You Don't Need To Be A Hacker ...

You don't need to be a hacker to get a high-paying cybersecurity job. Many people might not realize they have skills that are transferable to this in-demand field.

This week in Las Vegas, some of the most talented cybersecurity minds have gathered to take part in two of the year's biggest hacker conferences, Blackhat and Defcon. 

The highlights of these conferences are often what can best be described as cyber magic tricks, where technicians show off their skills by proving how they can break into various devices, such as computers inside cars, voting machines and medical instruments.

These demonstrations may lead you to imagine that cybersecurity professionals need technical abilities. But there are many career paths in the increasingly high-demand and lucrative field, and some may require only small tweaks in skills and experience.

Corporations in the U.S. and globally are seeing a major shortage in qualified applicants for cybersecurity jobs, meaning more people with transferable skills will need to be trained into them. Today, the U.S. Department of Commerce estimates there are around 350,000 cybersecurity jobs currently unfilled in the U.S. Cybersecurity analytics and research company Cybersecurity Ventures released data that indicate 3.5 million cybersecurity jobs are likely to go unfilled globally by 2021, making this an excellent career path.

These jobs can pay exceptionally well, too. Top cybersecurity jobs, like chief information security officer — typically the highest-ranking cybersecurity employee in a company — often fetch salaries above $300,000 in top metropolitan areas such as Washington, D.C., New York and San Francisco, according to cybersecurity recruiting firm SilverBull. Salaries for cybersecurity staff range from $90,000 to more than $200,000 for more experienced employees, including jobs such as information risk managers and security engineers, according to career information company Glassdoor.

"I think we have perpetuated this myth that cybersecurity is based on this hacker stuff, sitting in a basement and only working on technical things," said Vyas Sekar, an associate professor of electrical and computer engineering at Carnegie Mellon's Cylab.

"In fact, it's those with an analytical mindset that can do very well in the cybersecurity field. The sort of basic computer science that is necessary can be taught later. It's maybe more useful to think of cybersecurity as solving a bunch of interesting puzzles."

Calling all cops, musicians and crossword enthusiasts

People with experience in project management, analytics and data science, technical writing, law, policy, third-party oversight, or physical security functions like law enforcement or military roles, may all be able to qualify for cybersecurity jobs by fine-tuning some critically needed skills, said Pete Metzger, a recruiter of c-suite cybersecurity professionals with consulting firm DHR International.

"The fact is that, because of the imbalance in the equation of supply and demand, these jobs have become not only hot but highly paid," said Metzger, who started his career in the Marine Corps and later served as a foreign intelligence officer with the Central Intelligence Agency.

Companies are looking for people who can help them "reshape" how they think about security, he said. Having the ability to "solve problems, having exceptionally well-tuned leadership skills and the ability to influence people in various lines of business," are critical to what corporations are seeking in cybersecurity executives and staff, he said.

In addition, companies are increasingly being asked to cooperate with one another, with government agencies or with international organizations to share information about threats and incoming attacks. Doing so involves carefully creating channels for sharing sometimes sensitive information and building trust between factions who might not traditionally get along. Those jobs require excellent relationship-management skills and the ability to help move partnerships forward, especially those that involve a mix of the public and private sectors, Metzger said.

People with experience quantifying risk have become particularly valuable, including accountants and data analysts, said Sekar. "It's a very broad landscape. There are aspects of psychology, being able to understand users and user behavior. There are aspects of strategy, for people with experience formulating business strategies," Sekar said.

He used the example of how British military officers in World War II used a timed crossword puzzle in a newspaper — not complex math problems — to try to find people well-suited for solving the encryption of Germany's code-generating Enigma machine.

"Some early solvers of encryption problems were linguists, not mathematicians. What is necessary or critical in cybersecurity is the ability to analyze, and the curiosity and the desire to understand how things work," he said.

Many cybersecurity job listings focus very little on technology qualifications: Chronicle, the new, secretive cybersecurity company launched by Alphabet in January, is recruiting for technical writers who can provide "a key link between engineers, UX, product, marketing, and customers." The job calls for some experience interpreting source code, but doesn't ask for a technical degree, instead focusing on people who have experience with "technical writing, product documentation, or online publishing, including experience with writing technical customer-facing materials."

Apple is recruiting for a security counsel to help aid in investigations of cyber intrusions, fraud and other breaches. The job requires a law degree. Three of the top skills required don't even mention technology, but instead ask for investigations experience "in a prosecutor's office, law enforcement agency or corporate environment" and "excellent diplomacy and communication skills."

Many companies require certifications in cybersecurity, and the CISSP, or Certified Information Systems Security Professional, is still the "gold standard," said Metzger. But he adds that even top cybersecurity executives have entered the field from leadership positions in IT and risk, only to get those critical cybersecurity certifications later. "The key is really having those strong leadership skills and the ability to communicate and put a price on how these issues could hurt the company financially," he said.

CNBC:

You Might Also Read:

The Five Most In-Demand Cybersecurity Roles

« Darktrace Discoveries Report 2018
How Hackers Target Critical Infrastructure »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ProfitBricks

ProfitBricks

ProfitBricks is a secure cloud computing infrastructure-as-a-service (IaaS) solution.

ContentKeeper

ContentKeeper

ContentKeeper provides Web Threat Protection solutions to secure today’s Web 2.0 and mobile centric business environments.

MD5

MD5

MD5 is a leading UK provider of Digital Forensic & eDiscovery services to large multi-national corporate businesses, Law Enforcement & Government Agencies, high profile legal firms.

ComTrue Technologies

ComTrue Technologies

ComTrue Technologies provides artificial intelligence solutions and information security solutions.

Vuntie

Vuntie

Vuntie blend European craftsmanship, performance and open-source technology to deliver cybersecurity services including penetration testing, incident response, training and consultancy.

Digital Law

Digital Law

Digital Law is the only UK law firm to specialise solely in online, data and cyber law.

BAI Security

BAI Security

BAI Security is a Nationally Recognized Leader in IT Security. Keeping your data safe and your business compliant is our singular focus.

Quantinuum

Quantinuum

Quantinuum is the combination of Cambridge Quantum with Honeywell Quantum Solutions, structured to drive the future of quantum computing.

Synamic Technologies

Synamic Technologies

Synamic Technologies was founded in 2018 as a start-up to automate cyber security processes. Our CISOSCOPE product automates vulnerability management, risk management and compliance.

Trustifi

Trustifi

Trustifi leads the market with the easiest to use and deploy email security products, providing both inbound and outbound email security from a single vendor.

Vircom

Vircom

With a large majority of cyber attacks starting with email, Vircom provides protection against the worst email security threats to your business.

Block Harbor Cybersecurity

Block Harbor Cybersecurity

Block Harbor has worked closely with automakers, suppliers, and regulators since 2014 on vehicle cybersecurity.

Intel Ignite

Intel Ignite

Intel Ignite is an internationally renowned acceleration program for early-stage deep tech startups.

CYTUR

CYTUR

CYTUR provide trusted and secured maritime cybersecurity solutions to keep ships safe, protecting them, their crews, cargo and all stakeholders from maritime cyber threats.

Astran

Astran

At Astran, we revolutionize data security by introducing a groundbreaking solution for data confidentiality headaches.

Datagroup

Datagroup

Datagroup makes IT easy. Our IT experts ensure that your technology is always up to date with perfectly customized solutions.