Dive Brief:
-
Only 15% of cybersecurity professionals do not plan on leaving their current position, according to an (ISC)2 survey of 250 cybersecurity professionals in the U.S. Of that percent, most are mid-career professionals who are satisfied with their pay and feel "heard" in their smaller companies. While 70% of respondents are open to a "change," they are not actively searching for a new job in 2018.
-
Before entering a new role, cybersecurity professionals are cautious. About 85% of respondents said they would take time to explore a potential employer's "security capabilities" before assuming the position. Only 40% said they would step into a new company that needs improvements in cybersecurity.
-
Alongside a job description that is "clearly defined," potential hires value an employer's willingness and ability to listen the most. Cybersecurity professionals want to be viewed more as consultants to their company's managerial staff. Nearly one-third of cybersecurity professionals are ambivalent to whether or not their C-suite takes their opinions seriously, according to the report.
Dive Insight:
If cybersecurity professionals feel unheard, it begs the question as to what will happen as a result. Security is a function that all employees are responsible for, but if the C-suite isn't listening, an entire company's security practices are weakened.
Already more than 60% of IT professionals say their security teams are either understaffed or show a skills gap. Of those professionals, nearly half say their organizations do not have the resources or support to better IT training, resulting in a larger skills gap.
Unqualified staff will likely allow the foundational measures of cybersecurity to slip through the cracks. For example, Equifax allowed a patchable bug into its system after software updates had been neglected.
There about 300,000 open cybersecurity jobs nationally, and by 2022 that number will rise to 1.8 million. Companies are looking to women and millennials, traditionally overlooked groups for the field, to help bolster the inevitable expansion of cybersecurity teams.
However, few cybersecurity professionals have "advanced" expertise in the field, thus narrowing the candidate pool. But companies can simply not afford having an ill-equipped cyberstaff. Simply throwing money into cybersecurity products is not enough to perform effective offense on maturing cyberthreats.
