8 ms·

IT has a shortage of metasploit/burpscanner/nexpose/nessus jockeys and XYZ security appliance administrators at low salaries. The positions you're talking about

by rhexs 9y ago

IT has a shortage of metasploit/burpscanner/nexpose/nessus jockeys and XYZ security appliance administrators at low salaries. The positions you're talking about are an incredibly difficult sell to companies. Top 10 companies have a few positions on hire at decent wages doing unique work but that's it. Some companies cyber defense strategy just involves buying a bunch of insurance. Plenty of pen testing mega-mart consultancy jobs making 60-90K a year working 70 hours a week in Boston and other ungodly expensive cities though. Guessing all this news about the "shortage" in cyber is just more propaganda to further open up the H1B floodgates and drive salaries down.

greatamerican 9y ago
This is the correct answer. An "unfilled" job is a misnomer. There is a market-clearing price for everything.
- aianus 9y ago
  If refineries shut down and the price of gas goes to $10/gallon is that not a "real shortage" because there is still a market clearing price and I can still buy gas? I disagree. I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally.
  - user5994461 9y ago
    >>> I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally. Software engineers from a top school, who passed the most hardcore interviews in the most selective firms in the world, to live in the most expensive city on the planet where a single bedroom flat is $4k a month.
- user5994461 9y ago
  I don't think so. There really are not 3 million jobs in cybersecurity. There is not much demand for people who can run a scanner or set up a firewall. Not to mention that a setup is a single day of work, it's not even close to a full time job. Maybe they are counting every guy who ever plugged a broadband modem as a security specialist.
mc32 9y ago
Buying insurance might be the most cost effective strategy. If insurance of $2MM would cover your liability, why incur 3MM expenditures and still only be reasonably secure?
- yourapostasy 9y ago
  Cyber security insurance has liability caps, relatively low for the premiums. Standard boilerplate demands to hold such insurance in the US is around $1M liability coverage for small shops, usually gets quoted around $50K annual premiums. If you can even get underwritten at all. I have been able to negotiate those clauses away so far. Everyone is already trying to pass the buck (quite literally) on information security risk via insurance, and the insurance industry is pushing back. One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern. What no one outside of information security wants to admit much less promulgate is development and IT teams must grow larger, or security continues as an expensive as hell fat tail risk. The cheap hedge is hiring additional staff; businesses have grown so accustomed to living outside the fat tail that the accumulated technical debt presents the illusion that status quo is normal. The new normal is ever-more expensive attacks. I wish POSIX would offer a standard way to elide certain parts of a the command string that shows up in a process list. There are piles of legacy programs that won’t get retrofitted to use a file to read a password anytime soon. There are sins aplenty in our fields when it comes to security.
  - user5994461 9y ago
    >>> One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern. That would be good, the cloud is a lot more secure than everything self hosted or self developed.
    - mc32 9y ago
      Is that always true? If you're doing heavy R&D and you keep things on isolated networks, might not your R&D be at least similarly secure on-premises, if you follow secure practices? How much visibility do you have into your cloud provider's security? For email, sure go with a known cloud provider. Some SaaS services on the back-end can be less than ideally secure.

by rhexs 9y ago

greatamerican 9y ago

This is the correct answer. An "unfilled" job is a misnomer. There is a market-clearing price for everything.

aianus 9y ago
If refineries shut down and the price of gas goes to $10/gallon is that not a "real shortage" because there is still a market clearing price and I can still buy gas? I disagree. I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally.
- user5994461 9y ago
  >>> I think the fact that software engineers get offered $120k+ out of school to fiddle with js frameworks indicates a real shortage personally. Software engineers from a top school, who passed the most hardcore interviews in the most selective firms in the world, to live in the most expensive city on the planet where a single bedroom flat is $4k a month.
user5994461 9y ago
I don't think so. There really are not 3 million jobs in cybersecurity. There is not much demand for people who can run a scanner or set up a firewall. Not to mention that a setup is a single day of work, it's not even close to a full time job. Maybe they are counting every guy who ever plugged a broadband modem as a security specialist.

mc32 9y ago

Buying insurance might be the most cost effective strategy. If insurance of $2MM would cover your liability, why incur 3MM expenditures and still only be reasonably secure?

yourapostasy 9y ago
Cyber security insurance has liability caps, relatively low for the premiums. Standard boilerplate demands to hold such insurance in the US is around $1M liability coverage for small shops, usually gets quoted around $50K annual premiums. If you can even get underwritten at all. I have been able to negotiate those clauses away so far. Everyone is already trying to pass the buck (quite literally) on information security risk via insurance, and the insurance industry is pushing back. One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern. What no one outside of information security wants to admit much less promulgate is development and IT teams must grow larger, or security continues as an expensive as hell fat tail risk. The cheap hedge is hiring additional staff; businesses have grown so accustomed to living outside the fat tail that the accumulated technical debt presents the illusion that status quo is normal. The new normal is ever-more expensive attacks. I wish POSIX would offer a standard way to elide certain parts of a the command string that shows up in a process list. There are piles of legacy programs that won’t get retrofitted to use a file to read a password anytime soon. There are sins aplenty in our fields when it comes to security.
- user5994461 9y ago
  >>> One possibility that might develop out of the standoff is customers pushing the liability onto Cloud vendors and washing their hands of the concern. That would be good, the cloud is a lot more secure than everything self hosted or self developed.
  - mc32 9y ago
    Is that always true? If you're doing heavy R&D and you keep things on isolated networks, might not your R&D be at least similarly secure on-premises, if you follow secure practices? How much visibility do you have into your cloud provider's security? For email, sure go with a known cloud provider. Some SaaS services on the back-end can be less than ideally secure.