This chapter sets out an analysis of cyber security job vacancies, based on our analysis of the secondary job data on the Burning Glass Technologies labour market database. It covers the number of job postings, the roles, skills, qualifications and experience levels in demand, where the demand is coming from (both in terms of economic sectors and geographically) and the salary levels being offered. As this is a relatively experimental methodology, there are no comparisons drawn here against the wider literature on cyber security skills.
7.1 Core versus cyber-enabled job roles The separately published technical report comprehensively lays out the methodology used for this analysis. An important aspect to bear in mind when reading this chapter is that we split cyber job roles into core and cyber-enabled job roles.  Core cyber roles are formally labelled or commonly recognised as cyber security jobs. They have a greater demand for skillsets and tools directly related to cyber security, such as information systems, cryptography, information assurance, network scanners, and security operations. In other words, these are job roles where some aspect of cyber security is the main job function. This would typically include job titles such as Cyber Security Architect, Cyber Security Engineer, Cyber Security Consultant, Security Operations Centre (SOC) Analyst and Penetration Tester  Cyber-enabled roles are not formally labelled or commonly recognised as cyber security jobs, but they still require cyber security skills. Alongside cyber security skills, they demand more general IT and business skills, such as project management, risk assessment, network engineering, SQL, system administration, and technical support. This might be because the job requires light touch knowledge and application of technical cyber security skills (e.g. for IT technicians or governance, regulation and compliance roles) or because the job role includes cyber security functions among other things (e.g. network engineers whose role is broader than just network security). Typical job titles include Computer Support, IT Support Analyst and Applications Analyst It is worth noting that both core and cyber-enabled job roles typically require a mix of technical and non-technical cyber security skills. Therefore, these cannot simply be differentiated as technical vs. non-technical jobs in cyber security. To be clear, this is a different distinction from the formal versus informal cyber roles discussed in Chapter 2, which addresses the fact that many organisations (typically micro ones) have people carrying out cyber functions on a largely ad hoc or informal basis. By contrast, all the job postings included in this secondary analysis have, by definition, technical aspects of cyber security within their job descriptions. They are all formal cyber roles.
###7.2 Number of job postings The broad search results yield a total of 393,257 cyber security-related job postings in the UK between the start of September 2016 and the end of August 2019 (a 3-year period). This includes:  105,194 core cyber job postings  288,063 cyber-enabled job postings These figures should not be considered as a definitive stance on the number of jobs in cyber security in the UK. Instead, they are our best estimate of the number of job postings that contain tasks, responsibilities or skillsets well aligned to the cyber security discipline. Changes over time Across the three-year period, on average there have typically been approximately 11,000 job postings each month, of which c.3,000 per month have been core cyber roles. The demand for people in these core cyber roles has been much more stable than the demand for the wider array of cyber-enabled jobs. The monthly breakdown of job postings in Figure 7.1 demonstrates that demand for cyber talent was particularly high in the 6-month period (November 2017 to May 2018) prior to the introduction of the General Data Protection Regulation (GDPR). It has subsequently reduced to a level that has been relatively sustained post-May 2018. There may be other factors linked to the volatility of monthly job postings, and the apparent decline in cyber-enabled job postings since late 2016. For example, some employers may have initially used external recruitment to build an internal cyber security team and then moved towards other closed forms of recruitment not captured in these statistics (e.g. headhunting or referrals) as their cyber security needs have become more sophisticated, or in response to growing skills gaps. Benchmarking against other cyber security employment estimates There have been existing attempts to understand the size and scale of the cyber security workforce in the UK, and to understand gaps in supply:  DCMS’s Cyber Sectoral Analysis 2020 estimates 42,855 full time employees working in cyber roles in the UK cyber sector, across the 1,221 cyber security companies that make up this sector. However, this excludes individuals working in cyber roles outside of these companies  Also, recently, the 2019 ISC2 Cybersecurity Workforce Study report has estimated that there are c.289,000 people in the UK cyber security workforce. By our analysis, this is an underestimate of the size of the workforce. Their report does not explain which roles are included or excluded, and this may in part be the source of the difference  In 2017, the Tech Partnership estimated that there were c.58,000 people working in cyber security in the UK. They also estimated that there were c.7,000 vacancies per month in 2017, and that this figure had increased by 18 per cent between 2016 and 2017 Within our analysis, we have identified 393,257 job postings over 3 years, of which 105,194 can be considered core cyber roles. This means that there are approximately 35,000 core and 95,000 cyber-enabled roles in scope each year, which is broadly consistent with the Tech Partnership’s estimate of 7,000 vacancies per month (and its respective increase of c.18% per year).
7.3 Geographic differences Figure 7.2 shows the proportion of job postings for core cyber roles from each UK region (where the region is known). Given the large amount of source data, these are shown to 1 decimal place to highlight the small differences between certain regions. The darker the colour on the heatmap, the higher the density of cyber jobs in that region. This shows, as expected, a clustering of job posts in London and the South East. The regional differences in Figure 7.2 are very broad. They mask the fact that there are strong clusters of cyber security activity within regions. This is evidenced in the DCMS Cyber Sectoral Analysis 2020, which showed particularly strong sector hotspots within London, in parts of the North West, parts of the West Midlands and along the M4 corridor. We have, therefore, carried out more granular geographic analysis using the Travel to Work Areas (TTWAs) in the UK[footnote 14]. Figure 7.3 shows the top 15 TTWAs for core cyber job postings in absolute terms and in terms of Location Quotients. The latter measure shows how concentrated labour market demand is within a geographic area. The average demand is set at 1.0. A Location Quotient of 1.2, for example, indicates that the demand for core cyber employees is 20 per cent higher than the UK average. Figure 7.3 again shows a heatmap, with darker blues indicating a higher Location Quotient. Greyed out TTWAs are places where there were a negligible number of job postings in our data (with a Location Quotient that rounds down to 0), or none at all. Looking across both these maps highlights specific areas, or hotspots, where there is both a high absolute number of core cyber job postings and where they make up a relatively high proportion of the local economy. These hotspots include London and also other cities like Edinburgh and Belfast. The analysis also highlights the strong demand for core cyber jobs across the West Midlands and the South West (in Bristol, Cheltenham and wider Gloucestershire). As a caveat to this geographic analysis, both Figures 7.2 and 7.3 may slightly underestimate the extent of cyber security labour market activity in certain regions. For example, DCMS’s Cyber Sectoral Analysis 2020 found that 4 per cent of office locations in the cyber sector are in the East Midlands and a further 4 per cent are in Wales – neither of which register a high number of cyber security job postings in our analysis.61 In locations like Wales, there are a small number of very large firms that dominate the local cyber security labour market. As we discuss in Chapter 6, the largest employers often have a wider range of recruitment approaches and may not always post job adverts online. The Burning Glass Technologies dataset only accounts for online job postings.
7.4 The job roles being advertised Figure 7.4 lists the identified core cyber roles by job title. Many of these are minor variants of each other (e.g. Security Engineer and Network Engineer). It is possible to combine these categories to give a broader insight into the kinds of roles being recruited. We find that the most common roles requested are as follows (i.e. where the job title contains these specific terms):  Security engineers (18%)  Security analysts (13%)  Security architects (10%)  Security managers (9%)  Security consultants (8%) Expanding this analysis out to cover all 393,257 identified job postings (covering the cyber-enabled job roles as well as the core roles), we can highlight some of the important enabling and complementary jobs that are well aligned to cyber security (Figure 7.5). These are often roles where the job descriptions state that knowledge of cyber or network security is desirable but not necessarily essential. This highlights that employers are looking to build teams with not only dedicated cyber professionals, but also people working in complementary roles, such as support engineers and application analysts – people who will also require cyber security skills.
7.5 The sectors demanding cyber security staff Job postings within the Burning Glass Technologies dataset are typically advertised through a recruitment agency. This means that the employer name – the end client of the recruitment agency – may not be contained within the job posting. However, for the core cyber roles, a total of 11,527 job postings (11% of all the core cyber job posts identified) have a known employer name[footnote 15] and have categorised these by their sector (Figure 7.6)[footnote 16]. As the smallest sectors that still enter the top 20 threshold account for under 1 per cent each, we show percentages to 1 decimal place for this chart. This is not necessarily a comprehensive breakdown. As noted earlier in this chapter, the Burning Glass Technologies dataset is liable to omit some key large employers that do not post job adverts directly, Nevertheless, taken at face value, the analysis lines up with other subgroup analysis in this survey and other DCMS surveys on cyber security. It suggests that the sectors most in demand of cyber talent are the finance and insurance, information and communications, and professional services sectors. The retail sector appears relatively high on this list, which contrasts with the wider sector’s low rankings in various questions in the survey. For example, cyber leads in this sector are less confident than average at carrying out various basic cyber security tasks in-house (see Chapter 4). However, our analysis shows that this recruitment is largely concentrated among 3 household name UK retailers. Finally, matching the employers against the DCMS list of UK providers of cyber security products and services shows that 4.9 per cent of these 11,527 job postings are from cyber security firms. However, looking at the specific company names suggests that some of the UK’s leading cyber security firms have a relatively low volume of job postings within the dataset. This suggests that many top cyber firms are, in fact, recruiting through agencies, headhunters or other platforms – strongly matching the narrative from the survey data in Chapter 6.
7.6 The skills, qualifications and experience being demanded This analysis is based on text analytics of the descriptions given for each job posting. Skills in demand Looking at the core cyber roles, it is unsurprising that the key skill demanded from employers is knowledge of “information security” (61%) and “network security” (22%). This is very broad, possibly reflecting there is not yet a single, widely adopted cyber security skills framework to better break down the various skills areas. The full list is in Table 6.1. Several of the skills requested are soft in nature, such as teamwork and collaboration (12%). The most commonly demanded technical skills areas include:  Network engineering (e.g. Cisco and Juniper)  Risk management and technical controls (e.g. ISO27001 and ITIL)  Operating systems and virtualisation (e.g. Linux and VMWare)  Cryptography  Programming (e.g. Python, Java and SQL) Table 7.1: Top skills requested for core cyber job roles
﻿Skills%Skills%Skills% Information security61%IT industry knowledge7%VMware5% Network security22%UNIX6%Splunk4% ISO 2700120%Telecommunications6%Information assurance4% Cisco17%Microsoft Active Directory6%Network infrastructure (edge devices)4% LINUX13%Risk management6%Cisco switching4% Teamwork / collaboration12%Java6%Threat intelligence and analysis4% Security operations11%ISO standards5%Open web application security project4% ITIL10%Juniper networks5%DevOps4% Network engineering10%Software development5%The Open Group Architecture Framework (TOGAF)4% Project management10%Payment Card Industry (PCI)5%System or network configuration4% Customer service10%Budgeting5%Data security4% Stakeholder management9%Virtual Private Networking (VPN)5%Change management3% Cryptography8%Risk assessment5%Windows server3% Wide Area Network (WAN)8%Routers5%Cyber security knowledge3% Python8%Technical support5%Virtualisation3% Transmission Control Protocol (TCP) or Internet Protocol (IP)7%SQL5%Disaster recovery planning3% Information systems7%Domain Name System (DNS)5%Data privacy3% Source: Burning Glass Technologies Base: 79,750 core cyber job postings from September 2016 to August 2019 that request specific skills Experience requirements Figure 7.7 demonstrates that, over the last 3 years, the most common request from employers looking to fill core cyber security roles has been for applicants with 3 to 5 years of experience (52%), followed by entry level applicants (30%). The greatest demand being for 3 to 5 years again strongly reflects the current snapshot of the cyber sector covered in Chapter 6. In cyber-enabled roles, there is greater demand for those in entry level positions (41%, vs. 30% of core cyber job postings). This highlights the reluctance of employers to take on dedicated cyber staff at the entry level. At the same time, it also highlights an opportunity – there may be further scope to explore how those entering cyber-enabled roles, like network technician or IT support roles, might be upskilled. For example, there could be a mapping of career pathways for those who join as a support technician after completing an IT degree or HND, build up industry experience, and learn the cyber security skills needed for a core cyber role via accredited training (e.g. CompTIA Network+ followed by CompTIA Security+). Education requirements As Figure 7.8 shows, employers place a strong emphasis on applicants having bachelor’s degrees or higher qualifications. There is much less demand for foundation degrees and Higher National Certificates (HNCs) or other Level 4 certificates. The job postings that mention these are likely to be entry level roles that reflect where the employer is actually aware of these wider higher level qualifications. There are differences between core and cyber-enabled job roles here as well. Employers looking to fill cyber-enabled job roles are twice as likely to accept A Levels or GCSEs as a minimum (24% vs. 11%). This reflects the fact that cyber-enabled roles are more likely to include support positions and entry level positions. They therefore may not be as dependent on technical or educational backgrounds. For core cyber roles, the 11 per cent of postings allowing applications from those with A Levels or GCSEs possibly reflects work and training schemes where applicants can earn and learn, such as the GCHQ and CNI degree apprenticeships. The proportion of core cyber job postings allowing for these as minimum qualifications rose from 9 per cent in 2017/18 to 12 per cent in 2018/19. Encouraging a wider range of employers to engage with these schemes could help to meet some of the labour demand. Demand for certifications The most commonly requested certification is Certified Information Systems Security Professional (CISSP), which is included within 37 per cent of the job postings that ask for a specific certification. This reflects our qualitative findings in Chapter 2, which highlight that:  CISSP is a cyber security accreditation of which there is relatively wide awareness, making it more likely that employers will add this to job adverts  It was viewed as one of the broader accreditations in cyber security, covering both the technical and governance aspects, making it popular for those looking to fill generalist roles Cisco Certified Network certifications are also in high demand, with 27 per cent requesting Cisco Certified Network Professionals (CCNP), 22 per cent requesting Cisco Certified Network Associates (CCNA), and 9 per cent requesting Cisco Certified Internetwork Experts (CCIE). The top ranking certifications are shown in Figure 6.9. The following certifications are not shown on the chart and were each mentioned in 1 per cent of job postings: GIAC Security Essentials (GSEC), PRINCE2, GIAC Certified Forensic Analyst (GCFA), Advanced Certificate in Programme and Project Support (ISEB), GIAC Reverse Engineering Malware (GREM), CompTIA A+ Certification, Cisco Certified Design Associate (CCDA), GIAC Penetration Tester (GPEN) and Microsoft Certified IT Professional (MCITP). This analysis does not specify whether employers are requesting specific versions of the certifications shown in Figure 6.9. The version was often not specified in the job description – a further challenge for individuals navigating the training market. All this demonstrates that the certifications requested can become rather specific and niche within cyber security job postings. Whilst job postings may include broad minimum educational requirements, the landscape can still be challenging for both employers and potential employees, needing to request and supply specific certifications to meet role expectations.
7.7 Salaries Over the last 3 years, our analysis shows that the mean advertised salary for a core cyber job role was £59,600 (with a median value of £55,000). The mean advertised salary for all cyber jobs within the dataset (i.e. including cyber-enabled jobs) was £46,900 (with a median of £40,000). As a comparison, for all employee jobs within SIC code 62, which is the computer programming, consultancy and related activities industry code, the mean annual pay in 2019 was £47,934 (with a median of £40,063)[footnote 17]. Using this value as a proxy for IT jobs in the UK suggests there is a wage premium of approximately 25-30 per cent for core cyber security jobs compared both to IT jobs as a whole, and jobs with a partial cyber security requirement. Analysis of job postings with known salary data (Figure 7.10) demonstrates that the cyber-enabled jobs are typically lower paying, with almost 3 in 10 job posts advertised at less than £30,000 annually. By comparison, 9 in 10 core cyber jobs are advertised at over £30,000 annually. Geographic variation in salaries London has the highest mean advertised salary for core cyber roles. This is expected, given the prevalence of the finance sector as well as higher typical costs of living in the capital. At the other end of the market, Northern Ireland has considerably lower average advertised salaries for core cyber security roles (a mean of £43,300). Overall, typically core cyber job salaries are almost twice the level of average regional salaries67, indicating that cyber security is a well paid career option within each region.