8 ms·
U.S. has almost 500k job openings in cybersecurity
- BiteCode_dev 5y agoThat sounds huge. 0.15 % of the entire us population just for cyber security? I hope you don't need garbage men and bakers.
- Tade0 5y agoIt is huge. Software engineers in general make up around 0.3% of the world population.
- croon 5y ago> 0.15 % of the entire us population just for cyber security? Even better: 0.15% of the entire US population for unfilled jobs. I'm going to assume most of these aren't permanent positions but gigs.
- koheripbal 5y agoI'm going to assume the number is for any tech job that has even the slightest but of security function, including any sysadmin, dbeng, webapp dev, etc It's just too big to be correct.
- croon 5y agoYou're probably right, any tech ad featuring the tag "security".
- gher-shyu3i 5y agoProbably non-dev jobs too, managers, tech writers, HR, office assistants, etc.
- ac29 5y agoAccording to the primary source there are "319,720 additional openings requesting cybersecurity-related skills" included in that number. https://www.cyberseek.org/index.html#aboutit https://www.cyberseek.org/index.html#aboutit
- deleted 5y ago[deleted]
- estaseuropano 5y agoYou can make a study show anything you want, just choose the right assumptions.
- nine_zeros 5y agoUS tech industry bis larger than people imagine. With the ongoing cyber attacks, every company > 10 employees who have a lot at stake needs to hire cyber security specialists. If we can have 500k police and private guards, we should have 500k cyber security specialists
- pessimizer 5y agoDoes every company > 10 employees have a security guard?
- Kye 5y agoThere's probably a point where insurance requires it.
- dsr_ 5y agoLots of companies get physical security from: - the building that rents them an office including a guard in the lobby - the datacenter that rents them space including guards - the cloud service taking care of their own datacenters On the other hand, if you have your own building or rent in an unguarded building, deal with cash, have an actual storefront -- you'll probably be hiring security yourself.
- ChrisRR 5y agoHow many boot camp web devs are currently being churned out who don't know the first thing about the 1000 ways their service could be attacked?
- jmknoll 5y agoSeems like the solution being offered up in the article is more bootcamp. > An eight-week online course could help someone land an entry-level job as a "pen tester," a network security engineer or an incident response analyst, Moore said. Those jobs pay between $60,000 to $90,000 a year, she added
- dna_polymerase 5y agoWhile this is probably true for boot camp web devs, it is also a very real problem for recent college grads who learn about fancy algorithms in their CS degrees, but have no idea what angles of attack exist.
- MattGaiser 5y agoThe closest thing to security I learned in university was RSA and why we didn't need to worry unless quantum computing succeeded.
- jiscariot 5y agoLuckily there are now cyber security professional boot camps to fix this. Not kidding: https://bootcamp.umn.edu/cybersecurity/ https://bootcamp.umn.edu/cybersecurity/
- bunfunton 5y agoMany. Worked with a boot camp grad. She asked for help. Open the file and SQL injection literally dead center of the first page. Not a clue or sense of urgency to fix.
- david-cako 5y agoSometimes I wonder what percentage of the American population is required to surveil the American population.
- wheaties 5y agoI believe this. Most of the "security" people i run into don't know jack. Incompetence is ripe and this sector will only grow. Last external IT audit I had to explain to the auditors what a password manager was. They'd never heard of it.
- a2tech 5y agoExactly. Its shocking how bad most audits are. The standards they're trying to enforce were obviously put in with the best intentions but instead of the spirit of the rules, the letter is being followed. When the letter of the law is being enforced by people that don't know anything about the industry or how the technology works, you get truly asinine decisions.
- raesene9 5y agoIt's an inevitable part of the way IT Audit is structured. Standards are necessarily abstract from specific systems (so don't always apply well) and updating standards is a slow process. The auditors themselves are often tasked with reviewing a massively disparate group of systems, so there's no way they could be come subject matter experts in each one. So the result is a checklist approach, especially as most compliance tasks are pass/fail.
- austincheney 5y agoAs a developer who used to work in cyber security that feeling is mutual on both sides. Unfortunately they are typically both right.
- Hujiuu 5y agoI prepared so much for our audit and the only thing this guy cared for in a 5 developer company was the fact that I had root access on all environments. He didn't care about Aws having 2fa configured about our vlan ipsec Tunnel, etc I even took the liberty to fix the md5 Passwort shit with bcrypt just before the audit...
- austincheney 5y ago
- DoomHotel 5y agoThe US government's official numbers for 2019 [1] only show 131k jobs for "information security analysts" and they project 171k by 2029. The total for computer, network and database administrators is only around 500k. [1] https://www.bls.gov/emp/tables/emp-by-detailed-occupation.htm https://www.bls.gov/emp/tables/emp-by-detailed-occupation.ht...
- indigochill 5y agoFrom my perspective, they've got a perception problem to fix. I was keenly interested in cybersecurity for a while (enjoy playing wargames and CTFs, still considering going for my OSCP just for fun), but following people in the industry for a while, I got the impression you have (at least) three pitfalls to look out for: 1. Working in a corporation, where the job is just compliance checklist whack-a-mole. 2. Working in government, which can be good (Mudge has done good work there) but the common policy I've seen elsewhere seems to be to maintain an arsenal of open exploits, thus making everyone in the world _less_ safe in the name of... security...? 3. Working in contract pentesting... for clients who really only care about compliance checklist whack-a-mole. There is a fourth option, which is research, like what Christopher Domas does, but opportunities for that which don't end up falling into the government trap seem few and far between (and even fewer if you've developed your skills outside an MS/PhD program). That said, I am not an industry insider. This is only my impression as someone who was once interested in the field and decided to stick with software engineering after getting a bad taste from what I saw from the industry.
- fdroidmstrrce 5y agoThis is me. There's nothing more boring than those positions. (Or to me, unethical than working for the US government) I'd much rather create something that benefits the world. Maybe the partial solution is bug bounties? As much as I'd hate those positions, I actively poke around for holes in websites for fun. I love when I have to do business with a small poorly run website, seems you can always find something they don't want you to have access too. Most recently, no right click to save images, but chrome developer tools got me the high res version anyway!
- goalieca 5y ago> (Or to me, unethical than working for the US government) I'd much rather create something that benefits the world. I’ll be a little more nuanced. I’m very appreciate of the hard work nist does posting best practices and guidelines on privacy, zero-trust, crypto, and other things. The SP series of publications are well respected and do lift the entire industry up to some minimum standard. In some cases they actually move things forward by a lot (like the AES competition)
- 1vuio0pswjnm7 5y agoWhat is the minimum certification(s) to have.
- deleted 5y ago[deleted]
- syntaxstic 5y agoThe article says network+ or security+
- gaws 5y agoIf you have to ask, then you're ngmi.
- mindwok 5y agoI feel like cybersecurity is undergoing an AI/ML like buzz at the moment, where basically every company is going all in on it, but the value is really being provided by a small concentration of talented people who really know their stuff. I've found it frustrating being in the DevOps space, because the hype bleeds into other decisions and sometimes I swear people forget we're actually running a business and believe everyone should really be focused on security over everything else.
- goodpoint 5y agoBy now I know more people who stopped working in security rather than people who kept working in the field.
- opheliate 5y agoThere’s been a massive push for people to enter jobs in cyber sec in the UK too. Our intelligence services offer pretty huge bursaries for university students on the condition they’ll go into security on graduation. Really seems like there’s an imbalance wrt supply and demand currently.
- Tycho 5y agoI remember thinking circa 2009 that every company was going to eventually need a dedicated cyber security department or pay for equivalent services, and that investing in a portfolio of stocks that can provide software and services would be a windfall. I made a paper portfolio on Yahoo! Finance. Unfortunately it doesn't really track performance properly, but seems like I made a good call. I selected dedicated security vendors like Fortinet (+800%) as well as enterprise software vendors (MSFT +800%) and IT consultancy firms (Accenture +400%). I don't really have any convictions as strong in today's environment, although cyber security probably has a lot further to go.
- 6510 5y agoOffering 60 k vs 100+ k job openings should not be taken serious.
- iJohnDoe 5y agoSerious question. 500k job openings is a lot. Where do go to find these job listings? Are they still spread out across lots of job listings sites like Monster, etc.? Are they doing a total of all listings across those sites? Is there a defacto site that everyone uses now? Just wondering if I’m doing something wrong.
- readonthegoapp 5y agoI get that the US government funded part of the research this article is based on, but I think substantial skepticism is warranted -- as with all 'IT shortage' articles. Many US agencies are mis/guided/influenced/funded/run directly and/or indirectly by industry professionals, lobbyists, etc. If there was any actual shortage of IT personnel in the US, it would not take experienced US-based IT professionals months or years of job searching to find work -- if at all. There is no conspiracy theory necessary -- in this case, it's pretty clear-cut -- a training company needed some PR to drum up business, so they got their lobbyist to work with a group inside an agency in the government, got a report, pinged their contact at CBS, done. But outside of that, it'd be nice to know how 500,000 alleged openings compares historically. It's obviously a number that is supposed to impress. But how impressed should we be? How fast is the number growing? If the number is going up, why aren't all these unemployed IT professionals getting hired? Companies are willing to sustain IT attacks instead of hire and train an experienced IT professional? Hiring remotely is easier than ever, but does that apply to security jobs? Are clearances necessary? Physical presence? What is the appropriate number of job openings, per IT vertical (e.g. cybersecurity, networking, cloud, big data, SCADA, etc.), at any point in time, to provide proper 'slack'/fluidity of the labor force? Presumably this would be some number that the IT industry was roughly comfortable with, that industry analysts/economists thought was 'healthy', etc. Is that 10,000 job openings? 100,000? 1,000,000?
- vanusa 5y agoSomething tells me there's a lot of duplication behind that tally (for example, a single opening spammed out to 50 different recruiters, etc).