What It Takes To Train The Cybersecurity Workforce
By: Joanne Cheng
Tags: Cybersecurity, Future Of Work, Technology, Edtech, Venture Capital

What it takes to get hired in cyber: A Degree, Certifications & Work Experience.

Our portfolio company Burning Glass has compiled detailed data-based evidence on cyber hiring: right now, it takes the trifecta of a degree, certifications, and work experience to get a job in cybersecurity. This is a pretty high bar and clearly creates structural barriers to cyber job pathways. Meanwhile, employers are desperate to find great cyber talent, so it begs the question: why do employers look for all of these qualities in the first place?

The degree.

88% of cybersecurity job postings require at least a Bachelor’s degree. One CISO put it elegantly: cybersecurity is a “hybrid job”, requiring technical and domain knowledge but also importantly, an understanding of the human issues in business. It has significantly more soft/power skills requirements than IT: critical thinking and problem-solving, how to pre-empt threats, speaking across the business, and project management skills. CISOs prioritize hiring for these power skills over technical skills because they are harder to train for, and therefore tend to hire based on degrees as a signal of these “intangible” qualities.

Certifications.

Certifications are a key part of cybersecurity careers but many believe that some certifications such as CISSP are actually “far more useful in getting a job than doing a job”. Historically employers have overburdened job postings with certifications, creating labor market inefficiencies (there are more job postings requiring certifications than there are people certified). Because of the lack of a common lexicon for describing cyber skills and roles, technical team members (aka CISOs) end up having a hard time communicating with HR hiring managers exactly which skills they need to hire for. Thus, certifications have become a standard way to screen candidates based on keywords in the ATS (Applicant Tracking System), a short-term convenient but long-term burdensome filtering method. In reality, jobs may only need select skills not requiring the whole certification. While credential attainment is fantastic for the job seekers’ marketability and career advancement (in the U.S., a certification can increase salaries by 20%+), for CISOs, “the certification is hardly the lynchpin for getting hired; it will only get your foot in the door”. They will still want to test for competency.

Job experience.

This is the classic work experience chicken-and-egg problem. Cyber hiring managers greatly prioritize job experience, with 85% of cybersecurity job postings requiring 3+ years of cyber work experience. Currently, a good (but long) pathway is for candidates to begin building experience in IT/tech jobs in “cyber-adjacent” roles and then transition into a “cyber-core” role.

Where Edtech Can Help

Re-imagining the cyber bootcamp into “cyber apprenticeships”.

There are a number of cyber bootcamps today and what could be truly powerful for cyber is re-imagining that model into an apprenticeship or work-integrated learning model to tackle the “cyber trifecta” problem. In addition to the technical skills that more traditional bootcamps confer, we need to provide students with opportunities to work on real-world projects, develop their soft and power skills in the context of a team, and better understand what it means to be a cyber professional (day one on the job is not super-hacking!) This model can provide work experience, a certification, and help overcome the degree hurdle, by allowing employers to observe (and help train) a potential hire’s power skills while on-the-job. It also helps with career navigation: cyber careers are constantly evolving and tricky to navigate, which may be intimidating to new entrants. Ultimately, we need more solutions with great awareness of employer needs and a focus on actual job placement. There are already startups in edtech innovating around work-integrated learning models (not specific to cyber) that are focused on integration with employers and/or Higher Ed institutions, such as Forage, Paragon One, Parker Dewey, Student Opportunity Center, and WhiteHat.

Competency-based assessments.

A skills-based assessment tool could help employers better identify cyber talent without over-relying on certifications. While there are some performance-based tests out there (ie. virtual battlefield simulators), usually developed by the armed forces, there are few players in this space, especially ones with inexpensive offerings that enterprises could easily purchase and adopt in a widespread way.

I am reminded of an interesting model by one of our portfolio companies, Correlation One, which has developed a sophisticated competency-based data science assessment platform based on collecting a pool of performance indicator data from the many data science hackathons, or “datathons”, that they host. Employers have flocked to this solution because it is similarly hard to not only measure great data science talent but also find diverse candidates that don’t check the traditional boxes. It would be intriguing to apply the same model to cyber, where candidates could showcase their skills, critical thinking, teamwork, and creativity while battling in cyber range simulations, with data collection fueling a true, efficacious skills-based assessment that overcomes degree-filtering or perhaps even an expensive certification test. Also, gamers make great cyber candidates so a game-based simulation is an intriguing idea, especially for exposing young learners to cyber careers earlier on.

(It is important to note that there is regulation in the U.S. around hiring assessments. Assessments can be one aspect of the hiring process but cannot be the sole reason for hiring, and should be tested for validity to prove no “adverse impact” to any populations.)

Soft/power skill assessments.

A soft skills assessment and training solution can overcome the burdensome degree signal. However, there are a lack of inexpensive, effective solutions for soft skills broadly, not only in cyber.

One of our portfolio companies, Imbellus (recently acquired by Roblox), has done interesting work here. With a sophisticated game-based assessment adopted by McKinsey, Imbellus brings candidates into a virtual simulation in the natural world where they solve a problem such as protecting native plants against invader species. Imbellus can then measure qualities such as critical thinking, decision-making and meta-cognition by tracking every move of the mouse, actions and time spent on solving the challenge. Are there similarly effective solutions that can be developed for cyber for widespread distribution?

Structural workforce planning solution based on skills mapping.

Build, don’t buy, cyber talent. It is hard and expensive to hire a great candidate in a high demand market. For a large employer, the better solution may be to build cyber skills capacity internally. Burning Glass and EMSI have both written research advocating for this strategy and elevating which career fields transition well into cybersecurity roles.

What we need is a broad talent platform that can track skills, identify the right candidates that could transition into cyber based on known pathways, map with specificity which additional skills they need, and provide the targeted training to help them get there.

While it may take years to develop the educational apparatus you would need in-house to manage talent and skills for the whole organization, there are tech solutions tackling this problem. Our portfolio company Degreed (or others such as Faethm and SkyHive as part of an emerging category of skills-based workforce planning platforms) serve as platforms already managing and recommending learning across the organization with an internal mobility function to navigate role transitions. A data analytics company such as Burning Glass can further provide the underlying granular data around skills mapping and development.

Cyber career pathway navigation tools.

Career navigation seems to be trickier than usual in the cyber industry. Navigating entry into and progression in cyber careers is complex, especially given the large number of certifying bodies and certification options to choose from. Initiatives such as CyberSeek and My Cyber Path have begun elucidating the career pathway so it is less daunting for candidates to enter the cyber workforce.