Cybersecurity professionals continue to manage their careers in a tactical manner with little long-term planning.  Many cybersecurity professionals believe that their organizations need to do more to keep up with cybersecurity requirements.

The cybersecurity skills shortage seems to be getting worse, forcing overwhelmed cybersecurity professionals into constant firefighting. While the skills shortage will continue with no end in sight, this year’s research suggests that organizations could and should be doing more to address it.

Takeaways for Cybersecurity Professionals

As with past reports, cybersecurity professionals—especially those in the early stages of a cybersecurity career or individuals seeking to enter the field—should use this research for career planning. Therefore, cybersecurity professionals should:

Start networking, keep networking. Survey respondents recommend that entry-level security professionals join a professional organization as a means for getting their first job. The data also shows that professional organizations act as a catalyst for job hunting, career development, and continuing education. Taken together, the ESG/ISSA research demonstrates that professional organizations can help throughout a cybersecurity career, paying dividends on time and money invested. ISSA itself is a good choice, but the data seems to indicate that cybersecurity professionals will benefit from other regional, industry, and professional organizations.

Resist certification loading—it doesn’t pay. After five years of research, it’s clear to ESG and ISSA that a CISSP and a few limited other certifications can be valuable building blocks for a cybersecurity career. Others may look good on a resume or business card, but cybersecurity professionals consistently claim to get far more out of hands-on experience like internships, mentoring programs, or staff rotation. Security certifications should be consumed for specific use cases, to meet job requirements, or to augment on-the-job experience period.

Make a personal commitment to skills development and training. On an average year, cybersecurity professionals are expected to get about 40 hours of training. This year’s research revealed that 54% of those surveyed reported having more than 40 hours of training in the past year, 24% have had about 40 hours of training, and 21% have had less than 40 hours of training. This data seems positive, but ESG and ISSA also found that many hours of “training” are really used as a means for fulfilling CPE credits rather than real skills development. A cybersecurity professional career is analogous to a physician in that continuing education is critical for each type of profession to keep professionals’ skills and knowledge current and relevant. Therefore, cybersecurity professionals must make a commitment to skills development and training even if this means investing their own time/money or pushing back on employers that minimize continuing education. Given the ever-changing nature of cybersecurity, individuals who invest in their own skills should get a strong ROI throughout their careers.

Pick a technology or business path to pursue. Cybersecurity careers lead to two main roads. One aligns security and business operations, culminating in “C-level” jobs like CISO, data privacy officer, etc. The other digs into the technology toward positions like security engineer, cloud security architect, threat analyst, etc. Obviously, each road requires different skills, but the ESG/ISSA research shows that many cybersecurity professionals are managing their careers haphazardly with no end goal in mind. Indeed, it’s hard to see five or ten years into the future, but at the very least, cybersecurity professionals should decide whether they see themselves in technical or business roles. Upon making this decision, they should set their sights on the chain of command and what skill sets and experiences they’ll need to climb to the next most senior positions.

Remember that when considering a new job, relationships matter. The ESG/ISSA research indicates that cybersecurity professionals get job satisfaction from things like competitive compensation, the ability to work with a strong team and leading technologies, and additional perks for travel, training, industry participation, etc. While these are certainly worthwhile incentives, information security pros should remember that there should be plenty of open jobs offering these benefits. Therefore, ESG and ISSA recommend digging deeper by asking questions like: What’s the relationship like between security and IT departments? Do these teams collaborate well or is there friction? Do executives and the board include cybersecurity in strategic planning and decision making? What’s the relationship between the security team and HR, legal teams, and lines of business? Since cybersecurity is truly a collaborative effort, these relationships could determine cybersecurity program success. It’s worth doing some background research, asking questions, and meeting with non-technical managers as part of the interviewing process.

Takeaways for CISOs and Organizations

This research should be used as a guideline for building a strong and happy cybersecurity team. CISOs and their organizations should heed the following advice:

For goodness sakes, pay your people! Competitive compensation came up several times in this research project and is clearly critical to hiring and retaining security personnel. Given the competition for security talent, organizations that can’t meet this threshold won’t be successful in hiring and will likely lose key security personnel who are being aggressively pursued by recruiters and other organizations constantly. CISOs must push through archaic personnel models and pay grades and take this issue right to executives and corporate boards in pursuit of near-term changes in compensation structures. Business managers must realize that without an experienced security staff, all security investments and strategies will fail.

Drive security further into the business. Organizations should be alarmed by the fact that 29% of respondents said the security team’s relationship with HR is fair or poor, 28% said the relationship with line of business managers is fair or poor, 27% of respondents said that the relationship with the board of directors is fair or poor, and 24% said the relationship with the legal team is fair or poor. This should set off alarm bells to address these organizational problems as soon as possible. CISOs should immediately assess these relationships at their organizations while corporate boards should do the same. Poor relationships will lead to organizational friction, communications issues, human error, and ultimately, increased cyber-risk. The message is clear: Organizations with a cybersecurity culture are in the best position. Certainly, business executives must embrace cybersecurity, but it’s also important for CISOs to move their people, processes, and technologies closer to the business. This may take training, extended interdepartmental collaboration, and process reengineering, which are difficult but worthwhile changes.

Find time and resources for more cybersecurity training and skills development. Some CISOs believe that investing in training is a waste of money that serves as a free education for cybersecurity professionals who will ultimately leave the organization for greener pastures. ESG and ISSA believe this belief couldn’t be more misguided. Conscientious employees expecting continuing education will simply invest their own time and money while growing to resent the organization. Others will languish with increasingly limited skill sets. Meanwhile, cyber-risks continually rise. With the current state of the cybersecurity skills market, some employees will certainly find more lucrative opportunities, but investing in security training will improve the efficacy of the cybersecurity staff, bolster morale, and help the organizations mitigate cyber-risk. Benefits like these are well worth the investment.

Since the cybersecurity skills shortage isn’t going away, develop a long-term plan to address it. As previously mentioned, the cybersecurity skills shortage has created a shortage of qualified cybersecurity professionals as well as a persistent gap in advanced cybersecurity skills. Few organizations have the resources and appeal to hire all the talent they need, and five years of ESG/ISSA data indicate that nothing is going to change anytime soon. Therefore, CISOs need a realistic strategy that assumes staffing and skills risks. For example, organizations struggling to fully staff the security operations center (SOC) should consider investing in process automation and managed services for staff augmentation. The goal here should be covering all security requirements while making the existing staff as efficient and productive as possible.

Consider what’s necessary to make your organization an attractive landing spot for cybersecurity pros. Proactive CISOs want to retain existing personnel while recruiting new employees. The ESG/ISSA research provides a recipe for doing so. First and foremost, the organization must offer competitive compensation, including benefits for continuing education and career development. Internship programs can appeal to entry-level candidates and create a pipeline for new employees, while mentoring and staff rotation programs will help train and acclimate talented individuals. Organizations that create a cybersecurity culture and push cybersecurity into business and IT planning will have a distinct advantage. Finally, CISOs should tap into professional organizations, local threat sharing groups, colleges and universities, etc., to spread the word about the benefits of employment at their organizations. While this strategy won’t eliminate attrition, it should create a healthy and attractive work environment.