- There’s a significant and growing gap between available corporate and government cybersecurity jobs and the people available to do them, with 3.5 million cybersecurity jobs possibly going unfilled by 2021.
- Many people might not realize they have skills that are transferable to this in-demand field, experts said.
- Puzzle-solving ability, leadership skills, communication acumen and business risk experience are all sought in the cybersecurity job market.
This week in Las Vegas, some of the most talented cybersecurity minds have gathered to take part in two of the year’s biggest hacker conferences, Blackhat and Defcon.
The highlights of these conferences are often what can best be described as cyber magic tricks, where technicians show off their skills by proving how they can break into various devices, such as computers inside cars, voting machines and medical instruments.
These demonstrations may lead you to imagine that cybersecurity professionals need technical abilities. But there are many career paths in the increasingly high-demand and lucrative field, and some may require only small tweaks in skills and experience.
Corporations in the U.S. and globally are seeing a major shortage in qualified applicants for cybersecurity jobs, meaning more people with transferable skills will need to be trained into them. Today, the U.S. Department of Commerce estimates there are around 350,000 cybersecurity jobs currently unfilled in the U.S. Cybersecurity analytics and research company Cybersecurity Ventures released data that indicate 3.5 million cybersecurity jobs are likely to go unfilled globally by 2021, making this an excellent career path.
These jobs can pay exceptionally well, too. Top cybersecurity jobs, like chief information security officer — typically the highest-ranking cybersecurity employee in a company — often fetch salaries above $300,000 in top metropolitan areas such as Washington, D.C., New York and San Francisco, according to cybersecurity recruiting firm SilverBull. Salaries for cybersecurity staff range from $90,000 to more than $200,000 for more experienced employees, including jobs such as information risk managers and security engineers, according to career information company Glassdoor.
“I think we have perpetuated this myth that cybersecurity is based on this hacker stuff, sitting in a basement and only working on technical things,” said Vyas Sekar, an associate professor of electrical and computer engineering at Carnegie Mellon’s Cylab.
“In fact, it’s those with an analytical mindset that can do very well in the cybersecurity field. The sort of basic computer science that is necessary can be taught later. It’s maybe more useful to think of cybersecurity as solving a bunch of interesting puzzles.”
Calling all cops, musicians and crossword enthusiasts
People with experience in project management, analytics and data science, technical writing, law, policy, third-party oversight, or physical security functions like law enforcement or military roles, may all be able to qualify for cybersecurity jobs by fine-tuning some critically needed skills, said Pete Metzger, a recruiter of c-suite cybersecurity professionals with consulting firm DHR International.
“The fact is that, because of the imbalance in the equation of supply and demand, these jobs have become not only hot but highly paid,” said Metzger, who started his career in the Marine Corps and later served as a foreign intelligence officer with the Central Intelligence Agency.
Companies are looking for people who can help them “reshape” how they think about security, he said. Having the ability to “solve problems, having exceptionally well-tuned leadership skills and the ability to influence people in various lines of business,” are critical to what corporations are seeking in cybersecurity executives and staff, he said.
In addition, companies are increasingly being asked to cooperate with one another, with government agencies or with international organizations to share information about threats and incoming attacks. Doing so involves carefully creating channels for sharing sometimes sensitive information and building trust between factions who might not traditionally get along. Those jobs require excellent relationship-management skills and the ability to help move partnerships forward, especially those that involve a mix of the public and private sectors, Metzger said.
People with experience quantifying risk have become particularly valuable, including accountants and data analysts, said Sekar. “It’s a very broad landscape. There are aspects of psychology, being able to understand users and user behavior. There are aspects of strategy, for people with experience formulating business strategies,” Sekar said.
He used the example of how British military officers in World War II used a timed crossword puzzle in a newspaper — not complex math problems — to try to find people well-suited for solving the encryption of Germany’s code-generating Enigma machine.
“Some early solvers of encryption problems were linguists, not mathematicians. What is necessary or critical in cybersecurity is the ability to analyze, and the curiosity and the desire to understand how things work,” he said.
Many cybersecurity job listings focus very little on technology qualifications: Chronicle, the new, secretive cybersecurity company launched by Alphabet in January, is recruiting for technical writers who can provide “a key link between engineers, UX, product, marketing, and customers.” The job calls for some experience interpreting source code, but doesn’t ask for a technical degree, instead focusing on people who have experience with “technical writing, product documentation, or online publishing, including experience with writing technical customer-facing materials.”
Apple is recruiting for a security counsel to help aid in investigations of cyber intrusions, fraud and other breaches. The job requires a law degree. Three of the top skills required don’t even mention technology, but instead ask for investigations experience “in a prosecutor’s office, law enforcement agency or corporate environment” and “excellent diplomacy and communication skills.”
Many companies require certifications in cybersecurity, and the CISSP, or Certified Information Systems Security Professional, is still the “gold standard,” said Metzger. But he adds that even top cybersecurity executives have entered the field from leadership positions in IT and risk, only to get those critical cybersecurity certifications later. “The key is really having those strong leadership skills and the ability to communicate and put a price on how these issues could hurt the company financially,” he said.