- [Tia] The cybersecurity skills gap,
a challenge the industry has been faced
with for several years
and does not appear to be going anywhere anytime soon.
In fact, study after study supports the idea
that the skills gap will continue to grow
and security leaders will continue to struggle
with hiring and retaining security talent.
ISC-squared 2021 workforce study revealed
that security professionals view the gap
as the number one barrier to meeting
organizational security needs,
with 60% of the participants citing the shortage
as a source of organizational risk.
The study also showed that even though roughly
700,000 professionals joined
the cybersecurity workforce,
the demand for talent stretches
far beyond the available supply.
Oddly enough, on the other side
of the skills gap conversation
is a growing number of individuals entering
into the cybersecurity industry to help close the gap,
but finding it extremely difficult
to land gainful employment.
While the industry tied to 0% unemployment rate
for cyber security professionals
and the demand for qualified talent continues to rise,
many candidates for security roles are passed
over due to lack of experience,
non-technical backgrounds,
insufficient education and/or certification,
and the list goes on and on.
Let's take a step back for a moment and ask ourselves.
Where is the real problem?
On one hand, we have a growing demand for talent
and a highly competitive market
with a 0% unemployment rate.
And on the other hand,
we have a pool of entry level talent
struggling to find jobs with organizations
that by all accounts are desperate for talent.
So where's the disconnect?
Should entry level job seekers
do more to be considered qualified?
Should hiring managers assess
and redefine the qualifications
for cyber security talent in their organizations?
Maybe security leaders should design
their cyber security programs in a manner
that is more open to the continuous hiring
and development of security professionals at all levels.
Or perhaps it's a bit of all the above.
If you said to yourself all of the above,
you're spot on.
Think about it.
If security leaders restructure their security teams
to create more opportunity for entry level talent,
and to find qualifications based
on the functions of the role,
then job seekers new to the industry
will begin to have a better understanding
of the skills that are actually required
for a given role versus trying to cast
a wide net and touch on a long list of nice to haves,
this in turn will enable newcomers
to hone in on specific skills
leading them to be more qualified and a better match
to the needs of security teams with open roles.
Quite frankly, this approach could even influence
the decisions of certification bodies
and academic institutions task
with educating and validating the experience
of cyber security professionals.
Everybody wins.
I bet I know what you're saying to yourself
as I'm talking through this,
something along the lines of,
"Okay, Tia, this all sounds great,
but unfortunately I can't just wave a magic wand
and make all this happen."
And once again, you're 100% correct,
but trust me, it's not nearly as heavy a lift
as you might be thinking.
As we progress through the remainder of the course
and unpack some common challenges
security leaders face and how to solve for them,
keep the following questions
in mind to help you remain grounded.
Number one, what is your security team's top priority
within the organization?
And number two, what are the team's high level
roles and responsibilities?
Now there's certainly other very important questions
you'll eventually need to ask yourself,
but the goal of these two questions
is to ensure you remain focused
on the desired outcomes of the security program
and your team's alignment to those outcomes.
This way, whether you're a CSO responsible
for leading several functional teams
or a SOC manager responsible
for a specific functional team
within the security program,
keeping the desired outcome
or the why we're here in mind will help inform
both the strategic and tactical decisions
you'll be making as you evaluate
and continuously improve your teams.