Hiring Good Cyber Security Professionals Is Hard Work

The Coronavirus pandemic has thrown cyber security professionals into an  unprecedented situation, with many facing the most difficult challenges of their career. For Business and IT leaders the challenge is exaggerated by the shortage of qualified cyber security professionals to fill jobs at their organisations. This is despite the relatively high salaries and stability associated with jobs in the field.

In a recent cyber skills survey carried out by Cyberbit,  60% of respondents said that barely half of all applicants for cyber security positions at their companies were properly qualified. This included a lack of adequate skills in intrusion detection, and network monitoring, again with almost 60% saying these are major areas of concern.

Cyber security jobs will grow by 31% between 2019 and 2020, or much faster than the average for virtually all other occupations, the US Bureau of Labor Statistics has projected. In 2020, the worldwide cybersecurity workforce gap, or the difference between the number of skilled professionals required to protect organisations and the number available to fill those roles, declined slightly according to the leading professional certification organistaion (ISC)2. They calculated the  number of unfilled cybersecurity jobs worldwide in 2019 - 2020 to be 3.12 million people worldwide, with 359,000 of those in the US.

Concerns over inadequately prepared cyber security job applicants come even as demand for cyber security jobs remains strong and there are five important reasons why organisations have difficulty  in finding the right cyber security employees.  

  • There is a disconnect exists between HR and the information security team at many organisations.  Cyberbit's survey found that HR departments often do not have a clear idea of cyber security roles and the requirements for those roles; in fact, just one-third of the respondents to the survey felt that HR understood those requirements. The gap can often affect an organisation's ability to attract the right talent for the cybersecurity team.
  • Wrong perceptions about cyber security may be holding back people from entering or exploring the field as a career option.   A 2020 report from (ISC)2 of 2,500 individuals in the US and UK who are not currently in the cyber security field suggests that not enough job seekers are considering a cybersecurity job to close the gaps. Despite a ready availability of jobs, relatively high salaries, and good job stability, many are not drawn to the field because of mistaken perceptions of what the work entails. Many individuals consider the cyber security profession to be one that requires a high level of specialised technical skills, the survey found.

Though 69% agreed that cyber security might offer a good career path, 61% felt that they would need more education or certifications to enter the field. Some 27% felt that their inability to code was a disqualification, while more than one-quarter (26%) described the field as being too intimidating.

  • One important reason why some organisations have a hard time finding cyber security professionals is that they insist on hiring only people with formal four-year degrees in cyber security. That's a mistake, said John Pescatore at the SANS Institute, who thinks that its more valuable  to have hands-on experience with cyber security, rather than merely having attended classroom lectures that talk about doing something.

This is especially true for entry-level cyber security jobs, he said. Many university cyber security degree programs tend not to be very useful to hiring organisations because of their over emphasis on a lecture-driven format, Pescatore said. Often, they are also not especially exciting to creative, inquisitive, and analytical individuals seeking a career in cyber security, he added. 

  • Hiring managers should think more broadly about the requirements for cyber security roles. Academic degrees in cyber security and certifications in the field are important. But not all roles require technical skills. In fact, plenty of opportunities in the cyber security field are good fits for non-technical professionals. 
  • Individuals looking to break into the cyber security profession can help themselves and their employers by picking up coding skills and one of the best skills to break in at the entry level is considered to be Python coding, which was designed to be a straight-forward and generally lightweight scripting language that would require minimal coding background to accomplish automation and analysis.

Tackling the skills shortage calls for a fundamental reassessment of how organisations deal with defining the requirements for cyber security roles. Also, improving the ways in which they communicate those requirements to candidates, especially those who may want to enter the field but are put off by their misconceptions about the profession.

ISC2:          Cyberbit:          TechBeacon:       US Bureau of Labor Statistics:     Image: Unsplash

You Might Also Read: 

Five Reasons Why Women Should Consider A Career In Cyber Security:

« Instagram, TikTok & Twitter Shutdown Stolen Accounts
5G Will Disrupt Cyber Security »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Conference-Service

Conference-Service

Conference-Service provides a categorised calendar of conferences and events, including Information Security & Privacy.

Insta Group

Insta Group

Insta are a trusted cyber security partner for security-critical companies and organizations.

IOTA Foundation

IOTA Foundation

The IOTA Foundation is a non-profit R&D organisation focused on developing the next generation of protocols for the connected world.

KOS-CERT

KOS-CERT

KOS-CERT is the national Computer Incident Response Team for Kosovo.

Axence

Axence

Axence provides professional solutions for the comprehensive management of IT infrastructure for companies and institutions all over the world.

PureCyber

PureCyber

PureCyber (formerly Wolfberry Cyber) is an award-winning cyber security consultancy whose goal it is to make cyber security accessible, understandable, and affordable for any organisation.

Portshift

Portshift

Portshift leverages the power of Kubernetes and Service-Mesh to deliver a single source of truth for containers and cloud-native applications security.

Larsen & Toubro Infotech (LTI)

Larsen & Toubro Infotech (LTI)

LTI is a global technology consulting and digital solutions company with operations in 33 countries.

Cyware

Cyware

Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally.

Gatefy

Gatefy

Getfy is a cybersecurity company specialized in artificial intelligence and machine learning. We work to solve challenging issues, especially those involving email security.

Clearvision

Clearvision

As an Atlassian Platinum Solution Partner, Clearvision works with teams in the UK and US, providing solutions for the Atlassian stack, Git and open source tooling.

Varutra Consulting

Varutra Consulting

Varutra Consulting is an Cyber Security Consulting, Solutions and Training services firm, providing specialized security services for software, mobile and network.

Cytidel

Cytidel

Cytidel is a vulnerability and risk management platform that utilises threat and business intelligence to help IT Security teams.

Queen Consulting & Technologies

Queen Consulting & Technologies

Queen Consulting & Technologies specialize in providing IT support, management, and Security to Gov’t Contractors, CPAs, and Nonprofits.

Custocy

Custocy

Custocy is a unique collaborative AI technology that identifies sophisticated and unknown (zero-day) attacks.

Compugen Systems Inc (CSI)

Compugen Systems Inc (CSI)

Compugen Systems is an IT service delivery company that focuses on enabling your business outcomes.