Cisco Layoffs 2026: Network & Security Talent Impact

Cisco Layoffs 2026: Network & Security Talent Impact

Cisco’s 2026 layoffs are a reshuffle, not a retreat. The company is cutting legacy switching, routing, and parts of its Talos and Splunk security orgs to free payroll for AI networking, silicon design, and cloud security hires.

Last updated: April 19, 2026

That framing matters if you’re hiring for a network or security seat this quarter. The headline says Cisco cut people. Everyone knows the headline. The useful story for a hiring manager is which people specifically, which certifications just hit the open market, and how long the window stays open before every clearance-eligible CCIE and every ex-Talos researcher has a new seat. My read below, with the caveat that we benefit whenever displaced senior engineers route through our pipeline. I’ll flag where that tilts the take.

Tom Kenaley at KORE1’s IT staffing practice. We’ve moved roughly a dozen ex-Cisco engineers into new seats since late 2024, so the patterns below are half public reporting, half what’s actually showing up in our queue. If you’re closer to the press-release side of this than the recruiter side, the short version is near the top and the FAQ is at the bottom.

What the 2026 Cisco Cuts Actually Look Like

Cisco announced two large workforce actions in 2024: roughly 4,000 roles in February and another 5,600 in August, totaling about 7 percent of global headcount across the year, per SDxCentral and CFO Dive. Smaller targeted reductions continued through 2025 into 2026.

The most recent public action that anyone has been able to verify from WARN filings is the elimination of 221 positions split across the Milpitas and San Francisco offices, with an effective date in mid-October 2025 that spilled into severance paperwork running through early 2026. Not a headline number. Most of the 2026 activity is stacking up that way. Small, surgical, and spread across product lines.

Two orgs inside Cisco keep showing up in the press and on our inbound resume list as absorbing a disproportionate share of the cuts even though they’re small relative to the company’s total engineering headcount. Talos, Cisco’s threat intelligence unit, lost researchers and analysts in the 2024 cycle and has had further churn since. Splunk, the observability and SIEM business Cisco closed on in March 2024, has seen integration-driven consolidation across sales, support, and some engineering functions. Both are material for what follows, because Talos and Splunk alumni don’t land the same way a core-router engineer does.

One more thing worth saying out loud. Challenger and most trackers count announcements, not separations. A 5,600-role announcement produces fewer than 5,600 day-one departures. Internal transfers absorb a slice. Attrition absorbs more. The real number on the market lags by weeks and usually runs ten to twenty percent lower than the press figure. Count the announcement as a ceiling.

Why This Is a Reshuffle, Not a Shrinkage

Cisco’s net headcount is actually up modestly against 2023. Strange, if you’ve been reading the press coverage. The open reqs skew heavily toward AI networking fabric. Custom silicon. Cloud security. And hyperscale “data center solutions engineering,” which is Cisco-speak for the AI fabric team chasing Meta, Microsoft, and Oracle deals against Arista and Nvidia Spectrum-X. Very different sale than campus switching. Much harder technical conversation. Far higher stakes per account. CEO Chuck Robbins has framed the moves publicly as deliberate payroll reallocation to fund those bets. That’s a CEO line, so read it with the discount that implies. But the hiring data supports it. The legacy switching and routing teams that defined Cisco for three decades are shedding headcount. The optical, silicon, SASE, and AI-adjacent teams are growing.

The reshuffle explains most of what we see coming through the queue in 2026. Senior candidates with two decades of Cisco tenure are showing up on our inbound list with clean resumes and sharp answers about why they’re on the market, and the thing they keep saying in the first screen is that the internal mobility dried up well before the headcount action landed.

Which explains the profile of the candidates coming to us. A senior network engineer with fifteen years on legacy Catalyst and Nexus platforms, CCIE in pocket, strong on traditional enterprise networking and increasingly uncertain about where the next internal role would have come from. That person is more employable right now than the coverage suggests. Just not always at Cisco.

We covered the broader market picture in our tech layoffs 2026 analysis. Cisco is a cleaner version of the same pattern. Oracle and Dell cut on cost discipline after a decade of headcount that was always going to get revisited once capital got expensive again. Meta trimmed Reality Labs to feed AI capex. Cisco is reshaping around the AI infrastructure buildout it needs in order to compete with Arista on fabric and Nvidia on the silicon that sits underneath it. Same playbook, different product line.

Where Displaced Cisco Network Engineers Are Landing

The candidate profile is consistent. Fifteen to twenty years in networking. CCIE or senior CCNP. Deep on Catalyst, Nexus, ASR, Meraki, sometimes ISE and DNA Center. Comfortable in a CLI that hasn’t fundamentally changed since the 2000s. The kind of engineer who can still troubleshoot a multicast PIM sparse-mode problem in a live call with a carrier’s NOC on a Tuesday night, which is a rarer and more commercially valuable skill in 2026 than the press around AI hiring would lead you to believe. What’s different about 2026 is the destinations, which are not what they were in the 2018 or 2022 cycles.

The comp story is nuanced. Cisco paid well, but not hyperscaler well, and the RSU component of total comp swung harder than most candidates realized until the annual refresh hit a stock price that had deflated from its 2024 high by the time the August rounds were announced. A senior principal CCIE at Cisco was in the $185,000 to $240,000 base band, per Levels.fyi, with RSUs that had a lot of upside when the stock cooperated and less when it didn’t. The MSPs and federal integrators are landing offers in roughly the same base band, occasionally higher. The mid-market pullback roles sometimes come in ten to fifteen percent lower on base but ship real equity and a title bump. Our 2026 network engineer salary guide has the full benchmark table if you’re pricing a req.

The Security Side: Talos and Splunk Alumni

Talos was the prestige security research org inside Cisco. Small, visible, and disproportionately respected in the threat intelligence community. When a Talos researcher enters the market, they don’t sit long, because the credential itself narrows the competitive set to maybe six or seven peer shops that can meaningfully absorb someone with that kind of public research profile.

Destinations, in rough order of volume:

• Independent threat intelligence consultancies. Two or three people with Talos on the resume can start a boutique and sign enterprise retainers inside six months, which has happened twice in our direct network since early 2025 and both times the founders took at least one large-account retainer with them on the way out.
• Mandiant, Recorded Future, CrowdStrike Intel, and the MSSP tier. These are the landing pads that pay for the research profile.
• In-house CISO orgs at regulated industries. Banks, healthcare, defense primes. Slower hiring cycles, but the comp structure at a Fortune 100 CISO org now rivals the research shops.

Splunk is a different story. Different pool. Different destinations. The people leaving Splunk post-acquisition mostly aren’t the research profile. They’re sales engineers with a book of named SIEM accounts. Implementation consultants who ran on-prem deployments. Detection content developers. And a layer of product engineering that got consolidated once the Cisco Observability Platform integration plan turned into real org charts in the back half of 2025. Those skills port directly to other SIEMs, Microsoft Sentinel and Google Chronicle most visibly, and to the MDR market. Arctic Wolf, Expel, Red Canary are all hiring out of this pool.

One pattern worth naming. A former Splunk SE with three years of detection content work for a Fortune 500 customer is usually the stronger hire for a CISO trying to mature a SOC. Stronger than a SIEM engineer with every Splunk cert but no customer scar tissue. The certs matter less than the time spent tuning noisy alerts in front of a skeptical VP. The certs matter less than the time spent arguing with a customer about which alerts to tune. Our cybersecurity staffing team places for this profile weekly.

What This Means for Your Network or Security Hire in 2026

Short window. That’s the headline for anyone building a team right now. Not theoretical.

The Cisco displacements are not creating an infinite supply. They are creating a one-quarter-to-three-quarter bulge in availability of specific profiles. Once the federal integrators absorb the clearance-eligible CCIEs and the MSSPs absorb the Talos alumni, the pool tightens back to where it was. Which was already tight. BLS projects network and computer systems administrator roles at roughly 37,100 annual openings through 2034. Information security analysts project 33 percent growth over the same span, one of the fastest-growing categories the Bureau tracks.

If you have a networking or security req open right now and you’re not actively engaging with the Cisco alumni network, you are missing the best sourcing window of the year. Probably the quietest one too. It closes before most comp committees notice the market tightened. Our team averages 17 days from intake to first interview on tech roles, and Cisco-profile candidates are running shorter than that right now because the inbound volume is elevated.

Here’s the concrete playbook we use on intake calls this quarter:

1. Get clear on whether you actually need a Cisco background, or whether the shop is already trending toward Arista, Juniper, or cloud-native fabric. If the latter, a Cisco CCIE is still hirable but you need to underwrite the retool runway.
2. Decide on-prem versus cloud-lean. A former Cisco advanced services engineer with no AWS exposure will take six to twelve months to be productive on cloud networking. Budget for it or screen it out early.
3. Check clearance status first on anything federal-adjacent. TS/SCI eligible candidates are closing fastest.
4. Pay market and do not lowball on the theory that a laid-off candidate has to take what’s offered. Word travels in networking circles. Two cheap offers and you’re flagged.
5. Move fast. The candidates we’ve closed fastest in 2026 have been ones where the first interview happened inside five business days of submittal.

The Certification Question

Cisco certifications are not obsolete. They are not the credential they were in 2015 either, when a CCIE Routing & Switching on a resume was effectively a shortcut to a senior title plus fifteen grand above market without any further conversation.

CCIE still carries weight, particularly in federal, carrier, and large-enterprise environments where the exam’s reputation as the hardest networking cert in the industry still matters. CCNP is table stakes for senior roles. CCNA is an entry-level signal, fine for a junior hire, insufficient alone for senior. Cisco Certified CyberOps Associate and Professional credentials get mixed reactions. Some hiring managers in SOC and security operations treat them as meaningful signal, particularly the CyberOps Professional where the candidate passed the SECOPS 300-215 incident response exam. Others would rather see SANS GCIH, GCFA, or an OSCP. No universal answer.

What has changed is the adjacent credential expectation. A CCIE without any AWS or Azure exposure on the resume now gets screened out of roughly half of the senior networking reqs we see, because the shops hiring at that level have at least some cloud interconnect or cloud-native networking in scope. The usual retool path is AWS Advanced Networking Specialty or the Azure Network Engineer Associate. Three to six months of focused study gets most CCIEs there. Shorter runway than most expect. Routing, VPN, encryption, QoS. It all ports. What’s left to learn is mostly the AWS or Azure control plane primitives and a different operational model.

The KORE1 Take

Cisco is a case study in a pattern we see across the 2026 tech labor market. Companies aren’t cutting for the reasons the coverage says they’re cutting. They’re reshaping. Three of the five strongest placements we closed in Q1 of 2026 came out of companies the trade press was calling shrinking that same quarter, which tells you everything about how coarse the “layoff” framing is when you try to apply it to individual senior engineers with cloud and security depth. Oracle, Dell, Cisco, Salesforce, Meta Reality Labs. The hiring managers on our side who moved fast on those candidates are running teams that are quietly ahead of their peers this quarter.

If you’re building a network or security team right now, the Cisco alumni pool is the most interesting sourcing opportunity of the year. It closes by Q4. After that, you’re back to competing on a thin market for candidates who aren’t being displaced. Our placement average across IT roles is 17 days from intake to first interview. 92 percent of the direct hires we closed in the trailing twelve months were still in seat at the one-year mark. That’s the honest retention number. Not the speed number. Both matter, but retention is the one that says whether the match held up.

We are happy to run the intake call either way. If you’re sizing up a req and want a market read before posting it, start a conversation with our recruiting team and we’ll walk the pipeline with you for thirty minutes.

Common Questions About the Cisco Layoffs

How many people has Cisco actually laid off in 2026?

The 2026 actions so far are small and targeted. The most recent public WARN filing covers 221 positions in Milpitas and San Francisco. The large numbers most people remember are the 2024 cycles, about 4,000 in February and 5,600 in August, totaling roughly 7 percent of global headcount.

Announcements are not separations. The real separation count typically lags the announcement by weeks or even months and tends to run ten to twenty percent lower than the headline figure once internal transfers, attrition, and voluntary severance packages absorb part of the total. Read the press numbers as ceilings.

Is Cisco still hiring while it lays off?

Yes, aggressively. Cisco lists thousands of open roles across AI networking, custom silicon, cloud security, and data center solutions engineering for hyperscale accounts. The reshuffle is moving payroll dollars from legacy switching and routing teams into the AI infrastructure stack.

Should we target ex-Cisco network engineers right now?

If you are hiring for a senior networking seat, yes, and move in the next two quarters. The pool of CCIE and senior CCNP holders in transition is elevated in ways we haven’t seen since the 2018 post-acquisition round when a different generation of displaced Cisco engineers moved into Amazon and Microsoft to help stand up the first wave of modern cloud networking. MSPs, federal integrators, and mid-market companies pulling network operations back in-house are absorbing them fast.

The window usually closes inside six to nine months in a cycle like this one. Once the federal integrators and MSSPs finish hiring, supply tightens back to baseline. Move this quarter or pay market premium next quarter.

Which Cisco divisions are most at risk?

Legacy switching and routing product lines, parts of the collaboration business (Webex, the on-premise telephony remnants), and consolidation-driven functions inside Splunk and Talos post-integration. Growth areas are AI networking fabric, silicon, SASE, and cloud security.

Are Cisco certifications still worth anything in 2026?

CCIE still carries real weight in federal, carrier, and large-enterprise hiring. CCNP is table stakes for senior roles. CCNA is fine as an entry signal and insufficient alone for senior seats. The one shift is that a senior networking candidate with no cloud credential on top is increasingly getting screened out.

Where are laid-off Cisco security researchers going?

Talos alumni go primarily to Mandiant, Recorded Future, CrowdStrike Intel, MSSPs like Arctic Wolf and Expel, or spin up their own threat intelligence boutiques. Splunk detection engineering and implementation talent ports directly to Microsoft Sentinel, Google Chronicle, and the MDR market.

How fast can you fill a network or security role right now?

For CCIE or senior CCNP networking roles, 17 to 25 days from intake to first interview is typical in the current market, faster than our 12-month average because Cisco inbound volume is elevated. Cybersecurity senior roles run slightly longer, 20 to 30 days, because the candidate pool is more specialized and clearance checks add a step.

If the req has an unusual stack (say, Arista data center fabric plus AWS Direct Connect plus Terraform-driven automation) expect the upper end of that range. If it’s a clean Cisco-to-Cisco or Cisco-to-Meraki move, expect the lower end.