MO CASHMAN  argues that the cyber-talent gap can be bridged through training, mentorship and coaching.

The cyber-security industry is facing one of its biggest hurdles yet: closing the gap in security operations (SecOps) talent.

According to our recent survey, Mind of the CISO, 30 per cent UK CISOs cited that a lack of skilled talent in their team was one of their primary challenges. Without a consistent influx of candidates, the existing security teams are being stretched too thin, placing these individuals at a higher risk of burn-out.

Attrition also seems to be a growing problem. We identified that two in ten cyber-security professionals currently have plans to move on by 2024. This increases the likelihood of a successful attack with potentially devastating consequences.

In fact, our research found 85 per cent of cyber-security professionals believed the workforce shortage is impacting their organisation’s ability to secure increasingly complex information systems and networks.

We often talk about the talent shortage but when it comes to the industry, more focus is placed on the technology investments and outsourcing of services rather than bolstering individuals within the organisation. It’s time we focus on talent enablement strategies!

From embracing untapped talent pools to investing in innovative training methods and upskilling current analysts, shrinking the cyber-security skills gap will require businesses to think creatively about how to fill these roles.

Innovate to empower your current teams

Before looking outside of organisations, it’s important to first look at innovative ways to upskill our current SecOps teams. When looking at skills development overall, offering opportunities for external training to help current employees progress is important to improving job satisfaction and retention. However, specialised training courses are expensive so it should serve as only one piece of the talent enablement plan.

Leveraging automation, for repetitive sec ops tasks not only improves efficiency overall but also helps new analysts on-board quickly. Artificial Intelligence-enabled solutions are starting to emerge and will help sec ops teams execute complex analysis tasks with little training. Finally, conducting regular purple team exercises provides a realistic training to put all the theory into practice.

But what about encouraging new cyber-security professionals into the industry?

Looking beyond higher education

Encouraging more people into cyber-security-related roles starts from engagement with students in schools. By educating potential candidates in their formative years, the industry can plant the seed which nudges them down that path. However, more could definitely be done within the local community and schools at the organisational level to support this.

Lateral shifts into the industry are also important. The need for more talent indicates that it’s imperative that organisations display openness when considering employees from non-traditional cyber-security and demographic backgrounds. This could see the industry pave the way for greater innovation and progression.

Without addressing these areas, the cyber-security field certainly won’t be optimising its talent opportunities which in turn will have a knock-on effect on productivity, efficiency and creativity within a constantly evolving threat landscape.

The importance of mentorships and coaching 

With a growing skills gap across the cyber-security profession and a higher demand to fill these security-related roles, organisations will need creative solutions for recruitment and retention. In addition to investments in hiring new talent, businesses should also develop their own employees to create sustainable security teams. This is where mentorship comes in.

Mentoring and coaching on the job is incredibly important. After all, as new threats and tactics arise, it’s important that skills remain sharp to better respond and navigate incidents. Skills such as building secure software and applications, assessing vulnerabilities to defend against hacker attacks, and gaining critical computer forensics skills to react to threats are crucial.

Formal and informal mentorship, internships, and apprenticeships would also encourage and support participation of workers from diverse backgrounds into cyber-security-based roles. This guidance can help lower the barrier to entry into the industry and encourage a greater pool of employees to apply and meet the current demand for talent.

Bridging the cyber-security gap

Effective cyber-security is a critical success factor in today’s business world and the industry offers exciting and challenging roles for those who want to help defend against attacks. It’s up to organisations to work harder to show the benefits of a career in cyber-security to current and future employees. Implementing the right approach and processes will help address the growing gap and mitigate the impact further down the line.

It’s important for the cyber-security sector to participate in wider industry discussions on diversity, equality and inclusion and get involved in more initiatives to ensure that candidates from all walks of life are considered for roles.

In addition, CISOs and security leaders shouldn’t shy away from examining the current practices within the industry, so that they’re supporting professionals in the right way. 

By prioritising both factors, we will make progress which will ultimately drive the business forward. Addressing these challenges head on and embracing a talent enablement culture from both a wider community perspective and from organisations themselves, will help to retain current employees in the industry.

• Cashman is Senior Director and Field CTO EMEA at Trellix.