You Don't Need To Be A Hacker ...

You don't need to be a hacker to get a high-paying cybersecurity job. Many people might not realize they have skills that are transferable to this in-demand field.

This week in Las Vegas, some of the most talented cybersecurity minds have gathered to take part in two of the year's biggest hacker conferences, Blackhat and Defcon. 

The highlights of these conferences are often what can best be described as cyber magic tricks, where technicians show off their skills by proving how they can break into various devices, such as computers inside cars, voting machines and medical instruments.

These demonstrations may lead you to imagine that cybersecurity professionals need technical abilities. But there are many career paths in the increasingly high-demand and lucrative field, and some may require only small tweaks in skills and experience.

Corporations in the U.S. and globally are seeing a major shortage in qualified applicants for cybersecurity jobs, meaning more people with transferable skills will need to be trained into them. Today, the U.S. Department of Commerce estimates there are around 350,000 cybersecurity jobs currently unfilled in the U.S. Cybersecurity analytics and research company Cybersecurity Ventures released data that indicate 3.5 million cybersecurity jobs are likely to go unfilled globally by 2021, making this an excellent career path.

These jobs can pay exceptionally well, too. Top cybersecurity jobs, like chief information security officer — typically the highest-ranking cybersecurity employee in a company — often fetch salaries above $300,000 in top metropolitan areas such as Washington, D.C., New York and San Francisco, according to cybersecurity recruiting firm SilverBull. Salaries for cybersecurity staff range from $90,000 to more than $200,000 for more experienced employees, including jobs such as information risk managers and security engineers, according to career information company Glassdoor.

"I think we have perpetuated this myth that cybersecurity is based on this hacker stuff, sitting in a basement and only working on technical things," said Vyas Sekar, an associate professor of electrical and computer engineering at Carnegie Mellon's Cylab.

"In fact, it's those with an analytical mindset that can do very well in the cybersecurity field. The sort of basic computer science that is necessary can be taught later. It's maybe more useful to think of cybersecurity as solving a bunch of interesting puzzles."

Calling all cops, musicians and crossword enthusiasts

People with experience in project management, analytics and data science, technical writing, law, policy, third-party oversight, or physical security functions like law enforcement or military roles, may all be able to qualify for cybersecurity jobs by fine-tuning some critically needed skills, said Pete Metzger, a recruiter of c-suite cybersecurity professionals with consulting firm DHR International.

"The fact is that, because of the imbalance in the equation of supply and demand, these jobs have become not only hot but highly paid," said Metzger, who started his career in the Marine Corps and later served as a foreign intelligence officer with the Central Intelligence Agency.

Companies are looking for people who can help them "reshape" how they think about security, he said. Having the ability to "solve problems, having exceptionally well-tuned leadership skills and the ability to influence people in various lines of business," are critical to what corporations are seeking in cybersecurity executives and staff, he said.

In addition, companies are increasingly being asked to cooperate with one another, with government agencies or with international organizations to share information about threats and incoming attacks. Doing so involves carefully creating channels for sharing sometimes sensitive information and building trust between factions who might not traditionally get along. Those jobs require excellent relationship-management skills and the ability to help move partnerships forward, especially those that involve a mix of the public and private sectors, Metzger said.

People with experience quantifying risk have become particularly valuable, including accountants and data analysts, said Sekar. "It's a very broad landscape. There are aspects of psychology, being able to understand users and user behavior. There are aspects of strategy, for people with experience formulating business strategies," Sekar said.

He used the example of how British military officers in World War II used a timed crossword puzzle in a newspaper — not complex math problems — to try to find people well-suited for solving the encryption of Germany's code-generating Enigma machine.

"Some early solvers of encryption problems were linguists, not mathematicians. What is necessary or critical in cybersecurity is the ability to analyze, and the curiosity and the desire to understand how things work," he said.

Many cybersecurity job listings focus very little on technology qualifications: Chronicle, the new, secretive cybersecurity company launched by Alphabet in January, is recruiting for technical writers who can provide "a key link between engineers, UX, product, marketing, and customers." The job calls for some experience interpreting source code, but doesn't ask for a technical degree, instead focusing on people who have experience with "technical writing, product documentation, or online publishing, including experience with writing technical customer-facing materials."

Apple is recruiting for a security counsel to help aid in investigations of cyber intrusions, fraud and other breaches. The job requires a law degree. Three of the top skills required don't even mention technology, but instead ask for investigations experience "in a prosecutor's office, law enforcement agency or corporate environment" and "excellent diplomacy and communication skills."

Many companies require certifications in cybersecurity, and the CISSP, or Certified Information Systems Security Professional, is still the "gold standard," said Metzger. But he adds that even top cybersecurity executives have entered the field from leadership positions in IT and risk, only to get those critical cybersecurity certifications later. "The key is really having those strong leadership skills and the ability to communicate and put a price on how these issues could hurt the company financially," he said.

CNBC:

You Might Also Read:

The Five Most In-Demand Cybersecurity Roles

« Darktrace Discoveries Report 2018
How Hackers Target Critical Infrastructure »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Professional Information Security Association (PISA)

Professional Information Security Association (PISA)

PISA is an independent and not-for-profit organization for information security professionals, with the primary objective of promoting information security awareness and best practice.

Momentum

Momentum

The Cyber Security team at Momentum offers a professional and specialist recruitment service across Cyber & IT Security.

CybelAngel

CybelAngel

CybelAngel is a leading digital risk protection platform that detects and resolves external threats before these wreak havoc.

Soracom

Soracom

Soracom offers secure, scalable, cloud-native connectivity developed specifically for the Internet of Things.

Mitchell Sandham

Mitchell Sandham

Mitchell Sandham is an, independent insurance and financial services brokerage. Business products include Cyber/Privacy Liability insurance.

Brainloop

Brainloop

Brainloop's security architecture enables you to work on and distribute strictly confidential documents both within and beyond the firewall.

KOS-CERT

KOS-CERT

KOS-CERT is the national Computer Incident Response Team for Kosovo.

Advens

Advens

Advens is a company specializing in information security management. We provide Consultancy, Security Audits and Technology Solutions.

Cyber Command - Estonian Defence Forces

Cyber Command - Estonian Defence Forces

The main mission of the Cyber Command is to carry out operations in cyberspace in order to provide command support for Ministry of Defence’s area of responsibility.

Threat Status

Threat Status

Threat Status are a Threat Intelligence company. We are the developers of Trillion. A cloud based Security As A Service (SaaS) platform.

Salvador Technologies

Salvador Technologies

Salvador Technologies provides the world’s fastest technology to recover from cyber-attacks.

Defentry

Defentry

Defentry have created an Ecosystem that lets our users easily monitor, train and resolve their digital security issues.

SecurityGen

SecurityGen

SecurityGen is a global cybersecurity start-up focused on telecom security, with a focus on 5G networks.

ACI Learning

ACI Learning

ACI Learning - Training tomorrow’s industry leaders with formats for all types of learners in Audit, Cybersecurity, and IT.

Keepit

Keepit

Keepit offer all-inclusive, secure, and reliable backup and recovery services for your data.

Argenta Talent Acquisition

Argenta Talent Acquisition

Argenta Talent Acquisition is a recruitment partner specializing in Space and Defense, Intelligence Community, all things Technical, Cyber, and Logistics.