Keeping it Professional: Modernising the Cybersecurity Workforce 

IE: What are the biggest reasons security professionals change roles? What can organizations do to retain cyber talent?

AF: We did our state of the profession survey for 2022-23, and one of the things that we asked about was career development – why people stay in jobs, why people leave. Obviously, money is important and it’s probably more critical now because of the economic situation.

But very close on the heels of that is the opportunity to progress. If people feel like they’re able to progress and have a good working environment and got interesting work, they’re more likely to stay with you.

The main factors for leaving were toxic environments, bad management, continual boring work, as well as the burnout aspect.

That’s a worry because we’ve got a large proportion of people who are working over 55 hours a week which puts them into the danger zone.

Therefore, you need to develop teams, and we’re trying to advocate that there are a lot of transferable skills like problem solving, analytical and communication. Many those can be taken from other parts of the business. If people can move into something and they see themselves being developed that’s often why they stay.

IE: How important is using inclusive language to attract diverse talent into cybersecurity? What advice do you have for security leaders to ensure this is included in job descriptions?

AF: One of the problems you see with a lot of recruiters is unicorn jobs, where we’re asking for too much. That tends to put people off and the people who it’s most going to put off are diverse communities.

Women for example will not apply for something if they don’t fulfil 80% of the job requirement, whereas men often will say, ‘I’ll have a go at that.’

Similarly, if you’re from a background that’s not wealthy, and you haven’t got much confidence, you’re less likely to go for something because you’ll just see lots of barriers. The language is important because diversity makes stronger teams, and we need people from lots of different backgrounds and skills.

We run an Extended Project Qualification (EPQ) with schools. When took it a couple of years ago, the numbers were very low and we saw that the schools didn’t really understand it. They didn’t have much money so couldn’t pay for it unless they were an independent or grammar school.

We’ve gone out and said we understand cyber. All the content is online, you just need to understand how to mark them. We’ll handle the projects and schools don’t need to pay a penny.

IE: What are the most effective approaches organizations can use to reach a broader range of candidates to fill cybersecurity jobs?

AF: With the EPQ we’ve been targeting inner city communities. That’s been effective.

Another effective approach is apprenticeships because candidates get to work and earn at the same time. There are organisations that are building links with schools to take people in and the Northwest of England is doing a lot with cybersecurity.

Really, there needs to be a partnership between industry and education so that we’re getting interest to learn from the beginning and people can see jobs.

Additionally, with AI coming along, there’s going to be a lot of jobs where you don’t need as many people. Potentially, where organisations are restructuring, they can migrate some of those people into security roles, because they know the business, which is critical for security, and they’ve got transferable skills in areas like project management.

IE: What role would you like to see security teams play in educating colleagues about the dangers of AI?

AF: This is where the whole communications skill will come in. What we’re going to be seeing with AI is that attacks are going to be far more targeted. It’s not going to be the Nigerian prince asking you to send money, you’ll be seeing the attacks more tailored so they’re harder to spot. We have to enable the workforce to see these more easily.

The National Cyber Security Centre (NCSC) recently spoke about this regarding the elections coming up in the UK and US, with the concern over the impact of deepfakes. Within the organisation you need to make people understand how much the world is changing and how to protect themselves, which in turn will protect the company.