What’s behind a supposed shortage of cybersecurity workers? Last month cybersecurity professional Ben Rothke questioned whether a “shortage” even existed. Instead Rothke argued that human resources “needs to understand how to effectively hire information security professionals. Expecting an HR generalist to find information security specialists is a fruitless endeavor at best.”
Rothke — a founding member of the Cloud Security Alliance — contacted Slashdot this week with “a follow-up piece” arguing there’s another problem. “How can you know how many security jobs there are if there’s no real statistical data available?” (Most articles on the topic cite the exact same two studies, which Rothke sees as “not statistically defendable.”)
Which begs the question — how many information security jobs are there? The short answer is that no one has a clue. The problem is that there is no statistically verifiable and empirically researched data on the number of current information security jobs and what the future holds. All data to date is based on surveys and extrapolations, which is a poor way to do meaningful statistical research… Based on LinkedIn job postings, veteran industry analyst Richard Stiennon found 15,849 job openings at 1,433 cybersecurity vendors. As to the millions of security jobs, he notes that the same could be extrapolated for office administrators. There are millions of companies, but it’s not like they all will need full-time security people.
Helen Patton is a veteran information security professional and CISO at Cisco Security Business Group, and the author of Navigating the Cybersecurity Career Path. As to the security jobs crisis, she notes that there are plenty of talented and capable people looking for jobs, and feels there’s in fact, no crisis at all. Instead, she says part of the issue is hiring managers who don’t truly stop to think about the skills required for a role, and how a candidate can demonstrate those skills. What they do is post jobs that ask for false proxies for experience — degrees, certifications, work experience — and as a consequence, they are looking for candidates that don’t exist. She suggests that fixing the hiring process will go a lot further to close the skills gap, than training a legion of new people.
Challenging this supposed glut of unfilled positions, Rothke also shares some recent stories from people who’ve recently looked for information security jobs. (“He tried to explain to the CIO that Agile was not an appropriate methodology for security projects unless they were primarily software-based. The CIO replied, ‘oh the CIO at Chase would tell you differently.’ Not realizing that most projects at the bank are software-based.”)
If you want to know how few information security jobs there really are — speak to people who have graduated from security bootcamps and master’s degree programs, and they will tell you the challenges they are facing… That’s not to say there are not lots of information security jobs. It’s just that there are not the exaggerated and hyperbolic amounts that are reported.