MassTLC Security Community Advisory Board Meeting JANUARY 15, 2016

Transcription

1 MassTLC Security Community Advisory Board Meeting JANUARY 15, 2016

2 Guest Speakers: Will Markow Senior Analyst, Burning Glass Lou Piazza Director, BATEC

3 Bridging the Cybersecurity Talent Gap 2015 Burning Glass Technologies

4 Cybersecurity has a Big Problem Attacks are rising Cyber incidents jumped 38% year-over-year Demand for cybersecurity talent is soaring Cyber openings increased 91% from 2010 to 2014 But the supply of cybersecurity talent is lagging According to Cisco, there are 1 million unfilled cyber jobs worldwide 3

5 The Cybersecurity Skills Gap Persists As the economy moves faster, the skills gap is in danger of widening 4

6 Behind the Cybersecurity Skills Gap: An Information Gap Traditional data sources do not align well with the current realities of the cybersecurity labor market. Data are not packaged for employers or job seekers: They re designed for macro-economists Data are in broad categories Lots of cybersecurity jobs that matter are not tracked Skills and certifications are hardly tracked at all 5

7 Closing the Cybersecurity Information Gap with Real- Time Labor Market Data Real-time job market data offer up-to-date insights not possible through traditional sources Visit Online Job Sites Collect & Deduplicate Job Postings Read Postings to Generate Detailed Data Job Title & Occupation Employer & Industry Technical Skills Foundational Skills Certifications Educational Requirements Experience Levels 2015 Burning Glass Technologies - Proprietary and Confidential 6

8 It s Hard to Train People for a Job That s Not Defined To quantify and analyze the market for cybersecurity specific roles, Burning Glass developed a set of filters to identify those jobs that are directly related to network and information security. Jobs are flagged as a cybersecurity role if they meet one of the following criteria or job requirements: Cybersecurity-related title such as network security engineer, information security analyst or penetration tester Cybersecurity certification such as CISSP, CISA, or Security+ Cybersecurity skills such as information assurance, cryptography, computer forensics, malware analysis, , and 2015 Burning Glass Technologies - Proprietary and Confidential 7

9 Pulling Back the Curtain: What Trends Are Shaping the Cybersecurity Job Market? 8

10 What Trends are Shaping the Cybersecurity Job Market? Cybersecurity workers are in high demand The cybersecurity job market is growing in non-obvious places Certifications are in high demand, but certified workers are in short supply Cybersecurity jobs require a diverse and hard-to-find mix of skills and qualifications 9

11 Cybersecurity Demand is Large and Growing, But Supply is Struggling to Keep Pace In 2014, there were 238,158 postings for cybersecurity-related jobs nationally. Cybersecurity jobs account for 11% of all IT jobs. Cybersecurity postings have grown 91% from This growth rate is more than faster than IT jobs generally. Cybersecurity posting advertise a 9% salary premium over IT jobs overall. Cybersecurity job postings took 21% longer to fill than the average for all jobs, and 8% longer to fill than the average for IT jobs. The demand for certificated cybersecurity talent is outstripping supply. In the U.S., employers posted 49,493 jobs requesting a CISSP, recruiting from a pool of only 65,362 CISSP holders nationwide.* $6,459 *According to the International Information System Security Certification Consortium, Inc., (ISC)² membership counts as of July 14, Burning Glass Technologies 10

12 Employers Are Hiring a Diverse Set of Cybersecurity Roles The cybersecurity workforce covers a range of job types and skills. This includes advanced Engineer and Architect roles, Auditors (which are concentrated in Finance), and Specialists, which typically have lower entry-level requirements Burning Glass Technologies 11

13 What Trends are Shaping the Cybersecurity Job Market? Cybersecurity workers are in high demand The cybersecurity job market is growing in non-obvious places Certifications are in high demand, but certified workers are in short supply Cybersecurity jobs require a diverse and hard-to-find mix of skills and qualifications 12

14 Cybersecurity Demand is Spreading to New Industries That May Lack an Experienced Cyber Workforce Professional Services, Finance, and Manufacturing & Defense are the leading sectors for cybersecurity professionals. Sectors managing increasing volumes of consumer data such as Finance, Health Care, and Retail Trade have seen the fastest increases in demand for cybersecurity workers. Within these sectors, demand for cybersecurity professionals is growing rapidly in more specific industry subsectors not typically associated with cybersecurity, including Air Transportation (+221%) and Accommodation (+157%). *The Manufacturing Sector includes services divisions of a number of defense contractors (e.g. Raytheon) and computer manufacturers (e.g. Hewlett Packard). ** Industry growth rates are suppressed for the Public Administration and Other industry sectors because a significant portion of labor market demand in these industries exists offline Burning Glass Technologies 13

15 Cybersecurity Jobs Aren t Just in Tech Hubs Any More Top States by Total Postings* State Total Postings Location % Growth Quotient** ( ) 1 California 28, % 2 Virginia 20, % 3 Texas 18, % 4 New York 14, % 5 Illinois 11, % 6 Maryland 11, % Cybersecurity Job Postings in 2014 By State 7 Florida 9, % 8 Georgia 8, % 9 New Jersey 8, % Cybersecurity Location Quotient in 2014 By State 10 Massachusetts 7, % 11 Colorado 7, % 12 North Carolina 7, % 13 Ohio 6, % 14 Pennsylvania 5, % 15 Arizona 5, % *See Appendix 1 for state-level data tables on total postings and postings growth. **Location quotients show how concentrated demand is in a particular geography relative to employment in that area. National location quotient equals 1.0; an LQ of 1.2 indicates that demand is 20% more concentrated than nationally Burning Glass Technologies 14

16 What Trends are Shaping the Cybersecurity Job Market? Cybersecurity workers are in high demand The cybersecurity job market is growing in non-obvious places Certifications are in high demand, but certified workers are in short supply Cybersecurity jobs require a diverse and hard-to-find mix of skills and qualifications 15

17 Employers Look for Certified Cybersecurity Workers Cybersecurity jobs are highly certificated: More than one in three (35%) of all cybersecurity positions request at least one of the certifications listed below. Only 23% of overall advertised IT jobs request an industry certification. Certification increases salary: Security+ represents the entry-level certification for cybersecurity roles, and postings requesting it advertise an average salary of $75,484. This serves as a baseline salary for certified cybersecurity workers, and as workers obtain additional certification they can qualify for ever greater salaries. Postings requesting CISSP, for example, advertised an average salary of $93,010 a premium of $17,526 over the average salary for Security Burning Glass Technologies 16

18 Certifications: Too Many Openings Chasing Too Few Workers Employers prefer workers with cybersecurity certifications, but there can be two or more postings for every certificate holder. Considering that most of these certificate holders are already employed, the situation looks even better for workers possessing these certifications. Note: Different certifying organizations report slightly different counts of holders. For example, some may report total certifications awarded, while others may report only active certification holders Burning Glass Technologies 17

19 What Trends are Shaping the Cybersecurity Job Market? Cybersecurity workers are in high demand The cybersecurity job market is growing in non-obvious places Certifications are in high demand, but certified workers are in short supply Cybersecurity jobs require a diverse and hard-to-find mix of skills and qualifications 18

20 Cybersecurity Roles Require Significant Education and Experience That May Not Exist in the Market Some 84% of cybersecurity postings specify at least a bachelor s degree, and just as many (83%) require at least 3 years of experience, with an average of 5.4 years. High education and experience requirements make skills gaps hard to close. Because cybersecurity jobs require years of training and relevant experience, skills gaps cannot easily be resolved though short-term solutions. Employers and training providers must work together to cultivate a talent pipeline for these critical roles. Requested Education Level* Minimum Experience 2015 Burning Glass Technologies 19

21 Hybrid Jobs Combining Disparate Skills are Hardest to Fill The fastest-growing skills in cybersecurity postings include industry knowledge areas, such as HIPAA requirements in Health Care and Risk Management, and Accounting in Finance. The hardest-to-fill skills are typically related to finance, such as Information Assurance, Sarbanes-Oxley, and Accounting. Finding candidates with these unique skill sets can take roughly 17% longer to fill on average than other cybersecurity job openings. The difficulties in filling jobs that require a combination of IT security and financial skills reflects a broader trend in the market: hybrid jobs which combine skill sets that are not traditionally trained for together often suffer from the most severe skill gaps. Fastest-Growing Skills in Cybersecurity Job Postings Five-Year Growth Hardest to Fill Skills in Cybersecurity Job Postings Posting Duration Time to Fill Above Average Python 309% HIPAA 248% Risk Management 209% Internal Auditing 200% Audit Planning 170% Risk Assessment 169% ITIL 153% Management Information Systems 132% Accounting 121% Configuration Management 106% Management Information Systems 50 days +10 days Information Assurance 47 days +7 days Sarbanes-Oxley 47 days +7 days Accounting 45 days +5 days Python 45 days +5 days Dynamic Host Configuration Protocol (DHCP) 45 days +5 days Configuration Management 44 days +4 days C++ 44 days +4 days Public Accounting 43 days +3 days Internal Auditing 43 days +3 days 2015 Burning Glass Technologies 20

22 Roles Requiring Security Clearance Take Longer to Fill In 2014, 25,654 cybersecurity postings called for government Security Clearance, representing 11% of all cybersecurity postings. On average, cybersecurity postings requesting Security Clearance remained open 10% longer than cybersecurity postings overall. Posting Duration (2014) Average # of Days to Fill Online Job Postings in Burning Glass Technologies 21

23 The Road Ahead: What Are the Implications for Educators and Employers? 22

24 What Are the Implications for Educators and Employers? Communicate the Value of Careers in Cybersecurity Focus on the Credentials that Matter Looking Outside of Cyber: Understand Cybersecurity Career Pathways 23

25 Sell It! Communicating the Monetary and Non-Monetary Value of Careers in Cybersecurity Students and job seekers have choices when it comes to their careers. Articulating the value of cybersecurity jobs is essential if we are to motivate them to choose careers in cyber. On average, cybersecurity jobs advertise salaries of almost $84,000. This is 9% higher than IT jobs overall. $6,459 But cybersecurity careers don t just offer monetary benefits; they also offer exciting opportunities to protect the nation s digital infrastructure Burning Glass Technologies 24

26 What Are the Implications for Educators and Employers? Communicate the Value of Careers in Cybersecurity Focus on the Credentials that Matter Looking Outside of Cyber: Understand Cybersecurity Career Pathways 25

27 Broaden the Talent Pool by Focusing on the Credentials that Matter Some credentials are rare among cybersecurity workers and may not be necessary for onthe-job success. Separating the essential credentials from the nice-to-have credentials can broaden the pool of available talent for your cybersecurity roles. Similarly, educators and job seekers can focus on the credentials that are most-demanded and most lucrative to increase their value in the market Burning Glass Technologies 26

28 What Are the Implications for Educators and Employers? Communicate the Value of Careers in Cybersecurity Focus on the Credentials that Matter Looking Outside of Cyber: Understand Cybersecurity Career Pathways 27

29 Look Outside of Cyber to find Cyber Talent Cybersecurity Career Pathway 2015 Burning Glass Technologies 28

30 Filling Cybersecurity Jobs with Veterans: A Natural Fit Military Occupational Codes Mapping to Civilian Cybersecurity Roles MOC MOC Title Service 275 Information Systems Technician Coast Guard 6049 NALCOMIS Application Administrator/Analyst Marine Corps 9556 Security Specialist Navy 17C0 Cyberspace Operations Commander Air Force 17D(1,3,4)x Cyberspace Operations Air Force 140A Command and Control Systems Integrator Army 24A Telecommunications Systems Engineer Army 24X Designated Telecommunications Systems Engineer Army 250A Telecommunications Technician Army 254A Signal Systems Support Technician Army 255S Information Protection Technician Army 25A Signal, General Army 290A/29A Electronic Warfare Technician / Electronic Warfare Officer Army 352N Signals Intelligence Analysis Technician Army 352S Signals Collection Technician Army 2015 Burning Glass Technologies 29

31 The Bottom Line: Cybersecurity Has a Problem But Working Together We Can Solve It 30

32 Questions? 31

33 About Burning Glass Burning Glass Technologies delivers job market analytics that empower employers, workers, and educators to make datadriven decisions. Burning Glass is reshaping how the job market works, with data that identify the skill gaps that keep job seekers and employers apart and tools that enable both sides to bridge that gap and connect more easily. The company s artificial intelligence technology analyzes hundreds of millions of job postings and real-life career transitions to provide insight into labor market patterns. This real-time strategic intelligence offers crucial insights, such as which jobs are most in demand, the specific skills employers need, and the career directions that offer the highest potential for workers. Burning Glass applications drive practical solutions and are used across the job market: by educators in aligning programs with the market, by employers and recruiters in filling positions more effectively, and by policy makers in shaping strategic workforce decisions. At the same time, Burning Glass data-driven applications for workers and students help them choose career goals and build the skills they need to get ahead. Based in Boston, Burning Glass is playing a growing role in informing the global conversation on education and the workforce, and in creating a job market that works for everyone. For More Information Will Markow Senior Analyst t +1 (617) wmarkow@burning-glass.com Burning Glass Technologies 32

34 Draft Mission: About the Security Community The Security Community s mission is to create a forum for sharing knowledge, fostering innovation and positioning MA as a global leader in Security. Draft Goals: Improve connections & collaboration amongst individuals, companies, & organizations interested in security Support security workforce through professional development and networking Continuously promote Massachusetts as a leader within the security space Security Community Advisory Board (AB) Members work directly with MassTLC to identify programs: events, research, and/or other initiatives that help realize the goals of the cluster. Any MassTLC member in good standing may participate on the Security Advisory Board. Members must assist with at least one initiative per year. There will be two semi-annual planning meetings, along with other planning communications ( , conference calls, in-person meetings where necessary)

35 Co-chairs: About the Security Community Structure Gerald Beuchelt, CSO, Demandware Lee Weiner, SVP, Products & Engineering, Rapid7 Advisory Board: Knowledgeable about the industry/ issue and play an active role in its ecosystem Willing to roll up your sleeves, get active and help on one or several initiatives within the community that might include: Aggregating news on the industry (newsletter) Promoting the Community to engage the broader ecosystem Research on topics from size and scope to industry trends and forecast Identifying event ideas including speakers and format Writing or gathering blog posts that disseminate content of the broader community The benefits to you include: Having voice in cluster s direction Recognition on website/ LinkedIn profile/ resume Recognition at events as a leader at the Council Access and connections to a network of people in the industry with similar interests

36 MassTLC Clusters & Communities Cloud Security Talent Development Mobile CSO/CISO Sales & Marketing CMO & VP Mktg. Demand Gen Big Data IoT Software Development CTO & VP Eng. DevOps Healthcare Robotics CXO