How can you address the cybersecurity talent shortage in the US?

1. Strategic Partnerships: - Collaborate with educational institutions and training programs to align curricula with industry needs. 2. Diversity and Inclusion: - Actively promote diversity in cybersecurity and create an inclusive workplace culture. 3. Competitive Compensation: - Offer competitive salaries and benefits to attract and retain top cybersecurity talent. 4. Continuous Learning: - Foster a culture of continuous learning with ongoing training and development opportunities. 5. Agile Recruitment: - Streamline recruitment processes, leverage technology, and adapt quickly to changing needs for swift talent acquisition.

Defining your organization's cybersecurity needs is foundational before seeking talent. Identify the precise skills, roles, and responsibilities essential for your cybersecurity strategy. Establish metrics to gauge the team's performance and impact. Assess current and future challenges and opportunities in the cyber landscape. This comprehensive understanding enables crafting a tailored job description that aligns with business objectives, attracting suitable candidates and fostering alignment between the role and your organizational goals.

Investing more in cybersecurity education and training programs should be part of a comprehensive strategy to address the US's cybersecurity talent shortage. Reaching a larger talent pool requires encouraging collaboration between government, business, and academia as well as diversity in the field. Furthermore, establishing routes for enhancing the skills of current IT workers will help fulfil the increasing need for cybersecurity knowledge. In order to draw and keep cybersecurity experts, as well as to improve the country's cybersecurity capabilities overall, it is imperative to offer competitive compensation, benefits, and recognition.

In my experience, you first need to 1. assess your security posture 2. Determine the skills gaps 3. Determine if those gaps are trainable with existing staff 4. Look for internal resources that could be trained up in those skills. 5. Look outside the organization such as hiring us if to find those skills if you can’t find or train them internally.

In my experience, partnering with educational institutions helps tap into skilled talent. For instance, fostering internship programs can offer practical experience and identify potential hires. I agree that internal development is key, ensuring ongoing learning for current staff to build a resilient cybersecurity team.

Pick and focus on the high value-add tasks and headhunt to fill those positions, the lesser value tasks are ripe for offshoring and outsourcing.

The reason for the talent shortage is not because there are lot enough cybersecurity students. It’s because cybersecurity is not an entry level job. It an advance level professional career much like a Dr or lawyer. To be good at this profession, you need to be good at some other discipline like network engineering first.

I would say I agree 100%. With you on the culture and core values every company should have. What becomes challenging is balancing the culture and employee satisfaction with needs of the business to generate revenue at the lowest possible cost structure. Very few companies do this well. I think that having a culture that follows the core values and principles you describe, but also integrates a lean revenue focused approach is way more likely to be sustainable. Great opinion and happy you put it out there Tim.

Fit to corporate culture will lead to loyalty and high retention rate, and let's not forget that loyalty goes both ways. In my experience, monetary issues often are hygienic factors and are listed lower than workplace chemistry.

Salary is not everything. A culture the recognizes and celebrates accomplishments, balances work life, plus encourages growth will increase retention far more than increased compensation.

This almost seems like a joke of a question. A “cybersecurity experience gap”?! That’s like a teacher complaining that no student knows the answer, even though the whole class is engaged and have their hands raised, eager to be called on to contribute. We don’t have a a cybersecurity experience gap problem. Period. Full stop. What we have is a full unwillingness for companies to forecast the future of cybersecurity skills/certs./tools that will be most important and actually train and pay their current and future AMAZING employees and AMAZING candidates to meet these future challenges. Why does the buck keep being shoved to the cybersecurity candidate pool? Oh, that’s why- Companies don’t want to invest or train. End of story.

I absolutely believe that “upskilling” people is one of the best approaches to dealing with this shortage, and it has to be a continuous model. It would be neat if you could hire someone who could perform at the top of a role immediately, but in the real world those people are rare. Instead, you need to be able to take a capable person and help them learn to perform. But even those people won’t stay at their current position forever. Train them to move around or up, and be ready to train their replacements. And this training isn’t one-sided. Just like in academic medical centers where health professionals receive critical training while providing care, the trainers benefit from staying current while challenging their students.

Set goals for cybersecurity certifications that are aligned for both corporate and personal objectives, and support the best of the team to strive for those.

I recently heard someone ask "What if we spend all this money on training employees and they leave?" Answer: "What if we don't, and they stay?"

Investing in training is not optional in cybersecurity. It is a must. Employees won’t stick around if you are not continuing to invest in their growth.

Some functions are much better to outsource. No staff can be an expert in everything and often employees are too over loaded to handle project work. Find a trusted consulting firm and set well defined expectations and goals with them. If you don’t know of one, contact me and I’ll gone you a recommendation.

Karen Draper said "Diversity doesn't look like anyone. It looks like everyone." All voices should be heard. Sometimes that means knowing when it’s time to let someone else speak. Other times, it means amplifying that voice so they’re truly heard. Everyone deserves a seat at the table. Especially in security, it’s about what you know, how you apply it, and how well you can work with others.

We need to stop with the talent shortage narrative. It’s lack of understanding and knowledge of the sector that is making it impossible for people to get hired. Entry level roles with 10+ years experience. Asking for endless certifications. Pay scales that don’t make any sense. Companies need to get educated, and look internally before saying there is a “talent shortage”

It’s been said before, but consider the non-traditional applicants. I admit I speak from a bias because I am one! But look at the soft skills, management experience, and analytical thinking of someone trying to venture into a new career path. Don’t get me wrong, the candidate needs a solid foundation in how things work, but don’t fault an applicant later in their career just because they haven’t worked the help desk. Look at the whole applicant.