Flash Poll: The Hunt For Cyber Talent

For the Dark Reading security community the Chinese curse, "May you live in interesting times," has never been more true, at least when it comes to staffing.

According to our latest flash poll, roughly eight out of 10 respondents say their companies are struggling with personnel issues related to the skills of in-house staff, finding qualified candidates for new positions, and having a sufficient budget to hire them.

Worse, nearly a quarter of the security professionals who participated in the report say they are “too underwater” with the daily battle of fighting threats to even take the time to reflect and answer our question.

Not surprisingly, only 13 percent of respondents say that they are not hiring, with a little more than half of that cohort reporting that their staffs and skills sets are adequate. For the rest, where head counts are sufficient, managers struggle to train existing security staff on the critical skills to protect corporate assets. A scant 5 percent of respondents in a hiring mode report having no trouble finding qualified candidates.

The point of our State of IT Security poll, which asked readers to select a statement that best describes the status and makeup of their company’s current security team, was to get behind the numbers, trends, salaries, and wage increases reported in the more formal 2014 US IT Security Salary Survey conducted by the research department of our sister site Information Week. We wanted to try and capture the nuances of how security managers are dealing with the rapidly changing threat landscape and dig deeper into how the alleged security skills shortage is playing out in hiring strategies.

The results, as the above chart indicates are, well... interesting. In my view, they reflect what Mark Aiello, president of Boston-based cyber security staffing firm Cyber360 Solution, and Julie Peeler, head of the ISC(2) foundation, spoke of this week during the latest episide of Dark Reading Radio: The Real Reason Security Jobs Remain Vacant. It's their posture that some of the most critical changes in today’s security organizations are driven by the fact that "security is leaving the IT organization and standing on its own." What that means for both hiring managers and candidates is that security practitioners need to be in a constant learning mode in order to stay on top of the latest technology trends and threats. At the same time they also need to take on a broader focus.

"Employers are getting wise to sourcing their talent from social sciences, law, business, and the like, then bringing them in and teaching them the fundamentals of security," Aiello said during the broadcast, adding that the gold standard for advancement is "an ability to understand risk and how it drives the technical side of security [which] requires a bigger picture business focus compared to a narrow technical solution."

Robert McDougal, a senior financial sector information security analyst from Birmingham, Ala., has a slightly different view. He observed in a comment titled "salary bubble" that the security talent pool will continue to remain small because to be a security practitioner requires both an in-depth knowledge base and an expansive skill set. "Those skills span many different IT disciplines and it takes someone dedicated to be able to learn it. Unlike other areas of IT you cannot give someone a step by step tutorial on information security, every situation is unique."

With that in mind, let’s turn our attention to our new poll on cyber security skills, whick asks specifically which security talents are in the greatest demand. You can select three from our list of 10: communication, diversity, forensics, incident response, malware analysis, professional certifications, threat intelligence, understanding of business/industry, user awareness strategies, and vendor management. If none of those apply, please feel free to add your own in the comments. Click here to take the poll.