Cyber security industry key to solving skills gap

By 2022, there will be 1.8 million unfilled cyber security jobs, according to the latest (ISC)2 global information security workforce study.

“In Europe, the shortfall is projected to be around 350,000, with the UK’s share of unfilled cyber security jobs expected to be around 100,000,” said Adrian Davis, managing director for the Middle East, Europe and Africa at (ISC)2.

The study also revealed that only 10% of the cyber security jobs around the world are currently filled by women, with that figure falling to 8% in Europe, and only 7% of the current workforce is under the age of 30, he told the opening session of the 2017 Security Serious virtual conference.

“As an industry, we are facing a huge shortfall in skills. People with experience are expensive to hire, and there are relatively few women and too few young people being attracted to the profession, with the added problem of a very high churn rate,” said Davis.

Quentyn Taylor, director of information security at Canon for Europe, said information security is one of the toughest areas to recruit people.

“Candidates tend to be too expensive for the roles we have on offer. The other problem is that they have a lot of certifications, but have very little real-world experience, or they have very good advanced technical skills, but they are missing soft skills and the basic skills,” he said.

Taylor said while organisations are fairly likely to be willing to invest in further professional development training, they are generally unwilling to pay for training in basic security skills and the soft skills if these are lacking. “My advice to anyone applying for a cyber security role is to brush up on your basic skills and soft skills,” he added.

But Davis repeated that those recruiting people in cyber security industry have a role to play in making it clear what they are looking for.

“Young candidates tend to think that they need to have technical depth, but in reality, while hiring managers want to see candidates with good technical skills, they tend to weigh communication skills, analytical skills, business knowledge, and risk understanding higher than young candidates do.

“We are not sending the right messages to bring people into the profession – we are telling people we need one thing, but actually we want to hire for something else,” he said.