The cybersecurity talent gap is real. The 2019/2020 Official Annual Cybersecurity Jobs Report predicts that there will be 3.5 million security jobs left unfilled globally by 2021. The cybersecurity profession hit a 0% unemployment rate and the pay is good. So, why are security leaders struggling to fill positions? It could be because they are looking for the perfect candidate that doesn’t exist. Meanwhile, their newest security team member may already be working in their company.

Unrealistic Guidelines for Cybersecurity Professional Careers

Traditionally, the standard for entry-level cybersecurity professionals was five years of experience and several certifications, most specifically the Certified Information Systems Security Professional (CISSP) certificate. Even interns, who work with a company, have a tough time getting hired. Those who put in five years in the field and gained the certification typically aren’t looking for entry-level jobs.

Job descriptions also don’t match the actual duties. Cyber threats constantly shift, and technology is constantly updated. So, there needs to be a lot of flexibility in the search. Unfortunately, job descriptions are often written by people who aren’t working in the field. They follow a basic template, both overestimating and underestimating the actual needs of the position.

Finally, there is a tendency to overlook talent who don’t check off all the right boxes. Anyone who has attended a security conference knows how homogeneous the demographic is. Most climb the same ladder to get to the job. But, defining what that ladder is means a lot of potential great hires are ignored.

Looking Right in Front of You

Because cybersecurity is time-sensitive and requires urgent attention, decision-makers need to be creative about developing a security team. Looking internally should be the first option, and that means looking beyond IT.

Cybersecurity requires a variety of skills. Technical skills are taught. Soft skills, such as communication, writing, problem solving, management and work ethic, come naturally. Every security team needs someone who can work directly with the organization’s entire staff and clearly articulate security problems and behaviors; someone who is approachable; someone who isn’t afraid to take the lead and fix a problem. Most importantly, this will be someone who already has an interest in cybersecurity and follows good cyber hygiene practices.

Behavioral analytics is also a popular function in attack prevention. While this can be done with artificial intelligence (AI) tools, it also helps to have a human who can provide security awareness training and be able to detect what employee behaviors could predicate potential threats.

How to Find the Right Future Cybersecurity Professional

How do you figure out who in the company is a good candidate for a cybersecurity career? One way is to create a company-wide security team with one or two representatives from each department. Work with department heads to find out who meet some of the criteria you’re looking for — someone good with computer technology, is a self-starter and can communicate security issues back to co-workers. As the team meets regularly, you’ll learn who has the right characteristics like passion, strategic thinking and creativity to understand the mind of a threat actor.

Putting together a security team will help you build a cybersecurity culture within the company. Everyone should be cyber aware and be doing their part to protect corporate assets from threats. Use incentives and rewards to encourage the type of culture. Take note of who is succeeding in practicing good security habits. They also could be future security professionals.

Finally, work with corporate leadership to offer the type of formal technical training that the potential security professional will need. It could be a couple of courses in security for IT workers already adept with computer skills, or more in-depth technical training in computer architecture, cloud computing, programming and specific training your company needs.

The cyber skills gap isn’t going to disappear overnight, but you can reduce unfilled entry-level positions in your company by taking a hard look at the talent already in house.

More from CISO

Bridging the 3.4 Million Workforce Gap in Cybersecurity

As new cybersecurity threats continue to loom, the industry is running short of workers to face them. The 2022 (ISC)2 Cybersecurity Workforce Study identified a 3.4 million worldwide cybersecurity worker gap; the total existing workforce is estimated at 4.7 million. Yet despite adding workers this past year, that gap continued to widen.Nearly 12,000 participants in that study felt that additional staff would have a hugely positive impact on their ability to perform their duties. More hires would boost proper risk…

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…