Understanding the Cyber Security Talent Gap

The cyber security skills shortage is putting enterprises at risk. Worse, it shows no sign of abating. Here is why it's happening and what employers can do to mitigate the problem. To meet the security requirements to face evolving threats and changing technology, organizations must adapt and shift how they previously managed cyber security. While technical controls and capabilities still remain a priority and a commonly accepted method of securing the environment, adapting to a new approach for hiring cyber security talent can solve a leading concern of many leaders in a cost-optimized and risk-effective manner. Hiring cyber security talent normally uses a top-down approach that fills most senior roles first before filling roles further down the organizational chart. However, because of cybersecurity worker shortages and the need to focus on specific capabilities from a talent pool—sometimes with nontraditional backgrounds—the standard hiring approach is less effective in this competitive job market. While one answer may be to throw money at the problem and hire as many workers as possible to grow your organization over time, this approach does not necessarily lead to reduced risk. No matter what approach to resourcing companies use, the changing nature of cyber risk means companies need to manage talent flexibly to adapt to new threats. By preplanning and understanding the organization’s cybersecurity needs holistically, it is possible to lay out a hiring road map that focuses specifically on the most critical cyber initiatives. Assessing risks, understanding priorities, and then filling those roles based on capabilities and associated skills can reduce risk and protect business value.

The cyber security workforce gap has reached 3.4 million, according to the 2022 (ISC)2 Cyber security A focus on broadening talent pools and employee retention can help close the cyber security talent gap. ?The need for cybersecurity professionals is growing quickly, from 2013-2021 the number of unfilled cyber security jobs grew by 350% and research from Cyber security Ventures predicts that these numbers will remain the same until 2025. Moreover, according to a 2021 report by Accenture, cyber attacks are becoming more prevalent. Cyber security industry experts say breaches and other security attacks are a case of ‘where and when they happen’ and not ‘If.’ With the average number of attempted cyber attacks, per company, rising by 31% between 2020 and 2021, the need for increased Cyber security IT personnel across Ireland and Europe is continuing to accelerate. In fact, a recent report by Microsoft found that the need for cybersecurity skills has grown by an average of 22% across Europe. At the 2022 Munich Cyber Security Conference, Vice President of the European Commission - Margaritis Schinas made an urgent plea for Member states to 'pledge to train professionals on cyber security skills’. Despite increasing cyber security requirements in European legislation, little has been done to combat the talent gap.

Why is there a shortage of cyber security experts?

Approximately 44% of chief risk officers and chief information security officers report having had trouble attracting talent with cyber risk and security skills in the past year. The main reason for the current shortage of cyber security professionals is the skills gap. This is compounded by the increased pressure to secure ever-expanding remote systems fuelled by flexible working arrangements. Employers have found that there simply are not enough cyber security professionals with suitable credentials for the roles available. This is echoed in (ISC)2’s recent study where 70% of cyber security professionals said that they feel their organization does not have enough cyber security staff. Not only this, but a worrying 50% believe that this lack of staff is putting their organizations at a ‘moderate’ or ‘extreme’ risk of cyber attack. The increasing demand for cyber security professionals is widening the skills gap. Technology is becoming increasingly more sophisticated, making the securing of systems and data against cyber threats more difficult than ever before. As a result, organizations now require a larger cyber workforce.

What does a cyber security professional do?

A cyber security specialist safeguards digital data and network and infrastructure. Cyber security professionals work to protect organisation's systems. They ensure that sensitive information remains protected by auditing software and hardware systems. A professional is not only in charge of fixing the aftermath of an attack on the company’s network but ensuring that they are always producing new, efficient, and accurate solutions to prevent such attacks from happening.

A cyber security professional’s day-to-day responsibilities are varied and often change, however, some of their main duties include:

·         Regularly conducting audits of security practices to ensure compliance

·         Problem-solving, analytics, reporting and time management.

·         Analyzing network and application performance to identify irregularities

·         Conduct controlled cyber-attacks to identify gaps or vulnerabilities in a system’s existing structure and protection.

·         Preventing malicious hacks by deploying endpoint detection and prevention tools

·         Working with areas of the business such as HR (Human Resources) to inform employees about cyber-hacking and steps to take to avoid attempts such as phishing.

Apply talent to value protection

Leading organizations understand the impact and likelihood of cyber security and technology risks and seek to reduce those risks to enable the business. It is not just about what capabilities to prioritize, it is also about what skills are needed, if you can find those skills from within the organization, and if you need to hire or outsource. The talent-to-value-protection approach defines the most important roles that show a maximum reduction in risk or create the greatest amount of security value (Exhibit 1). Priority roles should be filled with the right skills to eliminate risk as soon as possible, utilizing all resources, capabilities, and recruiting efforts.

As a case in point, an organization undergoing a cyber transformation sought to fill more than 150 roles across all capabilities. After applying the talent-to-value-protection approach, the company’s leaders prioritized hiring based on critical business risks and what knowledge and skills were required first to secure the business. Using talent-to-value protection allows you to move in the right direction and reduce risk through focused hiring and talent development. The strategy helps identify which skills and associated roles are the highest priority to reduce cybersecurity risk—or, in other words, which can demonstrate the most “return on risk investment.” It allows you to hire the right person at the right time—ensuring that personnel spending is aligned with where it should be based on growth aspirations. Understanding where to focus recruiting efforts is important, as the global dearth of qualified security personnel available to hire requires creative approaches to finding talent.

Shortage of cyber security workers

There is a global shortage of 2.72 million skilled cyber security workers, according to the 2021 Cyber security Workforce Study by the International Information System Security Certification Consortium, or (ISC)2. Cyber security professionals said in the study that the workforce gap remains the number-one barrier to meeting their organizations’ security needs. Sixty percent of respondents report that a cyber security staffing shortage is placing their organizations at risk. The consequences of cyber security staff shortages are real and create challenges for organizational success

Depending on your type of organization, talent-to-value protection can work in a few different ways:

·         Early-stage cybersecurity organizations. For organizations just beginning their security journeys, the first focus is getting key players in place and setting up program management capabilities. This approach focuses on executing strategic initiatives and improvement activities in parallel; it fills management roles proactively and overweighs the importance of leaders (for example, managers and directors) to manage controls and operate capabilities.

·         Steady-state organizations. For organizations with well-established cybersecurity capabilities, the main priority is to make continued improvements to protect against emerging risks. This approach focuses on targeted improvement opportunities; it emphasizes high-impact experts or key frontline employees and places less weight on managers and directors because of the existing leadership structure.

·         Transforming organizations. Companies undergoing transformations prioritize new hires and skills against where the new risk will be or to protect the most valued part of the new business. This approach prioritizes new hires to safeguard the value gained from a business transformation, finding new talent or new skills to reduce potential risk.

The first priority is to understand what capabilities directly impact the systems and processes that drive business value: the crown jewels. The crown jewels are the assets, the data, and the applications that are most critical to business value and operations. Implementing a risk-based approach to protecting these assets requires mapping required controls and selecting the right people to implement them. Organizations can use existing frameworks, such as the National Initiative for Cyber security Education (NICE) led by the National Institute of Standards and Technology (NIST), to focus the organization on the types of skills needed for priority controls. This self-examination helps identify personnel who can be upskilled or determine when new hires are needed. For example, a large Latin American oil and gas company reprioritized its cyber security spending, capability development, and leadership after analyzing its crown jewels. The organization identified what mattered most and clearly defined the most critical risks. This crown jewel identification effort helped provide an understanding of the most critical talent needs and allowed the organization to build a targeted recruitment campaign to build its team’s capabilities. The first priority is to understand what capabilities directly impact the systems and processes that drive business value: the crown jewels. As organizations across all industries race to defend their business value, it is critical that they accelerate to close gaps on controls to reduce risk and stay ahead of evolving attackers. According to a 2021 McKinsey survey, only 10 percent of organizations were found to be approaching advanced cyber security functions, while 20 percent surpassed mature cyber security, which left 70 percent yet to fully advance to a mature approach—further highlighting the need to prioritize for risk-reducing activities that focus on value protection first

When looking to fill critical security positions, it’s time for business leaders to get creative. How is talent being attracted? Are top tools and solutions being invested in to support roles? To this end, here are three simple yet effective ideas to adopt when seeking cybersecurity talent.

Look to new ways of operating: In fields such as manufacturing, many note that tasks can be handled through automation, freeing up skilled workers for more critical tasks. The same holds true for security professionals. DevOps automation tools, for example, provide a way to help bridge the skills gap while also streamlining deployment. There’s a misconception that adopting more automation tools will eliminate the need for workers, but in the case of security professionals, this couldn’t be further from the truth. Organizations should look to leverage automation tools in tandem with hiring skilled team members who understand (or are quick to learn) how to use them as ultimately, automation isn’t perfect. Incorporating automation can help developers and security professionals achieve their goals faster, and reduce downtime.

Double down on diversity: Diversity is critical in every successful organization, yet it’s still an often overlooked approach to bringing in new hires. It’s arguably even more critical to build a diverse team within an organization’s cybersecurity team, as workers with different backgrounds bring fresh perspectives in terms of risk mitigation, problem-solving and strategizing.

Create new skills-based pathways: As the threat landscape evolves, so too must cybersecurity professionals’ breadth of knowledge and remediation methods, making training and upskilling top business priorities. But why should it end there? Security leaders can create opportunities for new career pathways within the organization and potentially discover untapped talent along the way.

Stop overlooking new talent: Speaking of candidate checklists, it’s time to get realistic about the requirements for cybersecurity jobs. There is a large talent pool with baseline skills that are enthusiastic for work and eager to advance their knowledge on the job—but they’re often overlooked. Per Protocol, companies like NextGen Cyber Talent offer cybersecurity training programs to help remedy the gap, but of 250 people that went through the program in 2021, just 20 were placed into jobs or internships. The reality is that this may be due to unreasonable demands from hiring managers who are caught up in traditional hiring methods where significant experience is required, along with rigid pathways for “what it takes” to achieve a level of expertise in the field. It’s here especially where investing in automation is beneficial, supporting the success of those that may be new in their cybersecurity career or making a career move, on top of improving positioning to top industry talent.