Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

2/13/2017
01:00 PM
Jim Zimmermann
Jim Zimmermann
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

You Can't Hire Your Way Out Of A Skills Shortage ... Yet

It will take much effort to fix the IT and cybersecurity talent crisis, but it is possible.

In 2015, 89% of cybersecurity job postings went unfilled due to the high standards that companies imposed for entry and midlevel positions, according to a CareerBuilder survey. Not enough job applicants had the necessary skills and/or certifications that hiring managers were looking for in potential new employees. The problem is perfect cybersecurity workers don't exist — or if they do, they're employed elsewhere.

When companies began outsourcing, there was a decrease in IT graduates because students feared going into the field without the promise of a career. Combine this lack of incentive with the relatively slow adaption of STEM (science, technology, engineering, and math) skills as a part of a revamped education curriculum, and it's evident that young people aren't introduced to IT opportunities until too late. Interest in other subjects and alternative career paths often occur during crucial development years. 

It's frightening that this shortage of IT skills education coincides with the rapid evolution of the Internet of Things and connected devices — cue the onslaught of new cybersecurity threats. These threats have the potential to be more dangerous than ever. Not only can hackers gain access into consumers' lives through personal computers and mobile phones, but thanks to the web-like nature of connected technology, they can now break into cars, homes, and all the way through to banks and traffic lights.

So, where do we turn from here? How can the industry begin to develop a workforce that is prepared to handle the fluidity and pace of today's cybersecurity industry, closing the cybersecurity skills gap?

Encourage Career Growth Outside of Management
In today's workplace, the path to both financial and career success often runs through management — this is especially true when it comes to small and medium-sized businesses and startups. An employee who is technically gifted at his or her craft often reaches a career "ceiling," and the only way to break through and move up the ranks is to jump to the management side. To keep the brightest and most technically gifted IT workers in the trenches, where they're often most effective, we need to give them incentives — whether financial, a change in title, or both.

Set Realistic Expectations at the Entry Level
Employers must be realistic about expectations for entry-level applicants because this can widen the candidate pool. In a field that evolves as rapidly as IT, many entry-level positions require industry certifications and training that a new employee might not necessarily have (especially those just out of school). Employers should consider applicants who may have some but not all the required skills, knowing that they will be fully trained during their employment. At these entry-level positions, employers should focus on other "big picture" qualities and soft skills that may make the candidate a good fit for the role and the company,  including communication skills, business knowledge, and working as part of a team.

Build "Corporate Universities"
This is an area already seeing growth as companies look for ways they can turn generalists into cybersecurity specialists. These corporate universities allow companies to hire less-qualified employees and train them for current tasks. When the tasks are complete, the employee goes back to the university to get training on the next project. This can be a two-way street for both the company and the employee. While the company gives employees access to the resources they need, an employee can request courses and educational tools to continue professional growth.

Promote STEM Boot Camps for Kids
Many organizations are creating STEM boot camps for kids, designed to get them involved at a younger age. These camps help students build a strong STEM foundation by teaching the basics of math, chemistry, and biology, among other subjects. In a time where the demand for cybersecurity professionals is rising as the candidate supply is falling, it's imperative to invest in the future of the industry.

Make IT Fun
IT and cybersecurity are no laughing matter, but that doesn't mean they can't be fun. Organizations are beginning to host networking events and friendly competitions such as hackathons to allow cybersecurity professionals to network and meet industry peers, while sharpening their skills in the process. Not only are the outcomes and discussions from these events a positive step for the industry, but a little professional fun keeps morale high.

As threats continue to grow with the introduction of new innovations and technologies, cybersecurity and IT skills are more important than ever. Through early and continued education and exposure, as well as a few shifts to organizational structure and expectations, we can begin to get a handle on the skills gap, taking a giant step toward filling the growing number of empty cybersecurity positions.

Related Content:

Jim Zimmermann is Skillsoft's Solutions Principal for IT and Digital Skills Portfolios. He works with current and prospective customers to help them address their IT skills challenges through training. In 2016, Jim was awarded Skillsoft's Outstanding Achievement Award for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
utsec12
50%
50%
utsec12,
User Rank: Apprentice
3/3/2017 | 1:41:12 PM
Something to fix now
I agree that entry level, just out of school, no experience is not as helpful.  But there are many other stats that make InfoSec a critical  position at multiple levels.  Got to have the CIO/CISO, and pay them decent, but the things mentioned like companies sponsoring and helping employees grow.  There should be more $$ incentives for certifications and support for education by Gov and Companies.  The Cyber Security professional attainment will only get more crazy with an ever changing tech environment, not to mention that hackers don't have the same rules to comply with:(
IanT113
0%
100%
IanT113,
User Rank: Apprentice
2/13/2017 | 2:15:59 PM
skills shortage in infosec
Hi - good post, thanks.

I'd say we're trying to hire too many people in infosec. We created roles around minute specifications for some reason, not sure why.

Entry level roles in infosec should not exist. We should be demanding 5 years of demonstrated excellence in some IT field with some evidence of the ability to be flexible (e.g. windows/messaging does some coding and *nix) before considering a more holistic IT-biased role in security. There are so many reasons for this, too many to cover here. The counter to this could be that there aren't enough wizards that fit this description, but i believe we need _fewer_ people, not more...but that's a story for another day :)

A team of 400 security staff employed by a large bank coiuld be reduced to 6.

More details at my blog site - seven-stones dot biz 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I've never actually seen the corporate ladder before.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18898
PUBLISHED: 2020-01-23
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14...
CVE-2019-19837
PUBLISHED: 2020-01-23
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
CVE-2020-7210
PUBLISHED: 2020-01-23
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
CVE-2019-19835
PUBLISHED: 2020-01-23
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...