Hiring Good Cyber Security Professionals Is Hard Work

The Coronavirus pandemic has thrown cyber security professionals into an  unprecedented situation, with many facing the most difficult challenges of their career. For Business and IT leaders the challenge is exaggerated by the shortage of qualified cyber security professionals to fill jobs at their organisations. This is despite the relatively high salaries and stability associated with jobs in the field.

In a recent cyber skills survey carried out by Cyberbit,  60% of respondents said that barely half of all applicants for cyber security positions at their companies were properly qualified. This included a lack of adequate skills in intrusion detection, and network monitoring, again with almost 60% saying these are major areas of concern.

Cyber security jobs will grow by 31% between 2019 and 2020, or much faster than the average for virtually all other occupations, the US Bureau of Labor Statistics has projected. In 2020, the worldwide cybersecurity workforce gap, or the difference between the number of skilled professionals required to protect organisations and the number available to fill those roles, declined slightly according to the leading professional certification organistaion (ISC)2. They calculated the  number of unfilled cybersecurity jobs worldwide in 2019 - 2020 to be 3.12 million people worldwide, with 359,000 of those in the US.

Concerns over inadequately prepared cyber security job applicants come even as demand for cyber security jobs remains strong and there are five important reasons why organisations have difficulty  in finding the right cyber security employees.  

  • There is a disconnect exists between HR and the information security team at many organisations.  Cyberbit's survey found that HR departments often do not have a clear idea of cyber security roles and the requirements for those roles; in fact, just one-third of the respondents to the survey felt that HR understood those requirements. The gap can often affect an organisation's ability to attract the right talent for the cybersecurity team.
  • Wrong perceptions about cyber security may be holding back people from entering or exploring the field as a career option.   A 2020 report from (ISC)2 of 2,500 individuals in the US and UK who are not currently in the cyber security field suggests that not enough job seekers are considering a cybersecurity job to close the gaps. Despite a ready availability of jobs, relatively high salaries, and good job stability, many are not drawn to the field because of mistaken perceptions of what the work entails. Many individuals consider the cyber security profession to be one that requires a high level of specialised technical skills, the survey found.

Though 69% agreed that cyber security might offer a good career path, 61% felt that they would need more education or certifications to enter the field. Some 27% felt that their inability to code was a disqualification, while more than one-quarter (26%) described the field as being too intimidating.

  • One important reason why some organisations have a hard time finding cyber security professionals is that they insist on hiring only people with formal four-year degrees in cyber security. That's a mistake, said John Pescatore at the SANS Institute, who thinks that its more valuable  to have hands-on experience with cyber security, rather than merely having attended classroom lectures that talk about doing something.

This is especially true for entry-level cyber security jobs, he said. Many university cyber security degree programs tend not to be very useful to hiring organisations because of their over emphasis on a lecture-driven format, Pescatore said. Often, they are also not especially exciting to creative, inquisitive, and analytical individuals seeking a career in cyber security, he added. 

  • Hiring managers should think more broadly about the requirements for cyber security roles. Academic degrees in cyber security and certifications in the field are important. But not all roles require technical skills. In fact, plenty of opportunities in the cyber security field are good fits for non-technical professionals. 
  • Individuals looking to break into the cyber security profession can help themselves and their employers by picking up coding skills and one of the best skills to break in at the entry level is considered to be Python coding, which was designed to be a straight-forward and generally lightweight scripting language that would require minimal coding background to accomplish automation and analysis.

Tackling the skills shortage calls for a fundamental reassessment of how organisations deal with defining the requirements for cyber security roles. Also, improving the ways in which they communicate those requirements to candidates, especially those who may want to enter the field but are put off by their misconceptions about the profession.

ISC2:          Cyberbit:          TechBeacon:       US Bureau of Labor Statistics:     Image: Unsplash

You Might Also Read: 

Five Reasons Why Women Should Consider A Career In Cyber Security:

« Instagram, TikTok & Twitter Shutdown Stolen Accounts
5G Will Disrupt Cyber Security »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Secure Identity Alliance (SIA)

Secure Identity Alliance (SIA)

The Secure Identity Alliance is dedicated to supporting sustainable worldwide economic growth and prosperity through the development of trusted digital identities and the adoption of secure eServices.

Japan Information Security Audit Association (JASA)

Japan Information Security Audit Association (JASA)

JASA is non-profit association active in developing and managing the quality of Information Security Auditing and Auditors in Japan.

Halcyon Knights

Halcyon Knights

Halcyon Knights is a specialist executive search and IT recruitment agency in the APAC region. Areas of specialisation include cybersecurity.

Salient Law

Salient Law

Salient Law is a virtual law firm that specialises in advising providers and users of technology on contracts involving technology.

Rhino Security Labs

Rhino Security Labs

Rhino Security Labs is a top penetration testing and security assessment firm, with a focus on cloud pentesting, network pentesting, web application pentesting, and phishing.

SecureNation

SecureNation

SecureNation offers a wide variety of cutting-edge technologies and IT services to address almost any of your information security, network security and information assurance needs.

Zephyr Project

Zephyr Project

The Zephyr Project strives to deliver the best-in-class RTOS for connected resource-constrained devices, built to be secure and safe.

Cyber Command - Romania

Cyber Command - Romania

Cyber Command represents the military authority responsible for the development, protection and resilience of military IT networks and services that support the Romanian Force Structure.

Mandiant

Mandiant

Mandiant deliver dynamic cyber defense solutions powered by industry-leading expertise, intelligence and innovative technology.

Navisite

Navisite

Navisite is a combination of eight respected IT consulting and managed service providers that were brought together under the Navisite brand.

Nine23

Nine23

Nine23 are a highly focused cyber security solutions company that defines, builds and manages innovative services, enabling end-users to use technology securely in today’s workplace.

Progress Partners

Progress Partners

Progress Partners is a corporate advisory firm that works with buyers and sellers of emerging growth companies to complete M&A or private placement transactions. Our sectors include cybersecurity.

The IoT Academy

The IoT Academy

The IoT Academy is a reputed Ed-Tech Institute that provides training in emerging technologies such as embedded systems, the Internet of Things (IoT), Data Science and many more.

inSOC

inSOC

inSOC is an enterprise-grade AI-driven SOCaaS solution detecting breaches 24/7 with vulnerability management built-in. Designed for MSPs and MSSPs.

APIsentry

APIsentry

APIsentry is a leading provider of comprehensive API security solutions, specializing in protecting organizations from a wide range of cyber threats targeting their Application Programming Interfaces.

Abstract Security

Abstract Security

Abstract Security has created a revolutionary platform, equipped with an AI-powered assistant, to better centralize the management of security analytics.