Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

01:00 PM
Connect Directly

The Cybersecurity Talent You Seek May Be In-House

IT staff in many cases are already performing security-related work -- with proper training, they could be converted to the security team.

Cybersecurity jobs are in demand across all industry sectors and government agencies.  As organizations struggle to address the shortage of skilled cyber talent, there may be existing employees within the IT department who can be trained to defend networks and critical assets from adversaries, experts say.

Tapping internal IT resources is one among several strategies managers can employ to find good security people, experts say. Companies should also partner with academia and educational organizations to ensure that college and university students receive training in real-world scenarios and technology to make them better equip to handle existing and future threats.

Casey O’Brien, executive director and principal investigator with The National CyberWatch Center, says security managers should tap the talents of network administrators, system administrators, and programmers because they have strong foundational skills in their specialty areas.

“So it is really a matter of giving them the right type of training and education and ways to continue to develop those skills where you are baking security into what they already do,” O’Brien says. “For the most part, they are already doing information security-related work as part of their job. This is the easiest way for organizations to start."

Based in Largo, Maryland-based National CyberWatch Center is a consortium of higher education institutions, businesses, and government agencies focused on collaborative efforts to advance information security education and research as well as strengthen the national cybersecurity workforce. The consortium is funded by the National Science Foundation's Advanced Technological Education Program.

Two programs in particular help train the next-generation of security professionals, providing a skilled pool of talent for potential employers: The Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC), which provides hands-on application of information security skills to enhance students’ understanding of both theory and practice; and The National Cyber League (NCL), which  provides an ongoing virtual training ground for faculty and students to develop and validate cybersecurity skills using content aligned with individual and team games. This approach allows students to test their cybersecurity knowledge and skills in a competitive environment.

Students work in teams on real-world, high-fidelity simulated environments in specific areas such as energy or healthcare, O’Brien says. “Pick a critical infrastructure or vertical and chances are we are running an event where students are not only showing technical capabilities but soft skills,” such as writing reports making a case for new technologies, or dealing with budget constraints or interfacing with C-level management who are not versed in technology, O’Brien explains.

The National CyberWatch Center’s events allow companies to recruit, receive resumes and individualized performance reports that show how individuals did across competencies such as analyzing log files or discovering vulnerabilities. “We call them scouting reports,” O’Brien says. 

Companies like Facebook are looking at these events to hire security professionals, he says. In fact, Microsoft, Raytheon, and government agencies such as the Homeland Security Department and National Security Agency, were partners and sponsors of the 2015 MACCDC. Still, “Many companies don’t know about these events. We have to do a better job at outreach,” he says.

Establish the Right Playbook, Team

The goal of all security programs should be to have that group of experts, like Navy Seals, who can create the playbook, who understand the threat and can put in place the necessary procedures and tools to defend their organizations, says Adam Vincent, CEO of ThreatConnect, developer of a comprehensive threat intelligence platform used in security operation centers globally.

After security manager establishes a team and playbook, then “I believe in promoting the junior generation in getting more experience and training them into becoming senior folks,” Vincent says. “The reality is there is not enough senior folks to go around. We need to raise people within and make them the players we want them to be instead of waiting for the right senior person to come along."

Government and the private sector are competing for the same resources, which is driving up the price for security professionals tremendously, Vincent notes. The median annual wage for information security analysts was $88,890 in May 2014, according to the Bureau of Labor Statistics. Salaries for security professionals with certifications could range as high as $103,117 annually, according to The 2015 (ISC)² Global Information Security Workforce Study,

ThreatConnect is in partnership with 15 colleges in the US and is part of The National CyberWatch Center, where company officials helped create curriculum for the process of looking at data from a threat intelligence perspective. The company also lets schools use the ThreatConnect platform to teach the classes.

Haiyan Song, senior vice president of security markets at Splunk, also sees the cross-training of technical people and solutions architects as a way to tackle the talent shortage and find good security people. Splunk develops software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.

“We’ve entered an era of fusion of technology, data, people, and domains,” Song says.

For instance, among Splunk’s own customer base, Song sees synergy between the cybersecurity and fraud prevention teams, which often are engaged in similar use cases.

Splunk’s professional services organization is taking on more security-related projects, so the company established a boot camp program to cross train those consultants who are well-versed in Splunk’s technology on security issues such as anomaly detection, behavior analytics, and common security language and technologies, and in some cases, sending them for security certification.  “This is a great way to get [good security] people fast," Song says.

Talent is also coming in from government, such as personnel who have retired or left the Defense Department to seek opportunities in industry or commercial companies. Splunk's chief of staff was previously with US Cyber Command, for instance. He brings a wealth of knowledge on threat intelligence and, at the same time, is learning a lot about how to develop new technologies for cybersecurity, according to Song. 

“I think cross training people who come from a security intelligence background is another way we are expanding our reach to the talent pool,” Song says.

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/3/2016 | 11:30:21 PM
While getting my CS degree and earning industry certifications in security I worked in a Deaktop Support role in an enterprise organization. My end goal was to join a security team. I learned a lot in this role with respect to sysadmin functions and server builds. As I learned more about security I could see it in my daily workplace and put context to the theory. And I'll readily admit that a network admin, server admin, and endpoint administrator are perfect candidates to lure into any security team. They are already most of the way there they just don't know it yet. If you are one of these people and are interested in security, by all means give it a go. You will not be disappointed as you'll be the one explaining to some of the senior people just what is really going on behind that alert traffic and why. I work with quite a few and I pick their brains daily, sometimes hourly. Good article, sir!
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-05
jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.
PUBLISHED: 2021-03-05
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javasc...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and ea...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlie...
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and ear...