Careers & People

2/13/2017
01:00 PM
Jim Zimmermann
Jim Zimmermann
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

You Can't Hire Your Way Out Of A Skills Shortage ... Yet

It will take much effort to fix the IT and cybersecurity talent crisis, but it is possible.

In 2015, 89% of cybersecurity job postings went unfilled due to the high standards that companies imposed for entry and midlevel positions, according to a CareerBuilder survey. Not enough job applicants had the necessary skills and/or certifications that hiring managers were looking for in potential new employees. The problem is perfect cybersecurity workers don't exist — or if they do, they're employed elsewhere.

When companies began outsourcing, there was a decrease in IT graduates because students feared going into the field without the promise of a career. Combine this lack of incentive with the relatively slow adaption of STEM (science, technology, engineering, and math) skills as a part of a revamped education curriculum, and it's evident that young people aren't introduced to IT opportunities until too late. Interest in other subjects and alternative career paths often occur during crucial development years. 

It's frightening that this shortage of IT skills education coincides with the rapid evolution of the Internet of Things and connected devices — cue the onslaught of new cybersecurity threats. These threats have the potential to be more dangerous than ever. Not only can hackers gain access into consumers' lives through personal computers and mobile phones, but thanks to the web-like nature of connected technology, they can now break into cars, homes, and all the way through to banks and traffic lights.

So, where do we turn from here? How can the industry begin to develop a workforce that is prepared to handle the fluidity and pace of today's cybersecurity industry, closing the cybersecurity skills gap?

Encourage Career Growth Outside of Management
In today's workplace, the path to both financial and career success often runs through management — this is especially true when it comes to small and medium-sized businesses and startups. An employee who is technically gifted at his or her craft often reaches a career "ceiling," and the only way to break through and move up the ranks is to jump to the management side. To keep the brightest and most technically gifted IT workers in the trenches, where they're often most effective, we need to give them incentives — whether financial, a change in title, or both.

Set Realistic Expectations at the Entry Level
Employers must be realistic about expectations for entry-level applicants because this can widen the candidate pool. In a field that evolves as rapidly as IT, many entry-level positions require industry certifications and training that a new employee might not necessarily have (especially those just out of school). Employers should consider applicants who may have some but not all the required skills, knowing that they will be fully trained during their employment. At these entry-level positions, employers should focus on other "big picture" qualities and soft skills that may make the candidate a good fit for the role and the company,  including communication skills, business knowledge, and working as part of a team.

Build "Corporate Universities"
This is an area already seeing growth as companies look for ways they can turn generalists into cybersecurity specialists. These corporate universities allow companies to hire less-qualified employees and train them for current tasks. When the tasks are complete, the employee goes back to the university to get training on the next project. This can be a two-way street for both the company and the employee. While the company gives employees access to the resources they need, an employee can request courses and educational tools to continue professional growth.

Promote STEM Boot Camps for Kids
Many organizations are creating STEM boot camps for kids, designed to get them involved at a younger age. These camps help students build a strong STEM foundation by teaching the basics of math, chemistry, and biology, among other subjects. In a time where the demand for cybersecurity professionals is rising as the candidate supply is falling, it's imperative to invest in the future of the industry.

Make IT Fun
IT and cybersecurity are no laughing matter, but that doesn't mean they can't be fun. Organizations are beginning to host networking events and friendly competitions such as hackathons to allow cybersecurity professionals to network and meet industry peers, while sharpening their skills in the process. Not only are the outcomes and discussions from these events a positive step for the industry, but a little professional fun keeps morale high.

As threats continue to grow with the introduction of new innovations and technologies, cybersecurity and IT skills are more important than ever. Through early and continued education and exposure, as well as a few shifts to organizational structure and expectations, we can begin to get a handle on the skills gap, taking a giant step toward filling the growing number of empty cybersecurity positions.

Related Content:

Jim Zimmermann is Skillsoft's Solutions Principal for IT and Digital Skills Portfolios. He works with current and prospective customers to help them address their IT skills challenges through training. In 2016, Jim was awarded Skillsoft's Outstanding Achievement Award for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
utsec12
50%
50%
utsec12,
User Rank: Apprentice
3/3/2017 | 1:41:12 PM
Something to fix now
I agree that entry level, just out of school, no experience is not as helpful.  But there are many other stats that make InfoSec a critical  position at multiple levels.  Got to have the CIO/CISO, and pay them decent, but the things mentioned like companies sponsoring and helping employees grow.  There should be more $$ incentives for certifications and support for education by Gov and Companies.  The Cyber Security professional attainment will only get more crazy with an ever changing tech environment, not to mention that hackers don't have the same rules to comply with:(
IanT113
0%
100%
IanT113,
User Rank: Apprentice
2/13/2017 | 2:15:59 PM
skills shortage in infosec
Hi - good post, thanks.

I'd say we're trying to hire too many people in infosec. We created roles around minute specifications for some reason, not sure why.

Entry level roles in infosec should not exist. We should be demanding 5 years of demonstrated excellence in some IT field with some evidence of the ability to be flexible (e.g. windows/messaging does some coding and *nix) before considering a more holistic IT-biased role in security. There are so many reasons for this, too many to cover here. The counter to this could be that there aren't enough wizards that fit this description, but i believe we need _fewer_ people, not more...but that's a story for another day :)

A team of 400 security staff employed by a large bank coiuld be reduced to 6.

More details at my blog site - seven-stones dot biz 
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer, AvePoint, Inc.,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Surviving the IT Security Skills Shortage
Surviving the IT Security Skills Shortage
Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15607
PUBLISHED: 2018-08-21
In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote atta...
CVE-2018-14795
PUBLISHED: 2018-08-21
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files.
CVE-2018-6692
PUBLISHED: 2018-08-21
Stack-based Buffer Overflow vulnerability in libUPnPHndlr.so in Belkin Wemo Insight Smart Plug allows remote attackers to bypass local security protection via a crafted HTTP post packet.
CVE-2018-14793
PUBLISHED: 2018-08-21
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution.
CVE-2017-17305
PUBLISHED: 2018-08-21
Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher R...