A cybersecurity skills gap demands thinking outside the box

A 22-year-old hacker without a degree might not look like a candidate for a six-figure public-sector job, but the Department of Homeland Security’s Christopher Krebs wants the federal government to look twice.

Krebs, director of the DHS Cybersecurity and Infrastructure Security Agency, said the longstanding General Schedule pay scale — which bases federal job requirements and employee salaries on stringent education and experience metrics — hamstrings the department’s cybersecurity hiring practices to disastrous effect. Krebs and his DHS colleagues want flexibility to bring on less conventional hires — a network administrator with a keen interest in security, say, or a self-taught tech whiz with a decade of informal yet substantive experience.

“By the standards we have in place right now, I can’t reward that person and pay them the way they could be paid in the private sector,” he recently told the U.S. House of Representatives’ appropriations committee.

To help fill the cybersecurity skills gap, Krebs has helped spearhead a new initiative called the Cyber Talent Management System, expected to debut in early 2020, which will allow DHS hiring managers to consider a wider range of candidates for security positions and offer them more competitive, market-aware salaries.

Experts say that organizations across both the public and private sectors need to be more flexible and creative when hiring as employers grapple with an escalating cybersecurity skills gap. The nonprofit (ISC)² counts nearly 3 million open and unfilled positions globally, with 500,000 of those in North America. And among cybersecurity pros the group surveyed, almost 60% said their organizations are at extreme or moderate security risks due to understaffing.

Kayne McGladrey, a member of the IEEE and director of security and IT at Pensar Development, based in Seattle, believes the industry can do its part to reframe and rebrand the cybersecurity field to address the cybersecurity skills gap.

“There’s a perception that it is all hands-on-keyboards — people sitting in a basement somewhere drinking soda,” McGladrey said. “That perception, unfortunately, drives a lot of talented individuals who would have made a lot of meaningful contributions to the field to make other career choices.”

McGladrey wants security pros to talk to their colleagues, friends and families about the field and its diversity of roles. He also urges organizations to widen their candidate pools to include those with more varied backgrounds and life experiences.

“Right now in cybersecurity, we’re doing the same thing over and over and expecting a different result — the definition of insanity,” he said.

To fill the gap, get creative Joseph Blankenship, a senior analyst for security and risk at Forrester Research, suggested that organizations look inward for current employees who might be well suited for security careers — then recruit and train them for those new roles. “In years past, people found their way into security almost by accident,” Blankenship said. “Maybe they got some experience using open source hacking tools and said, ‘Wow, this is kind of neat. I think I might want to do this as a job.’ And then they go out and they try to find the job on their own.” But in today’s hiring environment, security leaders can’t afford to wait for those candidates to come to them. Instead they need to actively look, both internally and externally. They should focus on temperament, aptitude and skill over traditional education and experience. “A lot of the best security operators I know don’t have a lot of formal education,” Blankenship said. “They may have a bachelor’s degree but doubtful; they probably don’t have a master’s degree. A lot of them went to trade schools. A lot of them were very much self-taught.