August 20, 2020 By Sue Poremba 3 min read

The cybersecurity talent gap is real. The 2019/2020 Official Annual Cybersecurity Jobs Report predicts that there will be 3.5 million security jobs left unfilled globally by 2021. The cybersecurity profession hit a 0% unemployment rate and the pay is good. So, why are security leaders struggling to fill positions? It could be because they are looking for the perfect candidate that doesn’t exist. Meanwhile, their newest security team member may already be working in their company.

Unrealistic Guidelines for Cybersecurity Professional Careers

Traditionally, the standard for entry-level cybersecurity professionals was five years of experience and several certifications, most specifically the Certified Information Systems Security Professional (CISSP) certificate. Even interns, who work with a company, have a tough time getting hired. Those who put in five years in the field and gained the certification typically aren’t looking for entry-level jobs.

Job descriptions also don’t match the actual duties. Cyber threats constantly shift, and technology is constantly updated. So, there needs to be a lot of flexibility in the search. Unfortunately, job descriptions are often written by people who aren’t working in the field. They follow a basic template, both overestimating and underestimating the actual needs of the position.

Finally, there is a tendency to overlook talent who don’t check off all the right boxes. Anyone who has attended a security conference knows how homogeneous the demographic is. Most climb the same ladder to get to the job. But, defining what that ladder is means a lot of potential great hires are ignored.

Looking Right in Front of You

Because cybersecurity is time-sensitive and requires urgent attention, decision-makers need to be creative about developing a security team. Looking internally should be the first option, and that means looking beyond IT.

Cybersecurity requires a variety of skills. Technical skills are taught. Soft skills, such as communication, writing, problem solving, management and work ethic, come naturally. Every security team needs someone who can work directly with the organization’s entire staff and clearly articulate security problems and behaviors; someone who is approachable; someone who isn’t afraid to take the lead and fix a problem. Most importantly, this will be someone who already has an interest in cybersecurity and follows good cyber hygiene practices.

Behavioral analytics is also a popular function in attack prevention. While this can be done with artificial intelligence (AI) tools, it also helps to have a human who can provide security awareness training and be able to detect what employee behaviors could predicate potential threats.

How to Find the Right Future Cybersecurity Professional

How do you figure out who in the company is a good candidate for a cybersecurity career? One way is to create a company-wide security team with one or two representatives from each department. Work with department heads to find out who meet some of the criteria you’re looking for — someone good with computer technology, is a self-starter and can communicate security issues back to co-workers. As the team meets regularly, you’ll learn who has the right characteristics like passion, strategic thinking and creativity to understand the mind of a threat actor.

Putting together a security team will help you build a cybersecurity culture within the company. Everyone should be cyber aware and be doing their part to protect corporate assets from threats. Use incentives and rewards to encourage the type of culture. Take note of who is succeeding in practicing good security habits. They also could be future security professionals.

Finally, work with corporate leadership to offer the type of formal technical training that the potential security professional will need. It could be a couple of courses in security for IT workers already adept with computer skills, or more in-depth technical training in computer architecture, cloud computing, programming and specific training your company needs.

The cyber skills gap isn’t going to disappear overnight, but you can reduce unfilled entry-level positions in your company by taking a hard look at the talent already in house.

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today