Is cyber security stuck in a recruitment rut?

Jamal Elmellas at Focus-on-Security argues that the cyber security  industry is causing the cyber skills shortage through their outdated recruitment strategies

 

Competition for cyber security talent has never been so intense. The fight over a dwindling pool of experienced candidates has seen demand shoot up.

 

The DCMS Cyber security skills in the UK Labour Market 2022 report shows an annual shortfall of 14,100 in 2021 – almost 50% higher than expected. Other reports have shown salaries are rocketing, with some positions commanding up to 45 percent more than a year ago.

 

At the time of writing, 33,000 cyber security posts remained unfilled.

 

While these statistics paint a grim picture for organisations now facing a recession, look a little closer and they also provide some indications of where they’re going wrong. The DCMS report reveals that over half of cyber employees (54 percent) come from within the sector.

 

Only 27 percent transitioned from a non-cyber role and only 19 percent were new entrants. This means that, as a sector, we’re simply not making it easy enough to break into the market.

 

The top criteria used in job adverts are for certifications and experience. The most desirable qualification is the Certified Information Systems Security Professional (CISSP) which requires at least five years of training, with others such as the Certified Information Security Manager (CISM) requiring two years, and entry level certifications including Certified Ethical Hacker (CEH) and CompTIA Security+ requiring none.

 

Help up the ladder

Industry bodies are now trying to help people get on the ladder with the ISC(2) recently offering its entry level qualification free to 100,000 applicants including the cost of the examination.

 

However, its estimated almost three quarters of entry level job posts ask for CISSP, which means these will never be filled. Those that do accept the entry level qualifications will often only do so when combined with experience, making it impossible for these individuals to find a placement.

 

It’s also increasingly apparent that there’s disconnect between what the IT hiring manager wants or needs and what the HR team is asking for, with HR often acting as a barrier. This means that the job description that’s created and the vetting of applicants is often carried out by those with the least sector knowledge.

 

So it’s not uncommon to see posts asking for ten years’ experience in a technology that’s only been around for seven, for example, or incompatible skillsets. Presumably this is to enable firms to hire one ‘unicorn’ that can take responsibility for multiple areas; but it is a strategy doomed to fail.

 

All of this indicates that hiring teams need to readjust their hiring criteria. Yes, they need to think broader but not in terms of experience in different disciplines. Rather, they need to look for evidence of a candidate’s potential.

 

For enthusiasm and tenacity and those who like to take things apart, the problem solvers and lateral thinkers. Selection methods should include practical tests such as reverse engineering or coding assessments.

 

There’s also a need to break the mould through diversity hires and the evidence is that inroads are being made here. The DCMS study showed the number of women in cyber security roles went up seven percent to 22 percent, ethnic minorities by nine percent to 25 percent, while the neurodiverse and the physically disabled account for 10 percent and 8 percent, respectively. But, while promising, there’s still a sense that this is an untapped reserve.

 

Retention rates

Yet, even when businesses do get it right and are successful in their recruiting efforts, they can often struggle to retain talent. Burn out rates are running at an all-time high, with the Cybersecurity Under Stress report finding that 53 percent thought stress levels had gone up during the second half of 2021.

 

There are also signs that the Great Resignation shows no signs of abating, with 41 percent of IT security managers considering leaving their jobs during 2022.

 

The DCMS report claims 11 percent of the cyber workforce have left since 2020 (of which 9 percent chose to do so) which is almost double the number anticipated. Employers blamed the exodus on better pay or benefits elsewhere (45 percent), those changing career (32 percent) and lack of career development, while 6 percent said it was in pursuit of a better work-life balance.

 

Those reasons tally largely with what cyber security professionals are telling recruiters. They state that salary is the number one reason to move, followed by career progression and then flexible working.

 

Again, these indicators provide the sector with the ways to solve the current retention problem. Like it or not, we’re currently in a candidate-driven market (although the recession may change that) and so employers need to take note of what’s driving people to switch jobs and seek to accommodate those wants.

 

Future vision

Employers may have limited scope when it comes to salary, but they can certainly compete on the grounds of the other two by providing clear career progression and investment in training and the option to work remotely at least part of the time. Indeed, training tends to be underplayed by employers, with recruiters often have to take the initiative and highlight it as a differentiator.

 

There’s been extensive work conducted in this area over the course of the last year, with a consultation being used to inform the UK Cyber Security Council’s Career Pathways Initiative, the results of which will be published in July. This sets out the certifications and experience required to progress within specialist fields, making it easier for professionals to forge their career and for employers to plan their training.  

 

In the meantime, employers can make use of its Careers Route Map. The Chartered Institute of Information Security (CIISec) newly announced cyber-skills framework is also relevant and is geared towards helping organisations develop recruit, and retain talent.  

 

Employers should also be prepared for their staff to be poached, particularly as the skills shortage worsens (the DCMS predicts an annual shortfall of 10,000). The only way to counter this is to engender loyalty through a company culture that values and invests in its employees and puts their well-being first.

 

Consider also how you can minimise stress, and communicate how you will achieve this through more investment in automated security solutions, for example.

 

In conclusion, while the cyber skills shortage is set to worsen, we do have the means to solve it. The industry needs to think more creatively about how it hires, to move away from rigid hiring hierarchies and to utilise the new career pathways to show prospective employees that they can offer them a rewarding career both now and into the future.

 

---

 

Jamal Elmellas is Chief Operating Officer of Focus-on-Security

 

Main image courtesy of iStockPhoto.com