“There are over 5 million jobs open in this country. The reason they are not filled is skills.” — Ginni Rometty, IBM CEO, speaking to Fox Business about new collar jobs.

Organizations are suffering from an inability to fill vacant technology and cybersecurity positions. A four-year wait for students to complete their curricula is an eternity for the technology sector given the rapid pace of innovation and change in the field. And since most organizations today cannot run without technology and an appropriate level of cybersecurity, this skills gap really extends to entire countries. A March 2017 report by Frost and Sullivan predicted that the number of global unfilled positions will reach 1.8 million by 2022.

Closing this gap in qualified workers requires innovative thinking, and security leaders must reach out to new pools of talent. In this new era of cybersecurity talent acquisition, potential recruits don’t need to have advanced degrees. This is neither a blue-collar nor a white-collar job; today, according to Rometty, “we have a new collar.”

What Are New Collar Jobs?

According to the recent report by the IBM Institute for Business Value (IBV), “It’s Not Where You Start — It’s How You Finish: Addressing the Cybersecurity Skills Gap With a New Collar Approach,” new collar is a term that refers to “professionals who may not have a traditional college degree but do have the needed technical skills and aptitudes.” The report stated that “a new collar approach focuses on skills — not degrees earned — as a prerequisite to find and attract nontraditional candidates with diverse backgrounds and skill sets. Once hired, these new employees are expected to strive for continuous learning and professional growth.”

Monster offered five examples of new collar jobs that people can go after without a four-year degree. Here are three relevant to cybersecurity:

  • Cloud administrator — someone who develops, deploys and maintains cloud-based services. Many such folks are self-taught or have completed relevant certifications, and are proficient in scripting languages such as Perl, Ruby and Python.
  • Service delivery analyst — someone who relies on software to review how services are provided to end users and seeks to improve those processes.
  • Cybersecurity architect — someone who can design, implement and test the security of an organization’s networks and computers, including running vulnerability assessment software.

Read the complete report: Addressing the Skills Gap with a New Collar Approach

IBM Takes the Lead

Rometty is not only credited with having coined the term new collar, but she is also leading the charge and taking bold steps to challenge the way governments, academia and various industries approach talent acquisition.

In her November 2016 open letter to the then President-elect, Rometty wrote, “What matters most is relevant skills, sometimes obtained through vocational training.” She went on to share IBM’s success in championing a new educational model for the U.S. by creating “six-year public high schools that combine traditional education with the best of community colleges, mentoring and real-world job experience.” IBM supported the opening of the first such school in New York five years ago and hired some of the first graduates, Rometty explained, adding that there would soon be 100 of these schools across the country.

With the letter, Rometty challenged the government to create “a national corps of skilled workers” to address the thousands of IT jobs that would otherwise go unfilled.

Closing the Skills Gap

The IBV report outlined three ways to address a talent shortage:

  1. Change the way work is done (e.g., automation, outsourcing).
  2. Change the environment (e.g., change culture, benefits or compensation to attract more talent).
  3. Change who the organization pursues.

The final option means reviewing input filters, casting a wider net and seeking to recognize talent in the early stages. According to the report: “There is a growing realization that new roles focused on emerging technologies require specific skills and knowledge to perform, but do not necessarily require a university degree. The approach also involves restructuring work around specific skill sets to create new roles.”

Organizations should look at how they assess and develop core attributes and skills. IBV defined core attributes as “a general disposition beneficial to security professionals — a set of common personality traits and learned behaviors.” Skills can include both technical and workplace-related abilities. The figure below shows how core attributes and skills can be mapped along different characteristics.

The IBV report highlighted a whole suite of steps that organizations can take to solve the talent shortage. The steps include the following:

  1. Re-examine your workforce strategy. Look at redefining or re-aligning various roles to ensure that they represent different levels of skill mastery, including an entry-level category that might not require a four-year degree. The report presented several examples of roles for each main cybersecurity category: builders, operators and communicators.
  2. Improve your engagement and outreach. Expand your recruiting grounds and interact with instructors, classes and, ultimately, students.
  3. Build a local cybersecurity ecosystem. Foster innovation and collaboration by engaging with regional workforce organizations and academic institutions, including secondary schools. The report also mentioned the benefits of providing externships for instructors to stay current in the field and ensure that students get fresh and relevant information.
  4. Provide a robust support program for new hires. After all, their success will be your success.

The figure below highlights various activities that organizations should consider to close the skills gap.

The talent shortage is likely to continue, but adopting a new collar approach can definitely ease the pressure that chief information security officers (CISOs) and organizations are facing today.

Read the full report: Addressing the Skills Gap with a New Collar Approach

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…