support obligations such as SEC incident disclosure, NIS2, DORA (which has applied to EU financial entities and their ICT third-party providers since 17 January 2025) and the Cyber Resilience Act. For work performed in India, partners must comply with CERT-In's directions, including six hour incident reporting and 180 day log retention, and with the Digital Personal Data Protection Rules notified on 13 November 2025, whose core duties apply from 13 May 2027.
Build, buy or partner: a decision framework
| Question | If yes, lean toward |
|---|---|
| Is the kernel sensor your core long-term differentiator, with a multi-year roadmap? | Build an in-house core, extended by a partner |
| Do you need a production-ready capability in under six months? | Partner, or buy an OEM component |
| Are you competing mainly on analytics and workflow rather than endpoint depth? | Buy or license a sensor |
| Do you need multi-platform coverage (Windows, Linux, macOS) without three separate hiring searches? | Partner |
| Do you lack in-house experience with Microsoft signing, HVCI and staged rollouts? | Partner for delivery and knowledge transfer |
How to evaluate an outsourced kernel partner
Kernel code is privileged code. Vet a partner with the same rigor you would apply to a critical supplier under NIS2 or DORA:
- Proven low-level depth. Ask for anonymized examples of minifilters, callback drivers, WFP callouts, eBPF programs or Endpoint Security clients they have shipped, and run a technical interview led by your own architect.
- IP ownership and protection. Contracts should assign all IP to you, restrict reuse, and specify secure repositories, access controls and offboarding. Ask how source code and signing keys are segregated.
- Secure development practices. Look for code review, static analysis, fuzzing, Driver Verifier and stress testing, and alignment with CISA Secure by Design principles.
- Testing infrastructure. Confirm OS version and hardware matrices, HVCI-enabled test machines, crash dump triage and automated regression suites.
- Signing and release experience. The partner should understand Microsoft's hardware dev center submission, attestation and WHQL options, Apple notarization and entitlements, and Linux kernel version compatibility, while your organization retains control of production signing credentials.
- Staged deployment discipline. Ask how they design for ring-based rollout, health monitoring and rollback, in line with Microsoft's MVI 3.0 expectations.
- Personnel security. Background checks, least-privilege access, device controls and clear policies for any work involving sensitive customer data.
- Communication and time zones. India's time zone allows a near follow-the-sun cycle with US and European teams. Insist on overlap hours, named technical leads and transparent reporting.
A good partner should welcome this scrutiny. A partner who cannot explain how they avoid becoming the next root cause analysis is not ready to write your kernel code. Use our coverage of threat detection trends and remediation components to set the technical bar for that conversation.
FAQ
Why is there a shortage of kernel developers?
Kernel development requires rare combinations of OS internals, systems programming, debugging and security expertise, with a long learning curve. Few universities teach it in depth, and employers are reluctant to put juniors on kernel code without senior oversight.
How much does a kernel developer earn in the US?
Glassdoor reports an average of $201,737 per year for US kernel developers as of July 2026, though other sources such as ZipRecruiter show lower averages around $135,000. Pay varies widely by company, specialty and location.
Is it safe to outsource kernel driver development?
It can be, with the right controls: clear IP assignment, secure repositories, segregated signing keys that you retain, rigorous testing, staged rollout discipline and background-checked engineers. Evaluate partners as critical suppliers.
Should we set up our own GCC or work with a specialist partner?
A GCC suits companies needing long-term scale and control. A specialist partner suits teams that need senior kernel expertise quickly. Many start with a partner and transition to a hybrid or captive model later.
Talk to our engineering leads
If an open kernel role is holding your roadmap hostage, you do not have to wait for the perfect hire. VoidStarIndia provides dedicated kernel engineering teams for Windows, Linux and macOS security products, working under your IP, security and release controls.
Schedule a call with a VoidStarIndia engineering lead to scope a pilot, review our engineering and security practices against the checklist above, and decide whether a partner, hybrid or in-house model fits your plans.
Sources
- ISC2 2025 Cybersecurity Workforce Study (December 2025)
- Glassdoor, Kernel Developer salaries (2026)
- ZipRecruiter, Windows Kernel Developer salary data (September 2026)
- ITJobsWatch, Senior Embedded Software Engineer UK data (September 2026)
- Zinnov-nasscom India GCC Landscape Report FY2026 and Mid-Market GCC Report FY2025
- Zinnov, Mega GCC Report 2025
- European Commission, NIS2 Directive questions and answers
- DORA, Regulation (EU) 2022/2554
- CERT-In Directions under Section 70B (April 2022)
- Digital Personal Data Protection Rules 2025
- CISA, Secure by Design Pledge
- Microsoft Windows Experience Blog, MVI 3.0 (June 2025)