# Is Your CISO Burnt Out yet?

Andrew Reeves, Malcolm Pattinson, Marcus Butavicius

► To cite this version:

Andrew Reeves, Malcolm Pattinson, Marcus Butavicius. Is Your CISO Burnt Out yet?. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.225-236, 10.1007/978-3-031-38530-8_18. hal-05462083

HAL Id: hal-05462083

https://inria.hal.science/hal-05462083v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Is Your CISO Burnt Out yet?
## Examining Demographic Differences in Workplace Burnout Amongst Cyber Security Professionals

Andrew Reeves¹, Malcolm Pattinson²✉, and Marcus Butavicius³

¹ Cybermindz.Org Ltd, Sydney, Australia
areeves@cybermindz.org

² Defence and Security Institute, University of Adelaide, Adelaide, South Australia
malcolm.pattinson@adelaide.edu.au

³ School of Psychology, University of Adelaide, Adelaide, South Australia
marcus.butavicius@adelaide.edu.au

**Abstract.** The aim of the research was to investigate the extent to which a sample of the Australian cybersecurity industry are impacted by Burnout. A cohort of 119 cyber security professionals, 32% of which were CISOs, completed the Maslach Burnout Inventory (MBI). The MBI defines Burnout as a combination of three dimensions, namely, emotional exhaustion, depersonalisation and reduced professional efficacy. Gender and Job Role were significant predictors of emotional exhaustion, but not depersonalisation nor professional efficacy. The interaction between gender and job role was also significant. For emotional exhaustion, female respondents who worked in security consultant roles tended to score higher than their male counterparts. All roles and genders tended to score in the high range on the MBI when compared to the Australian general population, indicating a need for future research and industry attention. In addition, some scores met or exceeded the average level of burnout experienced by frontline healthcare workers. Left unaddressed, this high level of workplace Burnout may add to the wellbeing and retention problems developing within the cybersecurity community. These results indicate that organisations should look to measure the wellbeing of their own cyber workforce and implement meaningful change if they wish to keep their cyber talent and enable them to thrive at work.

**Keywords:** Burnout · Chief Information Security Officer (CISO) · Cyber Security · Confidentiality · Integrity and Availability (CIA) · Maslach Burnout Inventory (MBI) · Workplace Wellbeing · Psychological Safety

## 1 Introduction

The cyber industry has seen exponential growth in recent years, driven by the ever-increasing sophistication of cyber attackers. Cyber-attacks cost the Australian economy an estimated 42 billion AUD per year (University of New South Wales, 2021). This high
cost of failure, teamed with the rapid pace of change, creates a high-pressure environment for the cyber teams who must protect organisational systems, and which can take a toll on the mental well-being of employees. Emerging research indicates that mental health issues such as anxiety, depression, and Burnout are prevalent in the cyber industry. A recent report by Nominet (2021) found that 88% of Chief Information Security Officers (CISOs) report moderate or high stress, and 48% believe that this has impacted their mental health.

In addition, reports by Australian not-for-profit organisation Cybermindz indicate that this level of Burnout can be in excess of that occurring in front-line healthcare workers (Reeves and Coroneos, 2022). Left unaddressed, this extreme level of workplace stress will directly cause attrition of valuable talent in the cyber sector and create readily exploited weaknesses in Australia's national security infrastructure, major corporations, and key economic institutions. Therefore, it is critical for researchers to direct attention to the state of mental health in the cyber sector. The present paper expands on the project reported in Reeves and Coroneos (2022) by utilising a larger sample and by investigating the role of gender and job role in understanding workplace Burnout in cybersecurity professionals.

## 1.1 What is Burnout?

Burnout is identified as a leading cause of attrition within the workforce (Maslach and Schaufeli, 2018). The resulting talent-drain has flow-on effects to the broader security posture of their organisation and to their ability to pursue their organisational strategy and goals. Schaufeli, Bakker, Hoogduin, Schaap, and Kladler (2001) define Burnout as a state of emotional exhaustion (feeling overwhelmed), depersonalisation (a loss of sense of purpose, or otherwise feeling unmotivated and cynical), and low professional efficacy (feeling inadequate) caused by excessive and prolonged stress. It occurs when employees feel overwhelmed, emotionally drained, and unable to meet constant demands in their workplace. As the stress continues, they can lose the interest and motivation in their role, leading to fewer extra-role behaviours (Petitta and Vecchione, 2011). Burnout has become a key topic for researchers who each attempt to map the factors that can lead to Burnout and identify possible interventions as solutions. For this research, we selected the Job-Demands and Resources (JDR) model of Burnout by Bakker and Demerouti (2007) as the most appropriate framework due to its strong research base and previous applications to corporate contexts (for a review, see Bakker and Demerouti, 2017).

## 1.2 What Causes Burnout?

The JDR model of Burnout holds that when job demands are high and job resources are low, stress and Burnout are common (Bakker and Demerouti, 2007). Job demands are defined as the physical or emotional stressors an employee must contend-with in their job role. These include time pressures, a heavy workload, a stressful working environment, role ambiguity, emotional struggles, and poor relationships. In contrast, job resources are the physical, social, or organisational factors that help an employee to achieve goals and reduce stress. They include feeling connected to purpose, autonomy, strong work relationships, opportunities for advancement, coaching and mentoring, and learning
and development. When these factors are balanced, an employee can feel challenged, supported, and thriving at work. However, when the demands outweigh the resources, employees will begin to feel stressed, which over time leads to Burnout. In industries such as cybersecurity, many job demands are inherent to the work and difficult to address (such as the always-on nature of the attack and the high cost of failure). Therefore, it is important for organisations to ensure that they have adequate resources in place to support their cyber workforce to face these challenges.

Left unaddressed, the three components of Burnout (emotional exhaustion, cynicism, and low professional efficacy) are predictors of intent to resign, fewer extra-role behaviours, increased insider threat, and low productivity (Leiter and Schaufeli, 1996; Ohue, Moriyama, and Nakaya, 2011; Petitta and Vecchione, 2011; Pham, Brennan, and Furnell, 2019).

The following section presents a review of literature regarding stress and Burnout in cybersecurity professionals and related roles, the existence of gender differences in the cyber industry, and the need to investigate the levels of stress occurring across job roles.

## 2 Literature Review

An early study by Ivancevich, Napier, and Wetherbe (1983) found that professionals working within the at-the-time still new field of information systems security were not reporting any higher levels of stress than many other job roles at the time. However, in the decades since, the exponential expansion of the internet into every part of modern economies, organisations, and governments has meant that the role of the security professional has become aggressively more stressful. Nobles (2017) found that stress and Burnout were major causes of short tenures in senior roles for security executives. They found that key stressors included the ever-changing nature of technology and necessary interactions with other senior executives who often have a poor understanding of cybersecurity. They recommended that human factors professionals direct greater attention to the issue to identify high-friction areas that degrade the performance of cybersecurity professionals and implement initiatives to reduce the risk. While Nobles (2017) focused on security executives, Dykstra and Paul (2018) performed a similar study looking at entire cyber operations teams. They found that security analyst stress is a common, persistent, and disabling effect of cyber operations and is an important risk factor for performance, safety, and employee Burnout. Since these studies, the cyber industry has grappled with ever more sophisticated attack methods, complexities surrounding the COVID-19 pandemic and the rise of decentralised work-from-home IT systems, and the growth of more aggressive nation-state threat actors. Therefore, it is likely that these early signs of stress have increased since, however that has yet to be examined empirically.

Whilst there are only a few studies on Burnout within cyber security professionals, there is relevant research looking at similar occupations regarding workplace Burnout and stress, such as information technology professionals, Defence cyber warfare operators, and computer science students.

Rao and Chandraiah (2012) explored mental health and coping styles in information technology workers across a series of specific job roles, including management and shop-front IT workers. They found that shop floor workers experienced more job stress
and lower mental health than IT executives. Perhaps relatedly, they also found that the executives can achieve better work life balance. It may be that these executives have greater control over their workload and ability to balance work and life factors than their team-members, and this may also hold true for cybersecurity executives. Alternatively, we may expect that cybersecurity executives will feel a greater responsibility for the cybersecurity posture of their organisation, leading to higher levels of stress than their team. Therefore, while we expect to see a difference between these groups in our sample, we do not hypothesise a direction of the effect.

Regarding cyber warfare, Chappelle et al. (2013) examined the levels of occupational stress and Burnout occurring within active-duty air force cyber warfare operators. They found that these individuals are significantly more likely than others to suffer from emotional exhaustion and depersonalisation. Interestingly, the primary stressors were attributed to the nature of shift work, uncertainty around shift schedules, and long hours worked. Job-specific stressors (such as attacking adversarial networks or defending cyber networks from real-time attacks) were not listed as primary stressors, indicating that their poor wellbeing may be readily addressed through modest reform to organisational planning, procedure and operations. If this is also the case for cybersecurity professionals, researchers may be able to recommend simple solutions that significantly improve the mental wellbeing of cyber teams.

Not only is it clear that cybersecurity professionals are operating under high levels of stress, but there are also worrying signs that the industry is failing to equip the next generation of cybersecurity professionals with the skills needed to cope with the demanding nature of the work. Akullian, Blank, Bricker, DuHadway, and Murphy (2020) argue that computer science students and professionals alike are equally struggling with long hours, the pressure to meet deadlines, and intense fear of failure heightened by recent high-profile attacks. Left unaddressed, many of these budding cybersecurity professionals may become disenfranchised with the industry, further reinforcing the skills shortage (Cabaj, Domingos, Kotulski, and Respício, 2018).

## 2.1 The Importance of Demographics: Gender and Job Role

There is evidence that not only are women underrepresented in the cyber security workforce but that the cyber security work culture may be male biased as well. In 2022, ISC² estimated that only 24% of those working in cyber security identified as female (ISC², 2022). The male bias in the field of cyber security starts at the tertiary education level. Of those studying information technology at university, only 13% of undergraduate students and only 26% of postgraduate students are female (Prinsley, Beavis, and Clifford-Hordacre, 2016). Accordingly, there is evidence that the culture of the cyber security workplace has barriers to the acceptance of women.

There is evidence that barriers such as the dominant stereotype of males in cyber security (e.g., the 'male hacker') (Cheryan, Plaut, Handron, and Hudson, 2013), the lack of acceptance of women in the culture (Panteli, 1998), sexual harassment (Reed, Zhong, Terwoerds, and Brocaglia, 2017), and lack of part-time or flexible work options (Hewlett, Sherbin, Dieudonné, Fargnoli, and Fredman, 2014) make careers in cybersecurity unappealing to many women.
Unsurprisingly, women have reported experiencing a lack of cultural fit in the wider information technology workforce that includes cyber security professionals (Guzman and Stanton, 2009) and a lack of cultural fit has been associated with negative impacts on performance at least in non-IT specific workforce setting (Elfenbein and O'Reilly III, 2007).

In summary, there is evidence that the culture surrounding work in cyber security may be less accepting of females and therefore we predict that there will be higher levels of Burnout for women in our study.

There is also evidence that different occupation roles have different Burnout profiles. Schaufeli and Enzmann (1998) found differences between the occupational sectors of teaching, social services, medicine, law enforcement and mental health when it comes to relative levels of cynicism, exhaustion and inefficiency. Given the diversity of cyber security roles in the modern workforce, we also examined the levels of Burnout across different cyber security occupations in this study. To the best of our knowledge, neither gender nor occupational profiles and their association with Burnout rates in the cyber security workforce have been previously examined.

# 3 Research Method

Based on the above literature review, we expected to observe the relationships in the data shown below.

## 3.1 Hypotheses

**Hypothesis 1:** Gender will significantly predict Burnout scores. Those who identify as women will score higher on average than those who identify as men (due to being in a male-dominated industry).

**Hypothesis 2:** Self-reported Burnout will differ across job roles.

In addition, we expect these relationships to hold across the three dimensions of Burnout, namely:

* Emotional Exhaustion,

* Cynicism/Depersonalisation and

* Professional Efficacy.

## 3.2 Participants

Participants for the study were recruited through a recruitment drive by the Australian not-for-profit company, Cybermindz. Emails advertising the study were sent out via the researchers' networks and via Cybermindz' client organisations. Organisations that expressed interest in taking part in the study were first briefed by the researcher on the details of the project and provided with a recruitment email that could be used with their cyber employees. Employees were able to opt-in to the study by following a link to the Qualtrics platform provided in the recruitment email. Participants were asked to provide their job title in an open text field. These were then grouped by the researcher. Table 1 below presents the demographic characteristics of the sample.
<table><caption>**Table 1.** Demographic characteristics of the sample.</caption><thead><tr><th>DEMOGRAPHIC</th><th>N</th><th>%</th></tr></thead><tbody><tr><td>Gender</td><td></td><td></td></tr><tr><td>Female</td><td>20</td><td>16.8</td></tr><tr><td>Male</td><td>95</td><td>79.8</td></tr><tr><td>Use a different term</td><td>4</td><td>3.4</td></tr><tr><td>Prefer not to say</td><td>0</td><td>0</td></tr><tr><td>Job Role</td><td></td><td></td></tr><tr><td>Leadership/Management (e.g. CISO)</td><td>38</td><td>31.9</td></tr><tr><td>Security Engineer</td><td>21</td><td>17.6</td></tr><tr><td>Security Consultant</td><td>21</td><td>17.6</td></tr><tr><td>Security Analyst</td><td>11</td><td>9.2</td></tr><tr><td>Incident Investigator</td><td>9</td><td>7.6</td></tr><tr><td>Other</td><td>19</td><td>16.0</td></tr></tbody></table>

## 3.3 Data Collection

A total of 119 cyber employees participated in the survey across 11 Australian organisations. Participants had to be at least 18 years of age and employed (full time or part time) for an Australian organisation in a cybersecurity role. Interestingly, the plurality of respondents (31.9%) were in Leadership/Management roles, which are responsible for leading cyber teams or cyber strategy (E.g., CISOs).

The sample captured a broad variety of role types including Cybersecurity Managers, Cybersecurity Analysts, Cloud Security Administrators, Information Security Officers, and Chief Information Officers.

Participants were not reimbursed for their time and were free to withdraw from the study at any time.

## 3.4 Materials

The survey was hosted on the online research platform, Qualtrics. Participants responded to a set of demographics and completed a questionnaire battery consisting of the Maslach Burnout Inventory and other measures for ongoing research projects. The survey took an average of 9 min to complete.

The Maslach Burnout Inventory (MBI) is a widely used psychological assessment tool designed to measure Burnout in individuals, particularly in the workplace (Maslach and Schaufeli, 2018). The MBI-General Survey (MBI-GS) was selected as most appropriate for this cohort. The tool consists of a 22-item questionnaire that measures three dimensions of Burnout, namely, emotional exhaustion, depersonalization (also called cynicism) and reduced professional efficacy (also called low personal accomplishment). Emotional exhaustion refers to feelings of being emotionally drained and overwhelmed
by work-related stressors. Depersonalisation refers to a sense of detachment, a lack of sense of broader purpose, and cynicism towards the value of one's work, while Reduced Professional Efficacy reflects a lack of productivity and feelings of ineffectiveness. Leiter and Schaufeli (1996) and Bakker, Demerouti, and Schaufeli (2002) found the internal reliability for the MBI to be satisfactory. Specifically, they found the Cronbach alpha coefficients ranging from 0.84 to 0.87 for Emotional Exhaustion, 0.74 to 0.84 for Depersonalisation and 0.70 to 0.78 for Reduced Professional Efficacy.

The MBI has been extensively used in research on employee engagement and well-being, particularly in relation to Burnout. Researchers have demonstrated that high levels of Burnout as measured by the MBI are associated with negative outcomes such as decreased job satisfaction, decreased work performance, and increased absenteeism (Petitta and Vecchione, 2011). Furthermore, research has also shown that interventions aimed at reducing Burnout, informed by MBI scores, can improve employee engagement and well-being. For instance, a study by Lloyd, Bond, and Flaxman (2013) found that a stress management intervention based on cognitive-behavioural techniques reduced Burnout and increased job satisfaction among healthcare workers. Similarly, a study by Tims, Bakker, and Derks (2013) found that a job crafting intervention aimed at increasing employee control and autonomy reduced emotional exhaustion and increased job satisfaction among employees in a healthcare organisation.

## 3.5 Data Analysis

Analysis began by checking assumptions for parametric testing and no major violations were observed. To test the hypotheses that Gender and Job Role would predict self-reported Burnout levels, a two-way multivariate ANOVA was performed. Scores on each of the three subscales of the MBI were entered as dependent variables and Gender and Job Role were entered as categorical predictor variables.

## 4 Results

As presented in Table 2 below, the results of the multivariate ANOVA indicate that the model was only significant in the case of Emotional Exhaustion.

<table><caption>**Table 2.** Full model results of multivariate ANOVA for job role and gender predicting three subscales of MBI.</caption><thead><tr><td>Dependent Variable</td><td>df</td><td>F</td><td>p</td><td>Partial Eta2</td></tr></thead><tbody><tr><td>Emotional Exhaustion</td><td>10</td><td>2.86</td><td>.003</td><td>.218</td></tr><tr><td>Depersonalisation</td><td>10</td><td>1.48</td><td>.157</td><td>.126</td></tr><tr><td>Professional Efficacy</td><td>10</td><td>.46</td><td>.915</td><td>.042</td></tr></tbody></table>

Inspection of the full factorial model for emotional exhaustion indicates that both predictor variables and the interaction term are significant.
<table><caption>**Table 3.** Full factorial ANOVA of gender and job role predicting emotional exhaustion in cybersecurity professionals.</caption><thead><tr><th></th><th>df</th><th>F</th><th>p</th><th>Partial Eta2</th></tr></thead><tbody><tr><td>Full model</td><td>10</td><td>2.86</td><td>.003</td><td>.218</td></tr><tr><td>Job Role</td><td>5</td><td>3.98</td><td>.002</td><td>.162</td></tr><tr><td>Gender</td><td>1</td><td>9.18</td><td>.003</td><td>.082</td></tr><tr><td>Job Role*Gender</td><td>4</td><td>2.85</td><td>.028</td><td>.099</td></tr></tbody></table>

Inspection of the average emotional exhaustion scores separated by job role and gender (Fig. 1 below) indicates that the interaction effect may be strongest for security consultants, where females had significantly higher scores than males. Note: our sample did not include any female Cyber Investigators and only one female Security Engineer, which is reflected in Fig. 1 below.

<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Average Emotional Exhaustion scores (and 95%CI) across job role and gender.</figcaption></figure>

Inspection of the box plots (Fig. 1 above) indicates that Emotional Exhaustion scores are similar for both genders, except for Security Consultants and Security Engineers. For these job roles, females reported higher average Emotional Exhaustion than males.

No such relationships were found for the other two dimensions of Burnout, namely, Cynicism and Professional Efficacy.

# 5 Discussion

Our findings indicate that job role and gender do have a significant effect on the level of Burnout being reported by cybersecurity professionals, but only regarding subjective levels of emotional exhaustion. This indicates that gender and the type of job a person has
in cybersecurity impact how emotionally drained they feel due to their work. However, these factors don't seem to affect how cynical they become nor how effective they feel in their professional role. In general, men and women had similar levels of emotional exhaustion, except in the role of Security Consultant. In this role, women reported higher levels of emotional exhaustion than men.

Bakker et al. (2002) found similarly significant interaction effects of gender across occupations. In their study, females reported higher levels of Burnout than males, particularly when they were relatively young or had relatively little working experience. The results presented here may indicate that our sample included security consultants that were relatively early in their career and therefore are experiencing high levels of exhaustion at work. This could be examined in future papers.

Our results supported Hypothesis 1, namely that female cyber security professionals reported higher levels of Burnout than their male counterparts, at least regarding emotional exhaustion in some roles. This difference may be due to the lack of cultural fit experienced by females in the highly male-centric culture – as discussed in the literature review, the cyber security work culture is characterised by the dominate male stereotype (Cheryan et al., 2013), sexual harassment (Reed et al., 2017), and a lack of flexible work options (Hewlett et al., 2014). We propose that this lack of cultural fit has a negative impact on the performance of women in the industry that, in turn, may lead to higher levels of Burnout as they face discrimination and / or raise their performance to compensate for the negative effects of the pervading culture. Addressing this male-biased culture to reduce Burnout amongst females could begin by the promotion of Women in STEM programs at the secondary and tertiary education levels, workplace programs to address systemic issues and the adoption of flexible working conditions in workplaces.

Our results also showed differences in Burnout profiles for work roles in support of Hypothesis 2. Specifically, higher rates of Burnout for females were most associated with security consultant roles than in other cyber security roles such as security analyst and leadership positions. This is consistent with the notion that the different cyber security roles defined in our study reflect different occupational profiles. There is evidence that there are differences in Burnout profiles across different, albeit broader, occupational sectors (Schaufeli and Enzmann, 1998). Alternatively, the culture of cyber security workforce may in fact be comprised of different sub-cultures and that the sub-cultures associated with the security consultant role more strongly reflect the barriers that discriminate against female inclusion in the workplace. Future research should examine the differences in cyber security work cultures in more detail to shed light on this finding in our study and to better inform strategies to creating more equitable workplaces.

Interestingly, regarding Depersonalization and Professional Efficacy scores, our findings did not show significant differences across job role nor gender. Future research could look to examine why the same relationships were not observed here as seen for emotional exhaustion. It may be that emotional exhaustion is the first symptom of a growing problem in the industry, which if left unaddressed, could flow into greater levels of depersonalization and lower levels of professional efficacy. However, it should be noted that while we did not observe between-group differences for these subscales of Burnout, the average scores reported by cybersecurity professionals were at-level or above that of frontline healthcare workers.
Notably, the average level of Burnout in our sample meets or surpasses that reported by Roberts et al. (2021) for frontline healthcare workers in the aftermath of the COVID-19 pandemic. This comparison is particularly alarming given the intense stress and emotional strain experienced by healthcare workers during this global health crisis. Burnout at such an unsustainable high level in this the cyber sector can have serious implications, not only for the individuals affected but also for the organisations they serve and the broader society whose data they protect.

# 6 Limitations and Future Research

The male bias that exists in the cyber industry was reflected in our study with only 18% of females in our sample, which is similar to industry estimates of 24% (ISC², 2022). While our study is reflective of this bias, future research should conduct larger studies to better investigate the differences between the gender dimension of Burnout of Cyber Security professionals. It may be that some of the findings of the current paper are limited by the low proportion of female respondents and this should be further examined in future research.

# 7 Conclusions

Organisations are becoming ever more dependent on their cybersecurity workforce to keep their critical infrastructure secure. This research found that a cohort of cyber professionals, a third of whom are CISOs and other cyber leaders, are experiencing unsustainable high levels of stress and Burnout at work. In particular, many scores met or exceeded the average level of burnout experienced by frontline healthcare workers. Left unaddressed, this level of stress will cause talent attrition and may allow vulnerabilities to go unaddressed in organisational information systems which can be readily abused by attackers. In addition, rampant Burnout may add to the already tight skills shortage occurring in the cyber sector. Our results also found that female respondents who worked in security consultant roles reported greater levels of emotional exhaustion than their male counterparts. This may highlight how the male-dominated nature of the industry is failing to adequately support all members and this will need to be addressed to retain the diversity of talent needed for optimum cyber resilience. In addition, some job roles may place greater levels of stress on the employees than others, identifying potential target areas for future research and intervention. Our results highlight that it is critical for organisations to measure the wellbeing of their own cyber workforce in comparison to the broader industry, and to implement meaningful change if they wish to retain their cyber talent and enable them to thrive at work.

# References

Akullian, J., Blank, A., Bricker, L., DuHadway, L., Murphy, C.: Supporting mental health in computer science students and professionals. In: Proceedings of the 51st ACM Technical Symposium on Computer Science Education (2020)
Bakker, A.B., Demerouti, E.: The job demands-resources model: state of the art. J. Manag. Psychol. 22(3), 309–328 (2007)

Bakker, A.B., Demerouti, E.: Job demands-resources theory: taking stock and looking forward. J. Occup. Health Psychol. 22(3), 273 (2017)

Bakker, A.B., Demerouti, E., Schaufeli, W.B.: Validation of the maslach burnout inventory - general survey: an internet study. Anxiety, Stress, Coping 15(3), 245–260 (2002). https://doi.org/10.1080/1061580021000020716

Cabaj, K., Domingos, D., Kotulski, Z., Respício, A.: Cybersecurity education: evolution of the discipline and analysis of master programs. Comput. Secur. 75, 24–35 (2018). https://doi.org/10.1016/j.cose.2018.01.015

Chappelle, W., et al.: Sources of occupational stress and prevalence of burnout and clinical distress among US Air Force Cyber Warfare Operators. (2013)

Cheryan, S., Plaut, V.C., Handron, C., Hudson, L.: The stereotypical computer scientist: Gendered media representations as a barrier to inclusion for women. Sex Roles 69, 58–71 (2013)

Dykstra, J., Paul, C.L.: Cyber operations stress survey (COSS): studying fatigue, frustration, and cognitive workload in cybersecurity operations. In: 11th {USENIX} Workshop on Cyber Security Experimentation and Test ({CSET} 18) (2018)

Elfenbein, H.A., O'Reilly III, C.A.: Fitting in: the effects of relational demography and person-culture fit on group process and performance. Group Organ. Manag. 32(1), 109–142 (2007)

Guzman, I.R., Stanton, J.M.: IT occupational culture: the cultural fit and commitment of new information technologists. Inf. Technol. People 22(2), 157–187 (2009)

Hewlett, S.A., Sherbin, L., Dieudonné, F., Fargnoli, C., Fredman, C.: Athena factor 2.0: Accelerating female talent in science, engineering, & technology (2014). http://www.talentinnova tion.org/publication.cfm?publication=1420

ISC². (ISC)² CYBERSECURITY WORKFORCE STUDY: A critical need for cyber-security professionals persists amidst a year of cultural and workplace evolution (2022). https://www.isc2.org/-/media/ISC2/Research/2022-WorkForce-Study/ISC2-Cyb ersecurity-Workforce-Study.ashx

Ivancevich, J.M., Napier, H.A., Wetherbe, J.C.: Occupational stress, attitudes, and health problems in the information systems professional. Commun. ACM 26(10), 800–806 (1983). https://doi. org/10.1145/358413.358432

Leiter, M.P., Schaufeli, W.B.: Consistency of the burnout construct across occupations. Anxiety Stress Coping Int. J. 9, 229–243 (1996). https://doi.org/10.1080/10615809608249404

Lloyd, J., Bond, F.W., Flaxman, P.E.: The value of psychological flexibility: examining psychological mechanisms underpinning a cognitive behavioural therapy intervention for burnout. Work Stress 27(2), 181–199 (2013)

Maslach, C., Schaufeli, W.B.: Historical and conceptual development of burnout. In: Professional Burnout: Recent Developments in Theory and Research, pp. 1–16. CRC Press (2018)

Nobles, C.: Stress, burnout, and security fatigue in cybersecurity: a human factors problem. HOLISTICA – J. Bus. Public Admin. 13(1), 49–72 (2017). https://doi.org/10.2478/hjbp a-2022-0003

Nominet. One year on: CISO stress shows no signs of abating (2021). https://nominetyber.com/ one-year-on-ciso-stress-shows-no-signs-of-abating/

Ohue, T., Moriyama, M., Nakaya, T.: Examination of a cognitive model of stress, burnout, and intention to resign for Japanese nurses. Jpn. J. Nurs. Sci. 8(1), 76–86 (2011)

Panteli, N.: Women computer professionals: progress and resistance. J. Strat. Inf. Syst. 1(7), 71–73 (1998)

Petitta, L., Vecchione, M.: Job burnout, absenteeism, and extra role behaviors. J. Work. Behav. Health 26(2), 97–121 (2011)

Pham, H.C., Brennan, L., Furnell, S.: Information security burnout: identification of sources and mitigating factors from security demands and resources. J. Inf. Secur. Appl. 46, 96–107 (2019)
Prinsley, R., Beavis, A.S., Clifford-Hordacre, N. Women in STEM: A story of attrition
[Press release] (2016). http://www.chiefscientist.gov.au/wp-content/uploads/OCS_Women_in_STEM datasheet.pdf

Rao, J.V., Chandraiah, K.: Occupational stress, mental health and coping among information technology professionals. Indian J. Occup. Environ. Med. **16**(1), 22 (2012)

Reed, J., Zhong, Y., Terwoerds, L., Brocaglia, J.: 2017 Global Information Security Workforce Survey (2017). https://www.isc2.org/-/media/B7E003F79E1D4043A0E74A57D5B6F33E.ashx

Reeves, A., Coroneos, P.: Cybersecurity professionals may be burning out at a faster rate than frontline health care workers [Press release] (2022). https://caudit.edu.au/resources/cyberm indz-release-a-new-study-showing-early-evidence-of-burnout-in-cyber-professionals/

Roberts, R., et al.: Mental health and well-being impacts of COVID-19 on rural paramedics, police, community nurses and child protection workers. Aust. J. Rural Health **29**(5), 753–767 (2021). https://doi.org/10.1111/ajr.12804

Schaufeli, W., Bakker, A.B., Hoogduin, K., Schaap, C., Kladler, A.: On the clinical validity of the maslach burnout inventory and the burnout measure. Psychol. Health **16**(5), 565–582 (2001)

Schaufeli, W., Enzmann, D.: The Burnout Companion to Study and Practice: A Critical Analysis, CRC press. Boca Raton (1998)

Tims, M., Bakker, A.B., Derks, D.: The impact of job crafting on job demands, job resources, and well-being. J. Occup. Health Psychol. **18**(2), 230 (2013)

University of New South Wales. Cybercrime an estimated $42 billion cost to Australian economy
[Press release] (2021). https://www.unsw.adfa.edu.au/newsroom/news/cybercrime-estimated-
42-billion-cost-australian-economy