Careers & People
10:00 AM
Connect Directly

How To Retain Good Security People: Keep The Work Exciting

Security managers should foster a challenging but rewarding work environment and invest in training to keep their security teams intact.

Acquiring talented IT security professionals is a big challenge for organizations grappling with growing skill shortages that impact every industry sector and government agency. Even more challenging, though, is retaining skilled workers amid a hot market where they can be easily lured elsewhere by more money or better opportunities.

It's a delicate balancing act that not only requires companies to offer appropriate compensations and work environments, but also opportunities for the workforce to learn new skills and tackle more challenging and exciting work, experts say.

According to an online survey of 132 security professionals conducted by AlienVault’s Javvad Malik, 33.9% cite “more challenging and exciting work” as the main reason they would move to another job.

“Not surprisingly, pay came in at second [23.14%] and flexible working environments [16.81%] was third,” says Malik, a-London-based IT security specialist with AlienVault, a developer of security information event management and threat management solutions. Promise of training, certification, or more education, also ranked high as an incentive for taking a new job.

One way to help make the work environment more challenging is to automate the mundane tasks, Malik says. “Every organization has boring and routine things to do, but if they [security managers] can try to automate it or give it as a project,” the security team could focus on more complex tasks, he says. 

Take vulnerability scans, which can be time-consuming: why not import them into a security information event management system or write correlation rules, he says. The outcome is two-fold: “You are removing the tedious tasks and giving them something meaningful to do. Once that is accomplished, you’ve ended up saving 10% to 20% of your time per week.”

Other key findings of the survey:

  • Having offices situated outside of major cities not only attracts local talent, but the chances of retaining that talent increases significantly due to lack of competition.  

Malik spoke to managers at two large international companies who preferred to set up their data centers or SOCs outside of major cities, ideally near a university. They knew they would get a steady flow of talented staff they could train. The staff would have few options geographically to actually leave. “They ended up with staff retention that way,” Malik says. 

  • Team culture can vary from company culture: don't assume both are the same. 

Some survey respondents enjoy working with their boss and colleagues, but thought their companies were atrocious. They’re staying in their jobs because of their boss and colleagues.  However, it is more difficult to stay in a company where your boss or immediate colleagues are unsupportive, Malik notes.

  • Nearly 65% of security pros are happy and content in their current jobs.

One security director said he had great success in finding non-security people from within the company and training them for IT or cybersecurity jobs, Malik says. Plus, the director structured the SOC team like a consultancy or cost center within the company. As a result, he could more effectively determine how many people he needed to support the various businesses.

He could say, “These are the businesses I’m supporting so where do you want me to scale back, rather than just increasing the workload on everyone,” Malik explains.



Retention initiatives start at the top, says Adam Vincent, CEO of ThreatConnect, a developer of threat intelligence platforms. Leadership must grow and foster a security team to meet their organization’s needs, and people who are being trained eventually become experts in their fields.  They are either going to grow into a new role within their organization -- or look elsewhere, he says.

“If you let them go because it is the next frontier for their career and learning experience, I view that as a win," says Vincent, who advocates training people and supporting their decision to go elsewhere for more challenging work if he couldn't provide that to them.

“However, I will also say that leadership of the security practice is what you need to look at so you don’t end up with all of your people job hopping.”

Security professional responding to The 2015 (ISC)² Global Information Security Workforce Study, meanwhile, also expressed satisfaction with their current jobs.

“Given the environment in which security professionals work, a certain amount of discontentment with their current roles would be understandable, if not expected,” according to the report, which was written by Frost and Sullivan analysts. But the study found that three out of four say they are "somewhat or very" satisfied, and 30% of the 14,000 professionals worldwide that responded to the survey say they are "very satisfied.” 

High job satisfaction facilitates employee retention, according to the report, as well as other factors. Employee churn remains a challenge for employers despite security professionals’ satisfaction with their current positions, the survey shows.

“In a single year, 2014, nearly one in five security professionals changed employers or employment status. Across the 2011, 2013, and 2015 surveys, churn of nearly 20% is the highest that has been seen,” the report says. “Correspondingly, having 14% of respondents reporting that they 'changed employers while still employed' was also the highest percentage across the three surveys. Rising churn is the first sign of rising security professional scarcity,” according to the (ISC)2 report.

Interop 2016 Las VegasFind out more about security careers at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.



Offering training programs (61%) and paying for employee’s security certification expenses (59%) are the top two initiatives security managers surveyed have in place to retain professionals. Improving compensations (57%) landed third on the list. 

Offering flexible work schedules (55%) and supporting flexible working arrangements (51%) were fourth and fifth, “suggesting that employers can improve retention with initiatives that do not have a significant expense-line impact,” the reports states.


Related Stories



Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.