topic Re: Where is the Infosec jobs shortage really at? in Career Discussions

Where is the Infosec jobs shortage really at?

CISOScott — Mon, 15 Oct 2018 13:29:45 GMT

We keep hearing about the cybersecurity job shortages but I am starting to wonder where the shortages are really? Is the expectation set so high that everyone wants the CISO job starting out at 150K and we have no one to fill the junior analyst type jobs? Is that where they are hurting? I know I could use some more analysts. I also work with people who have IT skills but lack InfoSec skills. Are we facing a crisis of not really shortages but under skilled or unknowledgeable IT workers in the ways of InfoSec?

Tell me where your shortages are or what you see as the gap left unfilled.

Re: Where is the Infosec jobs shortage really at?

rslade — Mon, 15 Oct 2018 19:41:00 GMT

> CISOScott (Advocate I) posted a new topic in Career on 10-15-2018 09:29 AM in the (ISC)Â² Community :

> Are we facing a crisis of not really shortages but under
> skilled or unknowledgeable IT workers in the ways of InfoSec?

I've been seeing the same types of "we have no skilled workers" articles, stories,
and complaints for over 30 years.

Over the same time I've seen lots of skilled and competent workers who can't get
(proper or appropriate) jobs. I've never been unable to fill positions when I've
needed to.

I don't think there is any particular lack of skilled infosec workers. I do strongly
think there is a lack of skilled or knowledgeable HR staff. And also a lack of
willingness on the part of companies to pay for any kind of training ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Nothing in this world can take the place of persistence. Talent
will not; nothing is more common than unsuccessful people with
talent. Genius will not; unrewarded genius is almost a proverb.
Education will not; the world is full of educated derelicts.
Persistence and determination alone are omnipotent. The slogan
`press on' has solved and always will solve the problems of the
human race. - Calvin Coolidge
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Where is the Infosec jobs shortage really at?

CISOScott — Tue, 16 Oct 2018 12:15:45 GMT

@rslade wrote:
I don't think there is any particular lack of skilled infosec workers. I do strongly
think there is a lack of skilled or knowledgeable HR staff. And also a lack of
willingness on the part of companies to pay for any kind of training ...

And we have a winner! I have seen more incompetence in the HR field than any other. I know there are competent ones out there within the HR field, but they are few and far between.

Now how do we bridge that gap. I know I have been attempting to work with HR depts. to help them and I know that they are usually (at least in the federal and state space) held back by archaic laws and regulations.

Re: Where is the Infosec jobs shortage really at?

JayCee — Tue, 16 Oct 2018 12:49:05 GMT

In my experience it is down to a lack of flexibility in the remuneration package/s on offer and as stated above, insufficient training budget or desire to provide that training for new staff or even the current ones!

It really doesn't need that much investment to make a change for the better, but there are always so many calls on what little budget exists.

Re: Where is the Infosec jobs shortage really at?

Flyslinger2 — Tue, 16 Oct 2018 14:41:50 GMT

Here in the DC area the Feds are clueless at the salaries that cleared certified talent is requiring. Feds want to pay McDonald's wages and that won't buy you anything. The cost of living is too high, commutes are too long and one year commitments with possible renewable options is not enticing.

I bypass HR by going direct to LinkedIn and other recruiting resources. Once I have the candidate that will make the team successful I will say "this is the person I want". It ruffles feathers but I'm not very lenient when it comes to the overhead that HR has grown to be.

Re: Where is the Infosec jobs shortage really at?

agroll — Tue, 23 Oct 2018 13:01:02 GMT

I do not think there is a shortage. I think the real issue is unrealistic expectations on the employer side. The other thing is they don't know what they are looking for. Take a look at the job descriptions!

The job title says Information Security Analyst. But when you read you realize quickly they are looking for a seasoned Cisco Engineer (with all the certs), an experienced Pen Tester (with all the certs again), and an analyst that has experience with all SIEM tools out there. And of course, every possible certification)

No problem.....until you talk about the salary! You will be lucky if the range is $85,000 to $90,000.

What they are really looking for is someone that has all the above, and is willing to work for no more than $85,000 a year. Oh yeah....I forgot....they also want you to commute every day.

Re: Where is the Infosec jobs shortage really at?

rslade — Wed, 24 Oct 2018 18:17:51 GMT

> agroll (Viewer II) posted a new reply in Career on 10-23-2018 09:01 AM in the (ISC)Â² Community :

> I do not think there is a shortage. I think the real issue is unrealistic
> expectations on the employer side.

Amen!

> The other thing is they don't know what
> they are looking for. Take a look at the job descriptions!

Preach it, brother!

> The job title
> says Information Security Analyst. But when you read you realize quickly
> they are looking for a seasoned Cisco Engineer (with all the certs), an
> experienced Pen Tester (with all the certs again), and an analyst that has
> experience with all SIEM tools out there. And of course, every possible
> certification) No problem.....until you talk about the salary! You will be
> lucky if the range is $85,000 to $90,000. What they are really looking for
> is someone that has all the above, and is willing to work for no more than
> $85,000 a year. Oh yeah....I forgot....they also want you to commute every
> day.

Yup.

Re: Where is the Infosec jobs shortage really at?

doonwind — Wed, 24 Oct 2018 18:24:36 GMT

I am in the UK and I completely agree with you, I am NOT in London, and I truly believe there is a small shortage but nowhere near as bas a press articles are making out it to be. I believe there is a decent sized demand in large international capital cities but outside of that, I don't believe the issue to be as spectacular as some headlines are making it out to be. Also the job description for some of these positions of so-called Cyber Security are ridiculous in themselves, there is no real expectation of the time involved and dedication in learning such skills and companies come along wishing you to be "Full Stack Engineers" of all InfoSec domains. However I am just a mere minion in the InfoSec world, with a small voice....

Re: Where is the Infosec jobs shortage really at?

Krisboike — Mon, 29 Oct 2018 14:34:59 GMT

I would concur that the balance on ongoing training, certification, and education with current base staff is critical so that the current staff with knowledge of the company, their products, services, processes and technologies can maintain pace with IT security and information security skills, competencies, skills, and the ability to recommend, build, operation, and maintain the security controls and technologies to prevent, identify, detect, respond, remediate (well you get the drill) and eventually establish plans and budgets (the full lifecycle) to ensure data maintains confidentiality, integrity, and availability.

Re: Where is the Infosec jobs shortage really at?

Badfilemagic — Mon, 29 Oct 2018 14:43:46 GMT

Just like the "shortage" of development talent, it seems to come down to an inability to find people with 15 years of experience willing to work for entry-level wages and pay for their own training. In the development world, this is used to push two cost-saving agendas: One is the import of H1B labor on-shore, coupled with pushing much development (and certainly most testing) off-shore.

It is harder to outsource security due to regulatory issues, but not impossible. I think from the technical security/security engineering aspect, we'll continue to see more contractors and/or the use of MSSP, just as a lot of in-house IT jobs beyond the helpdesk/change-the-printer-ink level are removed and those roles picked up at the cloud service providers. Many of the internal jobs will be more policy based.

The degree to which that happens is probably vertical-specific. There is less of it in companies tightly coupled to the defense and intelligence spaces (although one could make the argument that is because those companies exist because the government already outsourced that work to the private sector, and working for a Lockheed or Northrop Grumman in a cyber space IS working for an MSSP) or highly-regulated industries, and more of it in the commercial space due to cost savings.

Of course, maybe I'm just cynical.

Re: Where is the Infosec jobs shortage really at?

rslade — Mon, 29 Oct 2018 17:45:50 GMT

> Badfilemagic (Contributor I) posted a new reply in Career on 10-29-2018 10:43 AM in the (ISC)Â² Community :

> Of course, maybe I'm just cynical.

I think you misspelled "cynical." It should be spelled R-E-A-L-I-S-T-I-C ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Art produces ugly things which frequently become more beautiful
with time. Fashion, on the other hand, produces beautiful things
which always become ugly with time. - Jean Cocteau
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Where is the Infosec jobs shortage really at?

CISOScott — Tue, 30 Oct 2018 12:52:29 GMT

@rslade I know you are not fond of the kudos but if you make me LOL then you are getting one.

Re: Where is the Infosec jobs shortage really at?

Flyslinger2 — Tue, 30 Oct 2018 13:11:11 GMT

@rslade I know you are not fond of the kudos but if you make me LOL then you are getting one.

Thus my kudo also.

Re: CISOScott mentioned you in (ISC)Â² Community

rslade — Tue, 30 Oct 2018 18:37:50 GMT

> CISOScott (Advocate I) mentioned you in a post! Join the conversation below:

> @rslade I know you are not fond of the kudos but if you make me LOL then you are getting one.

I'll try to live with the shame ... 🙂

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
The only truly secure system is one that is powered off, cast in
a block of concrete and sealed in a lead-lined room with armed
guards - and even then I have my doubts. - Gene Spafford
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Where is the Infosec jobs shortage really at?

Caute_cautim — Wed, 31 Oct 2018 19:52:18 GMT

Hmmm Australia is stating a shortage of 500,000 security practitioners by 2019 locally.

I don't think it is hype, given the majority of banks continue to create their own SOCs and attempt to man them with staff from all over the world. with enticements of a better lifestyle and of course a good salary to go with it.

Regards

Caute_cautim

Re: Where is the Infosec jobs shortage really at?

agroll — Wed, 31 Oct 2018 20:01:57 GMT

Australia has roughly a population of 25 million and if the country really has a shortage of 500,000 security practitioners......I can see that to be a big problem. In that case pay would go up significantly. I am going to check into the immigration policy of Australia. I hear it is a beautiful country.

Re: Where is the Infosec jobs shortage really at?

agroll — Wed, 31 Oct 2018 20:04:01 GMT

That is a good observation

Re: Where is the Infosec jobs shortage really at?

Caute_cautim — Wed, 31 Oct 2018 20:06:08 GMT

One of my colleagues in New Zealand is going across to Australia - look in the Public Sector as well - they are struggling too.

Having lived in Australia, I prefer New Zealand personally.

Regards

Caute_cautim