Cybersecurity teams struggle to find the right people with the right skills and retain experienced employees. Things are likely to get worse as inflation and a tight labor market push up wages.
This is the view of the Board of Chief Information Security Officers speaking at Infosecurity Europe. But there are steps organizations can take to ensure greater diversity, build cyber teams from within, and retain the most talented employees.
According to Paul Watts, a prominent analyst with the Information Security Forum (ISF) and former CISO, universities produce graduates with strong technical knowledge, but the skills needed to do their job in a business environment. not necessarily have a wider range of skills. This includes a lack of communication skills, an understanding of how a business operates, and even a lack of emotional intelligence.
Erhan Temurkan, director of security and technology at Fleet Mortgage, echoed his sentiments. “I could see that the colleges were coming out with graduates who knew how to use the tools,” he said. “But I would say that having a paintbrush does not make you an artist.”
Additionally, graduates may lack a deep enough understanding of networking and IT operations.
One reason is that graduates have a very limited view of the role of cybersecurity. “Every student wants to be a pentester,” Watts said.
He suggested the industry could do more to demystify a wide range of roles within the industry, including roles that can prepare entrants into management.
Read more about the cybersecurity workforce: The cybersecurity workforce gap will widen by 26% by 2022
Cara Annett, Director of Security Awareness and Culture at RX Global, wondered if the industry could do more to recruit people with backgrounds outside of cybersecurity and IT.
“I come from a non-technical background. How can I attract people from creative backgrounds?” she asked. “We rely heavily on academia to build our pipeline. [of talent], but is it necessary for individuals and businesses? ”
The panel agreed that employers could do more to attract talent by engaging with undergraduates early and casting a wider net.
“I have been giving guest lectures and it has given me a real lens into the daily life of security engineers, SOC analysts and even CISOs,” said Temurkan. “This is where alumni get real insight. And as a community, we must continue to give back.”
Companies can also diversify their hiring efforts by focusing on underrepresented groups and looking internally. “Such diverse groups can exist within an organization,” says Annette.
But the committee acknowledged that upward pressure on salaries is likely to continue. But companies should also look beyond just paying wages. Flexible work and working from home are now “hygiene factors,” Temurkan admitted.
“It may be comparable in terms of salary, but if other organizations allow them to work from home for an extra day or two, they will follow suit,” he said.
Watts argues that when companies invest in people, they are more likely to retain employees. “We have a horrible situation where colleagues are reluctant to train people because they become ‘escape hazards’. But you have to train people. Otherwise, it will become a revolving door. ”
