Sofia's ICT Sector Is Growing Fast and Splitting in Two: The Executive Hiring Gap Behind the Numbers

Sofia's ICT sector added between 6,000 and 8,000 net new technology positions in 2024. Broadcom's acquisition of VMware released 400 to 500 engineers from what had been one of the city's anchor R&D centres. By any conventional reading, hiring leaders should have found the market easier. They did not. Vacancy durations for senior AI, cybersecurity, and engineering leadership roles lengthened through 2025, even as junior and mid-level pipelines stabilised.

The explanation lies in a bifurcation that most external observers of the Bulgarian tech market have missed entirely. Sofia is no longer a single talent market. It is two markets wearing the same label. The first is a relatively balanced supply of mid-level full-stack developers, where 60% of candidates are actively looking and application volumes are healthy. The second is a near-impenetrable pool of senior AI engineers, cybersecurity architects, and VP-level engineering leaders, where passive rates exceed 80% and search durations routinely stretch past four months. The compensation dynamics, sourcing methods, and retention levers that work in one market fail completely in the other.

What follows is a structured analysis of how this split developed, what it means for the employers competing in Sofia's technology sector, and what organisations hiring senior technical leadership in this market need to understand before they build a shortlist.

Sofia's ICT Sector in 2026: Scale, Structure, and the Numbers That Matter

Sofia's technology sector now employs approximately 75,000 to 80,000 professionals. That figure represents roughly 12 to 14% of the capital's total workforce and generates an estimated 15% of Bulgaria's GDP, according to preliminary data from the National Statistical Institute and the Sofia Municipality Economic Development Strategy. More than 80% of services are delivered to clients in the EU, the United States, and GCC markets. This is not a domestic-facing industry. It is an export engine operating at European scale from a Southeastern European cost base.

The sector's structure has consolidated around three verticals. Foreign-owned engineering centres, led by SAP Labs Bulgaria at 1,350 to 1,450 employees, Progress Software at 650 to 750, and Oracle Bulgaria at 450 to 550, anchor the enterprise software R&D category. IT outsourcing and professional services firms, notably MusalaSoft at 1,200 to 1,400 employees and ScaleFocus at 800 to 900, form the second tier. Domestic product companies and SaaS scale-ups, including SiteGround, Chaos, and Payhawk, represent the third and fastest-evolving vertical.

Growth Moderation Is Not Market Cooling

The Bulgarian Association of Software Companies (BASCOM) projects 6 to 8% headcount growth for the sector in 2026. That figure represents a moderation from the 10 to 12% annual expansion seen between 2022 and 2024. The moderation is not driven by weakening demand. It is driven by supply constraints. Foreign direct investment in ICT is expected to hold steady at €300 to 350 million annually, but greenfield investments are increasingly diverted to Plovdiv, Burgas, or competing CEE capitals precisely because Sofia cannot supply the talent or the office space to absorb them.

Class A office vacancy in Sofia stood at 11.2% in Q4 2024, down from 14.5% in 2021, with prime stock along the Tsarigradsko Shose corridor effectively fully let, according to CBRE Bulgaria's Q4 2024 Office Market Report. New supply scheduled for 2025 and 2026 totals only 120,000 square metres against a total stock of 1.8 million. Average prime rents rose 18% year-on-year to €18 to 22 per square metre per month. For mid-size firms looking to expand, the physical infrastructure is as constrained as the human capital.

What these figures obscure is where within the sector the pressure is most acute. The aggregate growth numbers mask a market where junior talent is flowing and senior talent is stuck.

The VMware Displacement: Why a 500-Person Layoff Did Not Ease the Shortage

Broadcom's acquisition of VMware in November 2023 triggered approximately 2,800 global position eliminations. Sofia's centre, previously one of VMware's largest EMEA R&D hubs at 800 to 900 professionals, contracted to an estimated 400 to 500 by early 2025, according to reporting by Capital.bg and industry estimates. The public narrative framed this as a destabilising event for Sofia's tech sector. The data tells a different story.

Sofia added 6,000 to 8,000 net new tech positions in 2024, and vacancy rates for senior engineers rose rather than fell despite the VMware release. Two explanations account for this. The first is immediate reabsorption. Competitors moved quickly. According to Capital.bg reporting and Noble Hire compensation data from Q2 2024, firms including SAP Labs Bulgaria and Progress Software offered 35 to 45% salary premiums and signing bonuses of €15,000 to €25,000 to secure senior virtualization engineers and C++ specialists from the displaced pool. The talent was off the market within weeks, not months.

The second explanation is more consequential. VMware's Sofia operation concentrated on legacy virtualization and C++ development. The roles the broader market desperately needed to fill were in cloud-native architecture, AI/ML engineering, and cybersecurity. The skills did not transfer one-to-one. A senior C++ virtualization engineer is not an interchangeable substitute for a staff-level ML engineer working in PyTorch and MLOps. The displacement was real. The relief was not.

This is the dynamic that defines Sofia's executive search challenge in 2026. Capital moved faster than human capital could follow. Investment in AI, cybersecurity, and SaaS product development accelerated. The professionals required to lead that work were never released into the market. They were already employed, already well-compensated, and already passive.

The 85% Passive Problem: Where Sofia's Senior Talent Actually Sits

The most important number in Sofia's ICT hiring market is not a salary figure or a vacancy count. It is 85%. That is the estimated proportion of senior AI and ML engineers in Sofia who are passive: employed, not applying to job postings, and reachable only through direct outreach or executive search. For cybersecurity specialists at senior and lead level, the passive rate is approximately 80%. For VP Engineering and CTO-level candidates, it reaches 95%.

These are not estimates drawn from employer sentiment surveys. LinkedIn Talent Insights data applied to the Bulgarian AI/ML talent pool in Q1 2025 shows an 8:1 ratio of recruiter outreach to organic applications for staff-level and above ML roles, according to Dev.bg platform data. The cybersecurity market operates through what industry analysts describe as silent networking: BSides Sofia events and private Telegram and Discord communities where public job postings function as employer branding exercises rather than genuine sourcing channels.

What This Means for Search Duration

The practical consequence is severe. A typical senior Site Reliability Engineering search in Sofia requiring Bulgarian language skills and ISO 27001 audit experience runs 120 to 150 days to fill, compared to 45 days for a standard backend development role. That is a 2.7x time-to-fill multiplier, drawn from aggregate data in the 2024 Hays Bulgaria and ManpowerGroup surveys. For VP Engineering and CTO searches, the typical duration extends to four to six months using retained search methodology, with active unemployment at these levels effectively zero.

For hiring leaders accustomed to markets where a strong job posting generates a qualified shortlist, Sofia's senior technical market operates on fundamentally different rules. The candidates you need are not looking. They are solving problems at SAP, at Progress, at Chaos, at SiteGround. The methods that reach passive talent at this level are categorically different from those that fill junior pipelines. Organisations that do not recognise this distinction will wait four months and wonder why.

The Compensation Bifurcation: Two Markets, Two Price Curves

Sofia's ICT wage data presents a tension that resolves only when you disaggregate it. At the aggregate level, ICT wage growth moderated from 18% annually between 2021 and 2023 to 12.5% in 2024, with average gross monthly wages reaching BGN 7,800 to 8,500, or €3,980 to €4,340. This figure, published by the National Statistical Institute, suggests a market approaching equilibrium.

It is not approaching equilibrium. It is splitting in two.

At senior individual contributor level, a Software Architect with ten or more years of experience commands a base salary of BGN 140,000 to 175,000 (€71,500 to €89,400) with total compensation including bonus and equity reaching BGN 160,000 to 210,000 (€81,700 to €107,200), per the 2024 Hays and BASCOM salary surveys. At VP Engineering level, overseeing teams of 50 or more, base salaries run BGN 180,000 to 240,000 (€91,900 to €122,500) with total compensation packages reaching BGN 220,000 to 350,000 (€112,300 to €178,600). The equity component is where the variance explodes: bootstrapped Bulgarian firms offer 0 to 10% equity participation, while VC-backed scale-ups structure 15 to 40%.

The CISO Premium and the AI Acceleration

Chief Information Security Officers in Sofia command total compensation of BGN 200,000 to 320,000 (€102,100 to €163,300), carrying a 25 to 30% premium above general IT management roles. That premium reflects both regulatory liability, particularly with the EU NIS2 directive and Bulgaria's pending data residency amendments, and raw scarcity.

The sharpest acceleration sits in AI leadership. Senior AI and ML engineers at staff and principal level now command BGN 150,000 to 200,000 (€76,600 to €102,100) in total compensation. That represents a 30% increase over 2022 levels. For VP-level AI product leaders capable of bridging Bulgarian development teams and Western enterprise clients, equity-adjusted compensation grew 25 to 30% annually through 2024 and 2025, far outstripping the moderating average.

This is the bifurcation. The headline number says 12.5% growth. The senior AI and cybersecurity number says 25 to 30%. The market is not cooling. The average is being pulled down by volume hiring at lower tiers while the top end accelerates. Any compensation benchmarking exercise that relies on the aggregate figure will underprice every senior offer by 15 to 20%.

The Competitive Squeeze: Bucharest, Warsaw, Berlin, and the Emigration Drain

Sofia's senior talent pool does not exist in isolation. It operates within a three-tier competitive structure that pulls candidates outward at every level of seniority.

Bucharest offers 20 to 30% salary premiums for equivalent senior roles, with total compensation for senior engineers ranging from €90,000 to €110,000 against Sofia's €70,000 to €90,000, according to the 2024 Hays CEE Salary Comparison. Bucharest also fields a larger overall talent pool of 160,000 or more ICT professionals and superior flight connectivity to Western Europe. Warsaw competes at the C-level and enterprise architecture tier with 40 to 50% salary premiums and a deeper concentration of Fortune 500 regional headquarters. Active poaching of Bulgarian senior architects for fintech scaling is a documented pattern in the Aon 2024 CEE Salary Review.

The Western European Remote Premium

The most damaging competition arrives not through relocation but through remote contracts. Berlin, Amsterdam, and London offer 2.5 to 3.5 times Sofia compensation, with senior engineer packages running €150,000 to €250,000 via remote arrangements. This tier is responsible for an estimated 40% of senior talent attrition from Sofia firms, defined as professionals with eight or more years of experience, according to Stack Overflow's 2024 Developer Survey and Bulgarian emigration statistics. Bulgaria's working-age population has declined 1.2% annually since 2020. The ICT sector alone loses approximately 8 to 12% of senior talent annually to emigration, primarily toward Germany, the Netherlands, the UK, and increasingly Dubai.

Sofia retains competitive advantages. The 10% flat corporate and personal income tax rate compares favourably to progressive structures of 20 to 45% in Western Europe. Cost of living runs 40% below Berlin. Growing equity opportunities at domestic product companies offer wealth-creation potential that did not exist five years ago. But these retention factors are eroding as Bucharest and Warsaw replicate similar incentive structures. The window during which Sofia's cost advantage alone could retain senior talent is closing.

For any international executive search targeting this market, the implication is clear. The offer must account not just for the candidate's current employer but for the remote contracts and relocation opportunities that represent their real alternative.

The Education Pipeline Cannot Close the Gap

Bulgaria's university computer science programmes produce approximately 4,500 graduates annually. The ICT sector requires an estimated 8,000 or more new entrants per year to meet combined replacement and growth demand, according to Ministry of Education enrolment data and BASCOM projections. The deficit is structural.

SoftUni, the private sector-aligned institution, adds 3,000 certified developers annually. But only 15 to 20% of those graduates meet senior-level hiring requirements upon completion. The education pipeline feeds the junior and mid-level market adequately. It does nothing to address the senior shortage, because seniority cannot be taught. It can only be earned through years of production-grade engineering, team leadership, and domain expertise.

The EU AI Act compounds this constraint. Implementation costs for Sofia-based AI firms are estimated at €50,000 to €200,000 for conformity assessments, according to European Commission guidance. Marginal early-stage AI projects may be eliminated entirely, concentrating AI work in larger firms that can absorb the compliance burden. Draft amendments to Bulgaria's Electronic Communications Act propose stricter data residency requirements that could increase cloud infrastructure costs by 15 to 20% for SaaS providers serving EU clients.

These regulatory costs do not reduce demand for senior talent. They increase it. Every AI-deploying firm now needs compliance expertise alongside technical capability. Every SaaS firm handling EU data needs architects who understand both the infrastructure and the regulatory framework. The cost of appointing the wrong leader in a role carrying regulatory liability is not measured in recruitment fees. It is measured in enforcement actions.

What This Split Market Means for Hiring Leaders in 2026

The analytical claim this data supports is one that most external observers of the Bulgarian tech market have not articulated. The compensation moderation at the aggregate level and the acceleration at the executive AI tier are not two separate trends. They are the same trend, viewed from different altitudes. Sofia has produced enough mid-level developers to stabilise the volume market. It has not produced, and cannot produce through education alone, the senior AI product leaders, cybersecurity architects, and VP-level engineering executives who translate Bulgarian engineering capacity into Western enterprise products. The talent shortage in Sofia is not a hiring problem. It is a leadership formation problem. The candidates needed do not yet exist in sufficient numbers, and no salary increase or signing bonus creates them faster.

This has three practical consequences for organisations hiring in this market.

First, speed determines outcome. In a market where 85% of target candidates are passive and the best are fielding multiple approaches simultaneously, search timelines measured in months are search timelines that produce second-choice outcomes. The firms that moved within days to secure displaced VMware engineers in early 2024, offering premiums and signing bonuses before competitors could assemble a shortlist, demonstrated the only approach that works at the senior tier.

Second, the proposition must match the competition. A Sofia-based offer benchmarked against Sofia averages will lose to a remote contract from Berlin paying 2.5 times more. The counteroffer dynamics in this market are severe. Organisations must structure packages that account for the candidate's real alternatives, which now include international remote work, not just competing local employers.

Third, traditional sourcing methods reach the wrong candidates. Public job postings in Sofia's cybersecurity market function as branding, not hiring. Senior AI roles generate an 8:1 ratio of recruiter outreach to organic applications. The candidates required for VP Engineering and CISO roles are reachable only through direct headhunting and talent mapping that identifies where they sit, what they earn, and what would credibly move them.

How KiTalent Approaches This Market

KiTalent operates in Sofia's ICT executive market through AI-enhanced direct search that reaches the 85% of senior candidates who are not visible through any job board or application channel. Using talent mapping methodology calibrated to the specific vertical, whether that is AI product leadership, cybersecurity architecture, or VP Engineering for a scaling SaaS firm, the process delivers interview-ready candidates within 7 to 10 days. Clients pay per interview, not through upfront retainers, eliminating the financial risk of a prolonged search in a market where prolonged searches are the default.

Across 1,450 executive placements globally, KiTalent maintains a 96% one-year retention rate for placed candidates. In a market where 8 to 12% of senior talent emigrates annually, retention begins with the quality of the match, not the size of the signing bonus.

For organisations competing for senior AI, cybersecurity, or engineering leadership in Sofia's split ICT market, where the aggregate data suggests a cooling trend and the executive tier tells the opposite story, speak with our executive search team about how we identify and engage the candidates this market makes hardest to find.

Frequently Asked Questions

What is the average salary for a senior software engineer in Sofia in 2026?

A Senior Software Architect with ten or more years of experience in Sofia commands a base salary of approximately €71,500 to €89,400, with total compensation including bonus and equity reaching €81,700 to €107,200. At VP Engineering level, total packages range from €112,300 to €178,600 depending on equity structure. AI and ML specialists at staff level earn €76,600 to €102,100 in total compensation, reflecting 30% growth since 2022. These figures sit well below Western European remote contract rates, which range from €150,000 to €250,000 for equivalent seniority, creating persistent attrition pressure on Sofia employers.

Why is it so hard to hire senior AI engineers in Sofia?

An estimated 85% of senior AI and ML engineers in Sofia are passive candidates. They are employed, not monitoring job boards, and reachable only through direct outreach. Senior AI roles in Sofia show an 8:1 ratio of recruiter-initiated contact to organic applications. The education pipeline produces junior and mid-level developers but cannot accelerate the formation of senior talent, which requires years of production-grade experience. KiTalent's AI-enhanced talent identification process is designed for exactly this kind of market, where the candidates you need are employed, well-compensated, and invisible to conventional sourcing.

How does Sofia compare to Bucharest and Warsaw for ICT hiring?

Bucharest offers 20 to 30% salary premiums over Sofia for equivalent senior roles and fields a larger overall talent pool of 160,000 or more ICT professionals. Warsaw competes at C-level with 40 to 50% premiums and deeper Fortune 500 presence. Sofia's advantages include a 10% flat tax rate, cost of living approximately 40% below Berlin, and a growing domestic product company ecosystem offering meaningful equity participation. However, these retention factors are eroding as regional competitors replicate similar tax incentives.

What cybersecurity roles are hardest to fill in Sofia?

Cybersecurity Architects with CISSP or equivalent certification and EU security clearance eligibility represent the most acute shortage. Chief Information Security Officers command a 25 to 30% premium over general IT management roles, with total compensation reaching €102,100 to €163,300. The senior cybersecurity market operates through private networking channels rather than public postings, with an estimated 80% passive candidate rate. Searches for these profiles typically require retained executive search methodology and targeted identification within specialist communities.

How long does it take to fill a senior tech role in Sofia?

Standard backend development roles fill in approximately 45 days. Senior Site Reliability Engineering positions requiring Bulgarian language skills and ISO 27001 experience take 120 to 150 days, a 2.7 times multiplier. VP Engineering and CTO searches run four to six months on average. KiTalent compresses these timelines by delivering interview-ready candidates within 7 to 10 days through direct headhunting that bypasses the passive candidate barrier entirely.

Will the EU AI Act affect hiring in Sofia's tech sector?

Implementation of the EU AI Act requires conformity assessment investments estimated at €50,000 to €200,000 per AI-deploying firm. This cost may eliminate marginal early-stage projects, concentrating AI work in larger organisations. For hiring leaders, the regulatory burden increases demand for senior professionals who combine technical AI capability with compliance expertise. The net effect is intensified competition for an already scarce talent profile, not reduced demand.