Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

2/15/2016
10:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How To Retain Good Security People: Keep The Work Exciting

Security managers should foster a challenging but rewarding work environment and invest in training to keep their security teams intact.

Acquiring talented IT security professionals is a big challenge for organizations grappling with growing skill shortages that impact every industry sector and government agency. Even more challenging, though, is retaining skilled workers amid a hot market where they can be easily lured elsewhere by more money or better opportunities.

It's a delicate balancing act that not only requires companies to offer appropriate compensations and work environments, but also opportunities for the workforce to learn new skills and tackle more challenging and exciting work, experts say.

According to an online survey of 132 security professionals conducted by AlienVault’s Javvad Malik, 33.9% cite “more challenging and exciting work” as the main reason they would move to another job.

“Not surprisingly, pay came in at second [23.14%] and flexible working environments [16.81%] was third,” says Malik, a-London-based IT security specialist with AlienVault, a developer of security information event management and threat management solutions. Promise of training, certification, or more education, also ranked high as an incentive for taking a new job.

One way to help make the work environment more challenging is to automate the mundane tasks, Malik says. “Every organization has boring and routine things to do, but if they [security managers] can try to automate it or give it as a project,” the security team could focus on more complex tasks, he says. 

Take vulnerability scans, which can be time-consuming: why not import them into a security information event management system or write correlation rules, he says. The outcome is two-fold: “You are removing the tedious tasks and giving them something meaningful to do. Once that is accomplished, you’ve ended up saving 10% to 20% of your time per week.”

Other key findings of the survey:

  • Having offices situated outside of major cities not only attracts local talent, but the chances of retaining that talent increases significantly due to lack of competition.  

Malik spoke to managers at two large international companies who preferred to set up their data centers or SOCs outside of major cities, ideally near a university. They knew they would get a steady flow of talented staff they could train. The staff would have few options geographically to actually leave. “They ended up with staff retention that way,” Malik says. 

  • Team culture can vary from company culture: don't assume both are the same. 

Some survey respondents enjoy working with their boss and colleagues, but thought their companies were atrocious. They’re staying in their jobs because of their boss and colleagues.  However, it is more difficult to stay in a company where your boss or immediate colleagues are unsupportive, Malik notes.

  • Nearly 65% of security pros are happy and content in their current jobs.

One security director said he had great success in finding non-security people from within the company and training them for IT or cybersecurity jobs, Malik says. Plus, the director structured the SOC team like a consultancy or cost center within the company. As a result, he could more effectively determine how many people he needed to support the various businesses.

He could say, “These are the businesses I’m supporting so where do you want me to scale back, rather than just increasing the workload on everyone,” Malik explains.

 

Top-Down

Retention initiatives start at the top, says Adam Vincent, CEO of ThreatConnect, a developer of threat intelligence platforms. Leadership must grow and foster a security team to meet their organization’s needs, and people who are being trained eventually become experts in their fields.  They are either going to grow into a new role within their organization -- or look elsewhere, he says.

“If you let them go because it is the next frontier for their career and learning experience, I view that as a win," says Vincent, who advocates training people and supporting their decision to go elsewhere for more challenging work if he couldn't provide that to them.

“However, I will also say that leadership of the security practice is what you need to look at so you don’t end up with all of your people job hopping.”

Security professional responding to The 2015 (ISC)² Global Information Security Workforce Study, meanwhile, also expressed satisfaction with their current jobs.

“Given the environment in which security professionals work, a certain amount of discontentment with their current roles would be understandable, if not expected,” according to the report, which was written by Frost and Sullivan analysts. But the study found that three out of four say they are "somewhat or very" satisfied, and 30% of the 14,000 professionals worldwide that responded to the survey say they are "very satisfied.” 

High job satisfaction facilitates employee retention, according to the report, as well as other factors. Employee churn remains a challenge for employers despite security professionals’ satisfaction with their current positions, the survey shows.

“In a single year, 2014, nearly one in five security professionals changed employers or employment status. Across the 2011, 2013, and 2015 surveys, churn of nearly 20% is the highest that has been seen,” the report says. “Correspondingly, having 14% of respondents reporting that they 'changed employers while still employed' was also the highest percentage across the three surveys. Rising churn is the first sign of rising security professional scarcity,” according to the (ISC)2 report.

Interop 2016 Las VegasFind out more about security careers at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

 

 

Offering training programs (61%) and paying for employee’s security certification expenses (59%) are the top two initiatives security managers surveyed have in place to retain professionals. Improving compensations (57%) landed third on the list. 

Offering flexible work schedules (55%) and supporting flexible working arrangements (51%) were fourth and fifth, “suggesting that employers can improve retention with initiatives that do not have a significant expense-line impact,” the reports states.

 

Related Stories

 

 

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...
CVE-2019-12269
PUBLISHED: 2019-05-21
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
CVE-2019-12189
PUBLISHED: 2019-05-21
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
CVE-2019-12190
PUBLISHED: 2019-05-21
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.