Mitigating the cyber-security talent drought

Amanda Finch at CIISec describes how organisations can hire from less trodden pathways

 

In 2023, the global cyber-security workforce grew to a record high of 5.5 million people. Whilst this may seem like good news, the demand for skills is still outpacing growth – at a rate of 12.6%. This talent drought, coupled with the ever-changing nature of the cyber-security industry, makes bringing in new faces as important as ever. 

 

Cyber-security sits against a backdrop of an increasingly volatile threat landscape, with AI, new threat groups, and complex tooling to repel attacks posing challenges. To future-proof against these threats, it will be critical for organisations to recruit more cyber-security professionals who are equipped with the know-how to tackle these risks.

 

In addition, investing in cyber-teams to communicate and educate the wider business is a step in the right direction for ensuring the cyber-skills gap doesn’t open up, as more individuals will understand exactly what is needed from a cyber-security perspective.

 

Overcoming traditional hiring practices

Currently, organisations are sticking with traditional requirements to screen for candidates with very specific technical capabilities. Although cyber-security is a technical profession, there are so many beneficial transferable skills like critical thinking, problem solving and attention to detail that are being dismissed.

 

In fact, a UK Government report revealed that only 33% of new recruits in 2023 came from the non-cyber-security sector. 

 

But people from outside the industry can offer so much to cyber-security. For example, a professional with a background in finance may be able to apply their skills in risk management to cyber-security. Or marketeers could apply their skills in communication to translating complex security terms into language that people will be able to understand.

 

In addition to hiring practices and technical barriers, the cyber-security industry faces a ‘boys only club’ image problem, which is limiting talent applying for roles in the first place. The industry is really missing a trick here. Individuals from different backgrounds bring their unique views to the table, which may help to uncover and reduce security threats that might otherwise be ignored. 

 

Preparing for cyber-security success

The industry must act quickly to break down these barriers and attract individuals of different backgrounds to help build stronger and innovative teams to defend against rising threats. But after decades stuck in the same mindset, it can be difficult shake off the traditional ways of working.

 

Here are a few ways cyber-security organisations can recruit and retain talent, equipping the workforce with the skills to succeed:  

• Look beyond traditional job portals: Firstly, consider where jobs are advertised. While traditional job portals get the message out there, they don’t maximise the chances of attracting fresh talent – organisations should show up where the potential cyber-security stars of the future are. For instance, advertising roles in unconventional venues such as military bases, university campuses or even on social media can help expand outreach.

• Breaking the technical barriers: As such a technical field, the cyber-security industry is limiting its own appeal. It’s all about attracting people to the profession that may not have seen themselves in the role and making space for staff with non-traditional career paths who bring a new approach and way of thinking to solving problems.

• Support professionals early in their careers: Critical skills are often learned through hands-on experience, so young talent may miss out on opportunities for practical experience and technical skills, such as simulations or lab exercises. Although these can be learned, it’s important for organisations to address any knowledge gaps early on and provide a pathway for how they can build on skills. 

• Encourage continuous training and mentoring: Onboarding schemes, along with ongoing training and development can help address some challenges employees face. Encouraging new talent and demonstrating their impact can be invaluable during the onboarding process. Because the threat landscape is constantly changing, organisations must ensure all employees are mentored and motivated so they’re ready to take on any challenge, creating an environment that encourages growth. 

• Provide a supportive environment to prevent burnout: Our recent report showed that more than 22% of cyber-security professionals work more than the 48 hours per week mandated by the UK Government. It’s vital to give employees the right support to succeed and not burn out, enabling individuals to stay in their roles and the industry for longer.  

Cyber-security – an industry for everyone

The cyber-security industry urgently needs more people, not only to bridge the skills gap, but to bring innovative and inclusive ways of solving global challenges to the table.

 

Moving forward, organisations must emphasise that there’s a role for everyone – not just those with technical expertise – and ensure that they’re doing everything they can to retain staff once they’re through the door.

 

If the industry doesn’t, then it risks getting stuck in limbo and cyber-security will lose out, with talented individuals being attracted by other sectors. 

 

---

 

Amanda Finch is CEO at The Chartered Institute of Information Security (CIISec)

 

Main image courtesy of iStockPhoto.com and kyonntra