At the same time, a lot of experienced security professionals are reaching retirement age, while many of today\u2019s students find the potential rewards of building tomorrow\u2019s technology more appealing than the task of securing yesterday\u2019s.<\/p>\n
\u201cEvery year in the US there are 128,000 openings for Information Security Analysts, but only 88,000 workers currently employed in those positions.\u201d<\/span><\/p>\n This is another area where the federal government has been proactive. Just a few months into his first term, Obama launched the National Initiative for Cybersecurity Education (NICE) to address the need to expand the cybersecurity workforce.<\/p>\n A very visible example of these federal efforts is the website CyberSeek.org<\/a>, which provides \u201cdetailed, actionable data about supply and demand in the cybersecurity job market\u201d.<\/p>\n Unfortunately, the cybersecurity skills gap is proving to be a tough problem to solve. Consider these numbers from the CyberSeek site: \u201cEvery year in the US there are 128,000 openings for information security analysts, but only 88,000 workers currently employed in those positions \u2013 a talent shortfall of 40,000 workers for cybersecurity\u2019s largest job.\u201d<\/p>\n But wait, there\u2019s more (or less, depending on how you look at it): \u201cThere are 220,000 additional openings requesting cybersecurity-related skills, and employers are struggling to find workers who possess them. Jobs requesting skills, for example, remain open 96 days on average.\u201d<\/p>\n CyberSeek offers two interesting tools to help deal with this problem: the Career Pathway and the Cybersecurity Supply\/Demand Heat Map. The latter is regularly updated and presents some eye-opening numbers. Consider the number of online job listings for cybersecurity-related positions from July 2015 through June 2016: roughly 350,000.<\/p>\n To put that in context, consider the estimate for the total number of employed cybersecurity workers in 2016: about 780,000. You don\u2019t have to be an expert in labor economics to know that things are out of whack when one year\u2019s worth of job openings in an industry is 45% of the total workforce.<\/p>\n Another indicator of things being \u201cout of whack\u201d \u2013 which is not the technical term, but definitely seems to describe the situation \u2013 is the number of job openings in the US that request the Certified Information System Security Professional qualification, relative to the number of people in the US who are CISSPs: 93,000 to 70,000.<\/p>\n This particular gap, of 23,000 people, tells me two things. First, there are probably not enough CISSPs in America right now; and second, a significant number of those job openings could probably be filled by people who don\u2019t have their CISSP. Why would that be? Because too many companies don\u2019t understand what a CISSP means, and only ask for it because they see it listed in other security job ads. I wrote about this problem last year<\/a>, when I reached my 20-year anniversary as a CISSP, and clearly some of the issues that I identified persist.<\/p>\n \u201cToo many companies don\u2019t understand what a CISSP means, and only ask for it because they see it listed in other security job ads.\u201d<\/span><\/p>\n One of the most frustrating issues is the continuing lack of clarity about cybersecurity roles and KSAs: the knowledge, skills, and abilities required to perform the different roles that comprise the information systems security mission.<\/p>\n That\u2019s where the CyberSeek Career Pathway comes into play. This interactive tool embodies the National Cybersecurity Workforce Framework (the Workforce Framework), the initial goal of which was to establish a standard taxonomy for all cybersecurity work and the workers who perform it, regardless of employer or industry sector.<\/p>\n To accomplish this, NICE resolved cybersecurity work into 31 specialty areas organized into seven categories: Securely Provision; Operate and Maintain; Protect and Defend; Investigate; Collect and Operate; Analyze; Oversight and Development. NICE went on to identify the KSAs required for each role and then mapped possible career paths for cybersecurity workers, as seen here on the CyberSeek website:<\/p>\n The CyberSeek tool does more than you see there, allowing you to drill down to the education, skills, and qualifications requested for any given job description, with alternative titles used for that job, the number of openings, average salary, and pay range. If someone is interested in pursuing a job in cybersecurity then the National Initiative for Cybersecurity Careers and Studies<\/a> (NICCS) provides an online resource for locating cybersecurity training. The NICCS site lists over 3,000 cybersecurity-related training courses offered in the US and you can search them by keyword, specialty, and location:<\/p>\n These tools are free and I hope that they will help people to enter, and progress within, the cybersecurity field. Unfortunately, this field is in competition with many others. In other words, the cybersecurity skills gap is not the only gap the US has to worry about.<\/p>\n You may have seen this headline last month<\/a>: \u201cTrump\u2019s infrastructure splurge would collide with US skilled labor crunch\u201d. And earlier this year there was this warning in the Wall Street Journal<\/a>: \u201cThe US could run out of occupational therapists, railroad engineers and other workers, potentially leaving the economy in a long-term slump\u201d.<\/p>\n The US Federal Reserve Board considers 4.8% to be \u201cthe natural rate of unemployment\u201d; in other words, anything below that constitutes full employment. That means most job openings have to be filled by people leaving existing jobs. The US unemployment rate last month was 4.7%, so it\u2019s not like the country has a lot of \u201cspare\u201d people from whom to recruit the cybersecurity workforce. I fear the skills gap may well persist for some time, despite our best efforts to reduce it.<\/p>\n![\"Cloud](\"http:\/\/www.welivesecurity.com\/wp-content\/uploads\/2017\/01\/shutterstock_405360073-1.jpg\")
<\/p>\n![\"cyberseek-pathway-tool-qeu37\"](\"http:\/\/www.welivesecurity.com\/wp-content\/uploads\/2017\/01\/cyberseek-pathway-tool-qeu37.jpg\")
<\/p>\n![\"niccs-map-6f6ys\"](\"http:\/\/www.welivesecurity.com\/wp-content\/uploads\/2017\/01\/niccs-map-6f6ys.jpg\")
<\/p>\n