Can Enough Cybersecurity Experts Be Found?

Cybersecurity breaches and cybercrime have been recognized as an area of immense risk for years. Organizations ranging from the government to corporations have had data compromised or stolen. Cybercrime alone is a business estimated at hundreds of billions of dollars, according to the Harvard Business Review, and the average company deals with 200,000 attempts against security daily.

The number of incidents and their breadth is triggering concern that there are not enough qualified people to be the white hats: cybersecurity professionals who block security breaches, develop better security, monitor systems, and develop policy and educational programs to fight a threat that is likely only to grow bigger. The concern is very real — analysts estimate well over a million cybersecurity jobs unfilled worldwide.

Developing the No-Collar Job

Multiple issues have led to the weakness in filling the cybersecurity pipeline. The first is the relatively narrow qualifications and fields in which cybersecurity firms look: more than three-quarters of advertised cybersecurity jobs require a bachelor's degree, many specifically in computer science. Only 17% require just a high school diploma.

The second is a lack of knowledge of the field as a career. A Washington Post survey reported that a whopping 82% of people 18 to 26 years old had never had counselors or anyone else mention cybersecurity as a potential career while they were in high school.

The HBR suggests the cybersecurity pipeline could be filled by nontraditional as well as traditional means. The job requires curiosity, the ability to problem-solve, attention to detail, and ethics — not every cybersecurity job requires computer skills or advanced education. One specific solution is the formation of the "no-collar" job: neither blue- nor white-collar, but organized around specific expertise found in community college or certification programs, augmented with continuous learning on the job. Roughly 20% of current cybersecurity hires are from the no-collar pool.

Building a Cybersecurity Pipeline

Companies should move beyond situational hiring and toward building consistent outreach and a "cybersecurity ecosystem" as part of their business strategy. Companies can partner with government, colleges, high schools, and middle schools to make sure young people know what the field is. Mentorship programs and other support networks are also important for new hires, and rotating assignments lets skills be assessed appropriately.

Cybersecurity breaches and cybercrime are major threats now and will continue to be so. Recruiting no-collar positions and building a pipeline of interest in this growing field can eliminate the problem of undercapacity.