You Don't Need To Be A Hacker ...

You don't need to be a hacker to get a high-paying cybersecurity job. Many people might not realize they have skills that are transferable to this in-demand field.

This week in Las Vegas, some of the most talented cybersecurity minds have gathered to take part in two of the year's biggest hacker conferences, Blackhat and Defcon. 

The highlights of these conferences are often what can best be described as cyber magic tricks, where technicians show off their skills by proving how they can break into various devices, such as computers inside cars, voting machines and medical instruments.

These demonstrations may lead you to imagine that cybersecurity professionals need technical abilities. But there are many career paths in the increasingly high-demand and lucrative field, and some may require only small tweaks in skills and experience.

Corporations in the U.S. and globally are seeing a major shortage in qualified applicants for cybersecurity jobs, meaning more people with transferable skills will need to be trained into them. Today, the U.S. Department of Commerce estimates there are around 350,000 cybersecurity jobs currently unfilled in the U.S. Cybersecurity analytics and research company Cybersecurity Ventures released data that indicate 3.5 million cybersecurity jobs are likely to go unfilled globally by 2021, making this an excellent career path.

These jobs can pay exceptionally well, too. Top cybersecurity jobs, like chief information security officer — typically the highest-ranking cybersecurity employee in a company — often fetch salaries above $300,000 in top metropolitan areas such as Washington, D.C., New York and San Francisco, according to cybersecurity recruiting firm SilverBull. Salaries for cybersecurity staff range from $90,000 to more than $200,000 for more experienced employees, including jobs such as information risk managers and security engineers, according to career information company Glassdoor.

"I think we have perpetuated this myth that cybersecurity is based on this hacker stuff, sitting in a basement and only working on technical things," said Vyas Sekar, an associate professor of electrical and computer engineering at Carnegie Mellon's Cylab.

"In fact, it's those with an analytical mindset that can do very well in the cybersecurity field. The sort of basic computer science that is necessary can be taught later. It's maybe more useful to think of cybersecurity as solving a bunch of interesting puzzles."

Calling all cops, musicians and crossword enthusiasts

People with experience in project management, analytics and data science, technical writing, law, policy, third-party oversight, or physical security functions like law enforcement or military roles, may all be able to qualify for cybersecurity jobs by fine-tuning some critically needed skills, said Pete Metzger, a recruiter of c-suite cybersecurity professionals with consulting firm DHR International.

"The fact is that, because of the imbalance in the equation of supply and demand, these jobs have become not only hot but highly paid," said Metzger, who started his career in the Marine Corps and later served as a foreign intelligence officer with the Central Intelligence Agency.

Companies are looking for people who can help them "reshape" how they think about security, he said. Having the ability to "solve problems, having exceptionally well-tuned leadership skills and the ability to influence people in various lines of business," are critical to what corporations are seeking in cybersecurity executives and staff, he said.

In addition, companies are increasingly being asked to cooperate with one another, with government agencies or with international organizations to share information about threats and incoming attacks. Doing so involves carefully creating channels for sharing sometimes sensitive information and building trust between factions who might not traditionally get along. Those jobs require excellent relationship-management skills and the ability to help move partnerships forward, especially those that involve a mix of the public and private sectors, Metzger said.

People with experience quantifying risk have become particularly valuable, including accountants and data analysts, said Sekar. "It's a very broad landscape. There are aspects of psychology, being able to understand users and user behavior. There are aspects of strategy, for people with experience formulating business strategies," Sekar said.

He used the example of how British military officers in World War II used a timed crossword puzzle in a newspaper — not complex math problems — to try to find people well-suited for solving the encryption of Germany's code-generating Enigma machine.

"Some early solvers of encryption problems were linguists, not mathematicians. What is necessary or critical in cybersecurity is the ability to analyze, and the curiosity and the desire to understand how things work," he said.

Many cybersecurity job listings focus very little on technology qualifications: Chronicle, the new, secretive cybersecurity company launched by Alphabet in January, is recruiting for technical writers who can provide "a key link between engineers, UX, product, marketing, and customers." The job calls for some experience interpreting source code, but doesn't ask for a technical degree, instead focusing on people who have experience with "technical writing, product documentation, or online publishing, including experience with writing technical customer-facing materials."

Apple is recruiting for a security counsel to help aid in investigations of cyber intrusions, fraud and other breaches. The job requires a law degree. Three of the top skills required don't even mention technology, but instead ask for investigations experience "in a prosecutor's office, law enforcement agency or corporate environment" and "excellent diplomacy and communication skills."

Many companies require certifications in cybersecurity, and the CISSP, or Certified Information Systems Security Professional, is still the "gold standard," said Metzger. But he adds that even top cybersecurity executives have entered the field from leadership positions in IT and risk, only to get those critical cybersecurity certifications later. "The key is really having those strong leadership skills and the ability to communicate and put a price on how these issues could hurt the company financially," he said.

CNBC:

You Might Also Read:

The Five Most In-Demand Cybersecurity Roles

« Darktrace Discoveries Report 2018
How Hackers Target Critical Infrastructure »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

PSC

PSC

PSC is a leading PCI and PA DSS assessor and Approved Scanning Vendor.

Dark Cubed

Dark Cubed

Dark Cubed is an easy-to-use cyber security software as a service (SaaS) platform that deploys instantly and delivers enterprise-grade threat identification and protection at a fraction of the cost.

Identity Defined Security Alliance (IDSA)

Identity Defined Security Alliance (IDSA)

IDSA is a group of identity and security vendors, solution providers and practitioners that acts as an independent source of education and information on identity-centric security strategies.

GlobalPlatform

GlobalPlatform

GlobalPlatform’s specifications are highly regarded as the international standard for enabling digital services and devices to be trusted and securely managed throughout their lifecycle.

jobsDB.com

jobsDB.com

jobsDB Singapore is a search engine for jobs throughout Singapore.

Alcon Maddox

Alcon Maddox

Alcon Maddox is a niche recruitment and executive search firm specialised in sourcing exceptional Cyber Security sales and commercial leadership talent. Serving clients across the Middle East & Europe

Sollensys

Sollensys

Sollensys is a leader in commercial blockchain applications. Our flagship product, The Blockchain Archive Server™ is the best defense against the devastating financial loss that ransomware causes.

Seemplicity

Seemplicity

Seemplicity revolutionizes the way security teams work by automating, optimizing and scaling all risk reduction workflows in one workspace.

Truly Secure

Truly Secure

Truly Secure is an IT Service Provider that ensures greater efficiency and security within a company's technological environment.

Auriga

Auriga

Auriga create innovative software and have become a benchmark for high quality banking software including cyber security solutions to protect business critical devices.

Sweet Security

Sweet Security

Sweet Security delivers Runtime Attack Security for Cloud Workloads.

CLEAR

CLEAR

With more than 17 million members and a growing network of partners across the world, CLEAR's identity platform is transforming the way people live, work, and travel.

Mantodea Security

Mantodea Security

Mantodea Security is an industry-agnostic powerhouse backed by extensive experience and expertise in the realm of IT security.

Clango

Clango

Clango employs an identity-centric approach to optimizing your cybersecurity investment while minimizing risk.

Maltiverse

Maltiverse

Maltiverse is a threat intelligence platform that provides security teams with high-fidelity threat data and malicious IOCs to enhance detection and response.

Tek Yantra

Tek Yantra

Empower your business with our adept IT specialists, delivering rapid, scalable, and resilient cloud-based solutions designed to spur innovation and elevate productivity.