The Cybersecurity Talent You Seek May Be In-House

Cybersecurity jobs are in demand across all industry sectors and government agencies.  As organizations struggle to address the shortage of skilled cyber talent, there may be existing employees within the IT department who can be trained to defend networks and critical assets from adversaries, experts say.

Tapping internal IT resources is one among several strategies managers can employ to find good security people, experts say. Companies should also partner with academia and educational organizations to ensure that college and university students receive training in real-world scenarios and technology to make them better equip to handle existing and future threats.

Casey O’Brien, executive director and principal investigator with The National CyberWatch Center, says security managers should tap the talents of network administrators, system administrators, and programmers because they have strong foundational skills in their specialty areas.

“So it is really a matter of giving them the right type of training and education and ways to continue to develop those skills where you are baking security into what they already do,” O’Brien says. “For the most part, they are already doing information security-related work as part of their job. This is the easiest way for organizations to start."

Based in Largo, Maryland-based National CyberWatch Center is a consortium of higher education institutions, businesses, and government agencies focused on collaborative efforts to advance information security education and research as well as strengthen the national cybersecurity workforce. The consortium is funded by the National Science Foundation's Advanced Technological Education Program.

Two programs in particular help train the next-generation of security professionals, providing a skilled pool of talent for potential employers: The Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC), which provides hands-on application of information security skills to enhance students’ understanding of both theory and practice; and The National Cyber League (NCL), which  provides an ongoing virtual training ground for faculty and students to develop and validate cybersecurity skills using content aligned with individual and team games. This approach allows students to test their cybersecurity knowledge and skills in a competitive environment.

Students work in teams on real-world, high-fidelity simulated environments in specific areas such as energy or healthcare, O’Brien says. “Pick a critical infrastructure or vertical and chances are we are running an event where students are not only showing technical capabilities but soft skills,” such as writing reports making a case for new technologies, or dealing with budget constraints or interfacing with C-level management who are not versed in technology, O’Brien explains.

The National CyberWatch Center’s events allow companies to recruit, receive resumes and individualized performance reports that show how individuals did across competencies such as analyzing log files or discovering vulnerabilities. “We call them scouting reports,” O’Brien says. 

Companies like Facebook are looking at these events to hire security professionals, he says. In fact, Microsoft, Raytheon, and government agencies such as the Homeland Security Department and National Security Agency, were partners and sponsors of the 2015 MACCDC. Still, “Many companies don’t know about these events. We have to do a better job at outreach,” he says.

Establish the Right Playbook, Team

The goal of all security programs should be to have that group of experts, like Navy Seals, who can create the playbook, who understand the threat and can put in place the necessary procedures and tools to defend their organizations, says Adam Vincent, CEO of ThreatConnect, developer of a comprehensive threat intelligence platform used in security operation centers globally.

After security manager establishes a team and playbook, then “I believe in promoting the junior generation in getting more experience and training them into becoming senior folks,” Vincent says. “The reality is there is not enough senior folks to go around. We need to raise people within and make them the players we want them to be instead of waiting for the right senior person to come along."

Government and the private sector are competing for the same resources, which is driving up the price for security professionals tremendously, Vincent notes. The median annual wage for information security analysts was $88,890 in May 2014, according to the Bureau of Labor Statistics. Salaries for security professionals with certifications could range as high as $103,117 annually, according to The 2015 (ISC)² Global Information Security Workforce Study,

ThreatConnect is in partnership with 15 colleges in the US and is part of The National CyberWatch Center, where company officials helped create curriculum for the process of looking at data from a threat intelligence perspective. The company also lets schools use the ThreatConnect platform to teach the classes.

Haiyan Song, senior vice president of security markets at Splunk, also sees the cross-training of technical people and solutions architects as a way to tackle the talent shortage and find good security people. Splunk develops software for searching, monitoring, and analyzing machine-generated big data, via a Web-style interface.

“We’ve entered an era of fusion of technology, data, people, and domains,” Song says.

For instance, among Splunk’s own customer base, Song sees synergy between the cybersecurity and fraud prevention teams, which often are engaged in similar use cases.

Splunk’s professional services organization is taking on more security-related projects, so the company established a boot camp program to cross train those consultants who are well-versed in Splunk’s technology on security issues such as anomaly detection, behavior analytics, and common security language and technologies, and in some cases, sending them for security certification.  “This is a great way to get [good security] people fast," Song says.

Talent is also coming in from government, such as personnel who have retired or left the Defense Department to seek opportunities in industry or commercial companies. Splunk's chief of staff was previously with US Cyber Command, for instance. He brings a wealth of knowledge on threat intelligence and, at the same time, is learning a lot about how to develop new technologies for cybersecurity, according to Song. 

“I think cross training people who come from a security intelligence background is another way we are expanding our reach to the talent pool,” Song says.