The Recruitment Market in 2014

Transcription

1 Corporate Governance Recruitment Market Report 2014 Security

2 BARCLAY SIMPSON MARKET REPORT 2014 SECURITY CONTENTS Welcome to Barclay Simpson s 2014 Security Market Report Barclay Simpson has been producing corporate governance market reports since This year we are producing two reports. This one, summarising and analysing recruitment trends in the security recruitment market, is supplemented by an employer survey. Later in the year we will be producing our compensation and trends report which will focus primarily on remuneration and will again be supplemented by a survey of security professionals registered with Barclay Simpson. Comparable reports exist for all other areas of corporate governance. They can be accessed in section 8 of this report ( About Barclay Simpson ) or at We place great value on the professional reaction to our reports and would appreciate your comments and any further requests for clarification or information. 01/ Executive Summary /1 02/ market analysis /2 03/ market commentary /3 04/ sector analysis /5 05/ Outlook /7 06/ salary GUIDE /8 07/ Employer survey /12 08/ About Barclay Simpson /21 Offices London Edinburgh New York Dubai Hong Kong Singapore Disciplines Internal Audit Risk Compliance Information Security Business Continuity Legal Treasury

3 01 EXECUTIVE SUMMARY Companies now focused on why they should recruit It is said that there are two types of Chief Executive. There are those who are aware that their companies have been subject to a cyber attack and those who are not. In the meantime, cyber security has moved up the political agenda with the government launching a number of initiatives such as the National Cyber Security Programme and the Cyber Security Information Sharing Partnership to help drive cyber security. They have been designed to increase awareness and allow the public and private sectors to better protect their information assets. Recruitment matters When asked how important recruitment is to the success of their department, 89% of security managers rated it as important. Clearly the ability to attract and recruit security practitioners with the appropriate skills and experience matters. Security is a growth area and with the economy recovering strongly, the resistance to recruit externally that was widespread across the wider economy is retreating. No matter how much is made of it being a faux recovery built on increased consumer debt, external recruitment is about confidence. How confident are companies not only to receive CVs and interview candidates, but ultimately follow through and make realistic offers of employment? Companies a year ago were focused on why they should not recruit. At the start of 2014, they are now firmly focused on the reasons why they should. Pent up pressure to recruit There is clearly pent up pressure to expand security teams and recruit. The results from our survey indicate that 76% of security managers believe that they have insufficient resources to carry out their responsibilities. Of those who have recruited in the last six months, 59% reported they found it difficult to recruit with an equal number reporting that salary expectations from prospective candidates had been higher than they anticipated. The importance of interpersonal skills In spite of the increase in demand there has been no reduction in standards. A new challenge is securing candidates who not only have the necessary technical skills but also the necessary interpersonal skills. 65% of respondents to our survey reported that they considered interpersonal skills vital and over 50% reported that it was a greater challenge than finding candidates with the right technical skills. Clearly security practitioners can no longer simply be regarded as technicians and, as in other areas of corporate governance, the need to communicate and influence is vital. Need to focus on what matters Security is becoming more about instilling a corporate wide security culture and developing innovative security solutions. In recruitment terms it can come down to really understanding the skills and experience necessary to undertake a role. More insightful security managers should be prepared to negotiate away the less vital attributes and focus on those that really matter. This can open the way to a cheaper but superior recruitment solution. Security is a growth area and with the economy recovering strongly, the resistance to recruit externally that was widespread across the wider economy is retreating. 1

4 02 MARKET ANALYSIS VACANCIES Commerce taking the lead The number of vacancies generated in the security recruitment market recovered in the first half of 2013 and peaked in the second half of They have now plateaued with companies in the commercial rather than financial or consultancy sectors taking the lead. Given the increasing threat of denial of service attacks and other emerging cyber threats, areas in particularly high demand are SOC staffing and other specialists in the cyber security intelligence and response fields. Companies are prioritising staff retention wherever possible and many vacancies are currently newly established positions. If the number of people employed in security is growing, it does beg the question how this demand can be met? As in other areas of corporate governance, companies will need to be more creative. This will certainly involve considering candidates from interrelated disciplines provided they have relevant experience and the all important interpersonal skills. Companies are currently seeking candidates who can make an immediate impact and can readily deliver improvements. As a result, vacancies are more likely to be at the mid to senior level and require a minimum of five years experience. Less experience is being sought for support focused areas of security such as SOC staffing. New vacancies Outstanding vacancies Rate of placements Vacancies taking longer to fill To provide a better insight into the dynamics of the recruitment market, this graph plots the rate at which placements have been made across the last four years. In order to create a scale, we have taken the results from the first six months of 2010 as our 100% benchmark. It reflects the rate at which candidates are being offered and accepting jobs. The rate of placements declined in the second half of This is surprising given the improved economic backdrop and increased demand. The reason was the lack of availability or affordability of external candidates. In an environment where standards continue to rise and particularly where the need for well developed interpersonal skills is becoming universal, vacancies are taking longer to fill. Given the higher profile that information / cyber security is enjoying, it is becoming a more attractive internal career development choice. By recruiting internally, security departments can benefit from employees corporate knowledge and can be more confident of their intrinsic abilities. In terms of the wider recruitment market, it is also a way of increasing the pool of experienced practitioners relatively quickly. Whilst vacancies are being filled at a marginally slower rate, all sectors are continuing to steadily recruit. Opportunities are available to security practitioners across the market place. Placement rate 2

5 03 MARKET COMMENTARY Security becomes a mainstream corporate function Whereas a year ago the information security recruitment market was characterised by high demand from the banking sector and at times little else, since then there has been a broadly based expansion in demand. It now encompasses industry and commerce and the consultancy sector, where utilisation rates are high, and most consultancies and systems integrators are recruiting. Unlike a year ago, it is not simply a question of a security practitioner staying with their existing employer or accepting an offer, now they potentially have multiple opportunities open to them. Historically, investment in information security has followed investment in IT. Whilst the economy is clearly recovering, corporate investment remains low. Given the significant increase in demand for information security practitioners, the link between investment in IT and security recruitment appears to have been broken. Security has changed to the extent that what was once characterised as simply a technical discipline, has developed into a mainstream corporate function. Vacancies across all sectors The results of our survey indicate recruitment is being driven by increased levels of business and the introduction of new regulation and standards. When the banks dominated, there were many similar vacancies. Demand is now characterised by vacancies across all sectors with a wider range of skills in demand. This is providing a much wider range of opportunities and is making it easier for security practitioners to move across sectors. Our survey confirms this as 98% of employers said they would be prepared to recruit candidates with transferable experience from another industry sector. Security is no longer simply a technical discipline Security functions are becoming more focused on promoting a security culture throughout companies. This includes having a commercially savvy Chief Information Security Officer who can bridge the divide between the technical issues and engagement at board level, where the potential costs of not doing security well need to be understood. Security practitioners as a matter of course need to communicate and more importantly influence. From a recruitment perspective it is therefore no longer simply about technical skills on a CV but increasingly about the personality behind those skills. It is a novel development in security recruitment that candidates are now more likely to be rejected because of their lack of interpersonal rather than technical skills. This has introduced a new dimension to security recruitment. In the face of resurgent demand it is restricting the number of candidates who can realistically expect to navigate recruitment processes and will require companies to be more creative in their approach to recruitment. Security practitioners as a matter of course need to communicate and more importantly influence. 3

6 Increase in Cyber Attacks In 2013 there was a significant increase in cyber attacks which is now seen as one of the major threats facing UK businesses. As a result, there has been a notable rise in demand for specialists in Threat Detection and Incident Response. Addressing this threat is likely to be a top priority for businesses in 2014 due to the damage a data breach can cause. We anticipate a significant increase in the demand for security practitioners with the skills to defend against cyber attacks. The quality and ingenuity of cyber attacks is improving. Industry wide initiatives are a way of countering such attacks. We expect to see more such initiatives in 2014 where intelligence and experiences are shared. These initiatives are resource intensive and will inevitably result in increased headcounts in It is an area where intelligence skills honed in the government sector can be utilised in the private sector. Malware attacks to become more specific It is anticipated that malware attacks will decline in frequency but become more target specific and potentially destructive. Hackers are more likely to target vendors, consultancies and contractors for valuable information relating to their clients. As a consequence, we anticipate that a key driver in the recruitment market will be cloud data storage. Network storage security threats are not new and have helped underpin demand in both the contract and permanent security markets. However, with more companies looking to utilise cloud storage and cloud storage providers competing for market share, any significant security breach could be costly. In response, the IT solutions industry is likely to be a significant source of demand as companies look to compete on the quality of their security. Information Security Standards Our survey indicates that regulation is having a significant influence on the recruitment market. While the government will shortly be announcing its preferred organisational standard for cyber security, there are a number of specific developments that are driving demand. In September 2013, the latest version of ISO was published. It replaced the 2005 version and puts more emphasis on measuring and evaluating how well an organisation s ISMS is performing. It also recognises the emergence of outsourcing. In response, there has been a steady increase in demand for security consultants with in-depth knowledge of the standard and we expect this to continue in Demand for security consultants who hold CESG accreditations increased during the second half of This was as a result of the new CLAS scheme and the introduction of the CCP scheme which recognise the expertise of those working in Information Assurance and Cyber Security in government and commerce. Vacancies have risen sharply and even though demand outweighs supply, employers remain selective. In 2013 there was a significant increase in cyber attacks which is now seen as one of the major threats facing UK businesses. As a result, there has been a notable rise in demand for specialists in Threat Detection and Incidence Response. In fact CCP or CLAS accreditation alone is not enough with many employers looking for candidates with additional skills such as business development or security architecture. With the introduction of PCI DSS version 3.0, we anticipate that demand for security practitioners with expertise in this standard will increase as businesses look to be compliant. It will ultimately tilt demand towards practitioners with PCI DSS expertise. 4

7 04 Sector Analysis Financial Services During 2012 and the first half of 2013, there were a number of major transformation programmes in the banking sector. Some were the result of demergers that resulted in banks establishing in-house security functions. Other transformation programmes were driven by regulatory pressure. In spite of their commercial difficulties and the cuts they were forced to make, a number of banks had multiple vacancies as they looked to modernise and expand the scope of their security functions. This resulted in significant demand and encompassed architects, transformation managers and in house consultants / risk assessors. This demand has now subsided. Similarity in threat landscape More recently there have been significant developments in cyber security. The financial services sector is looking to up-skill at all levels in both strategic cyber security leadership and security operations and intelligence focused roles. As the threat landscape between the public and financial services sectors take on a similar shape, practitioners from the security services and military are in higher demand than ever before. Even without major transformation programmes, we expect demand to remain buoyant during 2014 as financial services companies look to bring essential skills in house. Demand for security practitioners from the consulting sector to join banks in subject matter expert or risk assessment roles is set to continue. Commerce Historically, demand for security practitioners from commercial companies has been significantly lower than in the financial services sector. This remained true during 2012 and early 2013 when banks and insurance companies continued to dominate demand. Demand in commerce outstripping financial services However, during the course of the last year, demand in commerce has increased to the extent that it is currently outstripping demand in financial services. Demand is particularly notable at senior levels with commercial groups looking to either establish or develop existing departments. Telecom groups have notably been looking to expand their in-house security resources and with on-line now accounting for over 10% of retail sales, e-commerce is also driving demand. Potential regulation re-inforcing demand Given the relative immaturity of security departments within commerce, candidates with broad skill sets are more likely to be in demand. However, with recent revelations concerning intrusive government monitoring and the volume and sensitivity of customer information, data protection is an area in high demand. Upcoming potential regulation is reinforcing demand and data protection is a likely growth area in commerce. Telecom groups have notably been looking to expand their inhouse security resources and with on-line now accounting for over 10% of retail sales, e-commerce is also driving demand. 5

8 Consultancies and Systems Integrators Buoyed by an improving economy and demand for their services, 2013 ended and 2014 has started with a number of takeovers and mergers in the sector. Demand from consultancies and systems integrators increased in the second half of A number came to the recruitment market with multiple vacancies. Unfortunately many were looking for identical recruits - security consultants with a mixture of delivery and business development experience. Some candidates received multiple offers and as a consequence otherwise reasonable offers were rejected. As corporate security budgets grow and the pressure to adopt new standards increases, competition for staff within the sector is likely to be a feature of the recruitment market in founded. Many security contractors are once again benefiting from multiple offers. Outside of the increase in overall demand, there has been a notable increase in demand for network security contractors specialising in Security Incident Event Management (SIEM) along with senior security architects with extensive hands on technical expertise. There is also an increase in demand for senior security consultants to assist with the development of security functions and information security management systems in response to the demerger activity within the financial services sector. In 2014, we expect a steady increase in demand for skilled contractors. Where contractors are becoming hard to find, rates are increasing and companies are starting to offer additional incentives such as allowing home working and longer notice periods. As corporate security budgets grow and the pressure to adopt new standards increases, competition for staff within the consulting sector is likely to be a feature of the recruitment market in The government drive to use more SMEs is also likely to impact the recruitment market. In response, more boutique security consultancies are likely to emerge. They will need staff and this will inevitably result in new sources of demand. Contract Contracting remains an integral part of the security recruitment market with almost 40% of the respondents to our survey reporting they use contractors. Last year we reported that many contractors were finding it more difficult than anticipated to secure contracts. However, we were optimistic and this optimism has proven to be well 6

9 05 OUTLOOK Security has become a mainstream corporate function There is no doubt that security has moved up the political and corporate agenda. It is benefiting from a profile that it has never previously enjoyed. It has become a mainstream corporate function. Whilst developments in the wider economy will always affect confidence and attitudes towards recruitment, the potential costs of not doing security well are understood. Dynamic and commercially savvy CISOs who can argue the case for effective security at board level are becoming common. The career development prospects of security practitioners are benefiting as their numbers increase and they enjoy greater career mobility than ever before. Positive recruitment plans for 2014 A whole range of positive forecasts are available for the UK economy and these are reflected in the security recruitment market. Recruitment plans in 2014 appear positive across the economy with 70% of companies in both commerce and financial services forecasting that they are likely to recruit, rising to over 80% amongst the consultancies and systems integrators. The skills that were in high demand in 2013 such as operational security, security architects, data protection specialists and security risk assessors will continue to be so. Given that 59% of companies were already finding it difficult to recruit in 2013, it does beg the question, once the requirement for effective interpersonal skills are factored in, where these recruits will come from? Higher salaries are a likely consequence. There are risks going forward Whilst the economic outlook remains positive, clearly there are risks. Monetary easing and the artificially low interest rates that have allowed the banking and wider economy to recover, will at some point be withdrawn. The consequences of this are at best uncertain. However, as far as 2014 is concerned, with business growth driving demand, as our survey suggests, demand for information security practitioners is set to remain robust. For many CISOs, balancing their recruitment aspirations with the available candidates will be a key challenge in The career development prospects of security practitioners are benefiting as their numbers increase and they enjoy greater career mobility than ever before. 7

10 06 SALARY GUIDE We reported in our main Salary Guide and Compensation Survey six months ago that the average salary increase achieved by information security practitioners changing jobs was 14% and close to its long term average. This was against 4% achieved by those staying with their existing employer. The 4% increase achieved by those staying was flattered by those who had benefited from promotions. For many working in information security, like the majority of other people working in the economy, there has been no real increase in their earnings. With inflation now falling, this pattern is likely to change in Whilst there is no doubt upward pressure on salaries in the recruitment market, it is not yet a problem. In our survey, whilst 12% of employers reported they believed salary expectations in the recruitment market were excessive and beyond their budget, and overall 71% believed they were high, 88% considered them affordable. In our experience, provided companies are offering the market rate, decisions made by information security practitioners in the recruitment market are more likely to be driven by the perceived quality of the opportunity and not salary. Salary Guidance The figures below are what we believe to be the most likely salary ranges available to a cross section of security practitioners. We also provide a more generic end user guide. This is split between banking, financial services non banking and commercial end users which have been divided between larger FTSE 100 or equivalent groups and smaller FTSE 250 or equivalent groups. We then go on to provide a generic guide for those in consultancies and SIs. This is split into Big 4, SIs, large consultancies and boutique consultancies. The salary ranges quoted are for good rather than exceptional individuals and take no account of other benefits in addition to the salary that usually accrues to security practitioners such as bonuses, profit sharing arrangements and pension benefits. Barclay Simpson will release a Compensation and Market Trends Report in July that will include detailed information on salaries. salary selected profiles London Rest of UK Head of Security Managing a team of 8 security practitioners in a financial services company, assisted by 2 more junior managers. 10 years management experience and 17 years security experience. Head of Business Continuity Major financial services group, a large team to manage/supervise. Established career history within BCM. Network Security Team Leader Working in a FTSE 100 group leading a team of 6-8 network security specialists, reporting directly to the head of security. 10 years experience. CHECK Team Leader Working in a penetration testing practice within a consultancy. Responsibility for some client management and mentoring less experienced penetration testers. EMEA Manager of Data Protection Medium to large insurance group. No direct reports. EU Data Privacy legislation experience. Security Presales Engineer Security Presales Engineer within a security vendor. Technology focus on network security. Security Manager Security background in a small financial services company. 3 years management experience. No permanent reports. Will utilise consulting firms and contractors on an ad-hoc basis , , , , , , , , , , , , , ,000 8

11 salary selected profiles (continued) London Rest of UK Senior Security Consultant Working for an SI, undertaking security consultancy and delivering on security projects for a large-scale client. Senior person also involved in bid / proposal work and mentoring team members. CLAS Consultant Senior level in a security practice of a large consultancy or SI. Skills in security architecture, security policy formulation and review, and risk assessment. Also undertakes business development activities. PCI QSA Practicing QSA working with external clients and managing their entire PCI compliance programme. Security and Compliance Manager Security Manager responsible for the business meeting compliance standards such as ISO27001 and PCI. Identity & Access Management Consultant Solid skills in identity and access management design and architecture. Background of working in consultancy, with good client-facing skills and bid work experience. Senior Business Continuity Consultant Working for a large consultancy firm, delivering and managing consulting engagements and in some cases managing junior staff. Some sales and business development responsibility. SIEM Consultant Technical specialist with strong skills with a leading SIEM solution such as ArcSight or RSA envision. Design, implementation and integration experience. Client facing consultative role. Security Analyst Generic information and IT security consulting and project delivery in a large retail financial services group. 4 years experience. Senior Data Protection Analyst Team member in a small DP department for a large mobile telecommunications group. Proven experience in a similar role and ISEB qualified , , , , , , , , , , , , , , , , , ,000 salary CONTRACT Security POSITIONS London Rest of UK Application Security Consultant Consultant will need to identify appropriate security controls, as well as carry out code reviews of J2EE enterprise applications, penetration tests, tracking new requirements and recommending improvements. Security Monitoring Analyst Analyst providing monitoring by using various security solutions deployed within the IT environment, providing active monitoring, identification, notification and response to internal and external threats and recommendation for the mitigation of risks. SIEM Consultant Technical Specialist with strong skills with leading SIEM solution such as ArcSight or RSA envision. Design, implementation and integration experience PCI Consultant PCI consultant who can work with the client to ensure compliance to the PCI-DSS standards Business Continuity Consultant Managing a team of 8 security practitioners in a financial services company, assisted by 2 more junior Security Consultant Providing security advice across the business, ranging from policy review and development, to information risk reviews. Holds CISSP or CISM

12 salary CONTRACT Security POSITIONS (continued) London Rest of UK Technology Risk Consultant Good technical understanding with the ability to identify, assess, manage and report risk. Working with different projects within the organisation on varying technologies. Penetration Tester SME in application security, code reviews and vulnerabilities, attacks and countermeasures with a deep knowledge of hacking and penetration testing techniques, methodologies and tools across web application and infrastructure. Data Privacy Analyst Experience of DPA 98 and EU Privacy Directive 95/46/EC, required to provide specialist privacy knowledge and support Salary 2013 End UserS Banking Non banking FS Commercial FTSE 100 equivalent Commercial FTSE 250 or smaller Info Security Analyst 2 yrs 30 37, , , ,000 Info Security Analyst 3 yrs 37 45, , , ,000 Info Security Analyst 4 yrs , , , ,000 Info Security Manager (team under 5) , , , ,000 Info Security Manager (team 5+) , , , ,000 Head of Info Security (dept under 10) , , , ,000 Head of Info Security (dept 10+) 160, , ,000+ N/A Business Continuity Analyst 2 yrs + Business Continuity Manager (4 yrs + no team) 37 46, , , , , , , ,000 Salary Chart 2013 End UserS Data Protection Analyst 2 yrs , , , ,000 Banking Non banking FS Commercial FTSE 100 equivalent Commercial FTSE 250 or smaller Data Protection Manager (5 yrs + no team) 55 90, , , ,000 10

13 Salary Chart 2013 Consultancies and SIs Big 4 Systems Integrator Large Consultancy Boutique Consultancy Consultant 32 46, , , ,000 Senior Consultant 43 52, , , ,000 Manager (Principal Consultant) 56 70, , , ,000 Senior Manager (Managing Consultant) 72 95, , , ,000 Director (Practice Lead) , , , ,000 Penetration Tester (under 4 years exp) 28 43, , , ,000 CHECK Team Member 40 50, , , ,000 CHECK Team Leader 58 90, , , ,000 11

14 07 Employer SURVEY 2014 Security Last year the results of our candidate survey were included in our 2013 Mid-Year Report. This year we are including the results of our recently completed employer survey in this, our 2014 Market Report. The results include some interesting conclusions and cover: Current recruitment needs Skills / qualities / experience most in demand Willingness to recruit candidates from other sectors / jurisdictions Views on quality and expectations of currently available candidates Key recruitment drivers in 2014 Recruitment intentions for 2014 Contents 1. Key conclusions from Security Employer Survey 2. Broader context key conclusions (comparison with other areas of corporate governance) 3. Security Employer Survey results 4. Broader context rest of results Our survey of employers covered not only security, but also compliance, risk, internal audit and legal. All respondents to our survey were individuals with responsibility for recruitment who were asked questions designed to elicit their perspective on the recruitment market. As a result, in addition to providing specific findings for security, we are also able to make comparisons with the broader picture in corporate governance. 12

15 1 Key Conclusions The overall conclusion is that demand in the security recruitment market is likely to increase in 2014, with significant competition for candidates with the appropriate technical and interpersonal skills. The main conclusions are shown below. Over three quarters of managers believe they are under-resourced p 76% of department managers do not believe their department is sufficiently resourced for the demands that are made on it Recruitment is important to business success p 89% of employers consider recruitment either vital or important to the success of their department p Only 2% said it was not important 3 years experience is almost essential p 98% of employers looking for over 3 years experience p Over half of employers (55%) looking for 3-5 years experience Technical suitability is absolutely critical p Technical suitability is far more important than any other consideration when drawing up a shortlist of candidates to interview All about skills, not background p Specific skills are so important in security that 98% of employers said they would be prepared to recruit candidates with transferable experience from another industry sector Interpersonal skills are also important, but are hard to find p 65% of employers say interpersonal skills are vital p 53% say that their greatest recruitment challenge has been finding candidates with the required interpersonal skills p Interpersonal skills are likely to be the differentiator when an offer is made Agencies still key to recruitment, though other sources are proving effective p 55% of candidates currently sourced by recruitment agencies p Internal recruits, Direct advertising / referrals and Onsite recruitment team / direct sourcing each account for more than 10% of candidates recruited Significant competition for the best candidates p 47% of managers have attempted to recruit in the last 6 months of 2013 p 65% believe that appropriate candidates are either available or plentiful p 71% believe the quality of available candidates is strong or acceptable p Yet 59% say they have found it difficult to recruit p And only 14% judge themselves better placed to recruit in relation to their competitors Salary expectations rarely the problem p Employers consider candidate salary expectations to be high but 88% believe they are affordable Demand likely to increase in 2014 p 72% of employers either definitely need to recruit in 2014 or are likely to recruit p Demand will be driven by a wide range of factors (business growth, new regulation, cyber security, data leakage, increased investment in IT, etc.) rather than just one or two factors 13

16 2 Broader Context There are three areas in which the security responses significantly differ: concern about current levels of resources, need to recruit and willingness to recruit from other sectors. Key conclusions Although much of the picture coming through from security employers is in line with the other areas of corporate governance we covered (compliance, risk, internal audit and legal), there are three areas in which the security responses significantly differ: Greater concern about current level of resources As the following table shows, confidence in their current level of resources is much lower in security than in other areas of corporate governance, with over three quarters of managers feeling that their department is under-resourced: Do you feel your department is sufficiently resourced for the demands that are made on it? Area Yes No Compliance 61% 39% Risk 56% 44% Internal Audit 52% 48% Security 24% 76% Legal 57% 43% Greatest need to recruit Directly linked to this concern about resources, nearly half of security managers expressed a definite need to recruit in 2014, which is higher than the other areas of corporate governance: What are your recruitment plans for 2014? Area Definite Likely to Unlikely to need Compliance 30% 35% 35% Risk 31% 38% 31% Internal Audit 35% 38% 27% Security 47% 25% 28% Legal 16% 48% 36% Willingness to recruit from other industry sectors Perhaps because of the building pressures on recruitment and the over-riding importance of highly specific skills in the security market, 98% of employers said they would be prepared to recruit candidates with transferable experience from another industry sector: Are you prepared to recruit candidates with transferable experience from another industry sector? Area Yes Possibly No Compliance 34% 49% 17% Risk 37% 44% 19% Internal Audit 58% 34% 8% Security 70% 28% 2% Legal (A comparible question was not asked in the legal survey) 14

17 3 Employer Survey results Over three quarters of departments under-resourced Do you feel your department is sufficiently resourced for the demands that are made on it? Recruitment is important to business success How important is recruitment to the success of your department? Contractors generally only used when essential At any given time, what is the approximate percentage of your department that is made up of contractors? What is your main reason for using contractors? What is the average contract period? CISSP and CISM in greatest demand Which of these security qualifications are you most likely to value? 15

18 Over half of employers looking for 3-5 years experience When recruiting, what level of experience are you most likely to request? Technical suitability is absolutely critical In order of significance, what are the key considerations when deciding which candidates to progress to interview? Consideration Weighted average Technical suitability for the role 5.7 Professional / Educational qualifications 3.7 Recommendation 3.3 Stability of employment record 3.1 Current / expected salary 3.0 Current employer 2.2 Interpersonal skills are also important and are hard to find When considering potential recruits, how important are their interpersonal skills? All about skills, not background Are you prepared to recruit candidates with transferable experience from another industry sector? What has been the greatest challenge? Agencies still key to recruitment, though other sources are proving effective What is your principal source of candidates? In order of significance, what are the key considerations when deciding to progress a candidate to offer stage? Consideration Weighted average Technical suitability 5.3 Interpersonal skills 5.0 Cultural fit 4.1 Perceived desire to work for the 3.0 Company / Department Professional and educational 2.3 qualifications Input from HR

19 Significant competition for the best candidates Have you recruited or attempted to recruit externally in the last six months? How would you rate the availability of candidates? How would you describe the quality of available candidates? Overall, have you found it difficult to recruit? How do you view your ability to recruit in relation to your competitors? In order of significance, what do you perceive to be the reasons? Factor Weighted average Salary / benefits package 3.9 Strength / weakness of the 3.6 corporate brand Quality of work / experience 3.3 Location 2.8 Recruitment process 1.4 Salary expectations rarely the problem Demand likely to increase in 2014 What has been your perception of candidate salary expectations? What are your recruitment plans for 2014? A range of factors will drive demand In order of significance which will be the most important recruitment drivers in 2014? Factor Weighted average Increased level of business 4.9 New regulation / standards 4.3 Increased cyber security threat levels 3.7 Fear of data leakage 2.9 Replacement recruits 2.8 Investment in IT

20 4 Broader Context Rest of Results The following tables compare the results from security employers with those from employers in compliance, risk, internal audit and legal. Certain figures have been highlighted to make it quicker and easier to spot key differences. Do you feel your department is sufficiently resourced for the demands that are made on it? Area Yes No Compliance 61% 39% Risk 56% 44% Internal Audit 52% 48% Security 24% 76% Legal 57% 43% How important is recruitment to the success of your department? Area Vital Important Somewhat important Not important Compliance 57% 38% 5% 0% Risk 59% 36% 5% 0% Internal Audit 75% 19% 2% 4% Security 40% 49% 9% 2% Legal 54% 42% 3% 1% When recruiting, what level of experience are you most likely to request? Area Up to 2 years 3-5 years 5-7 years 7-10 years Over 10 years Compliance 9% 55% 24% 6% 6% Risk 0% 47% 35% 9% 9% Internal Audit 9% 45% 34% 11% 1% Security 2% 55% 36% 2% 5% Legal 13% 46% 31% 6% 4% When considering potential recruits, how important are their interpersonal skills? Are you prepared to recruit candidates with transferable experience from another industry sector? Area Vital Important Somewhat important Not important Compliance 79% 21% 0% 0% Risk 97% 3% 0% 0% Internal Audit 86% 14% 0% 0% Security 65% 28% 7% 0% Legal 78% 21% 1% 0% Area Yes Possibly No Compliance 34% 49% 17% Risk 37% 44% 19% Internal Audit 58% 34% 8% Security 70% 28% 2% Legal (A comparible question was not asked in the legal survey) What is your principal source of candidates? Area Internal recruits Direct advertising / referrals Internal team / direct sourcing PSL of RECs Range of agencies Compliance 17% 8% 4% 59% 12% Risk 22% 10% 6% 56% 6% Internal Audit 6% 4% 9% 65% 16% Security 15% 10% 20% 48% 7% Legal 5% 23% 13% 50% 9% (Please note that there were slight differences in the wording of the options for legal) 18

21 In order of significance, what are the key considerations when deciding which candidates to progress to interview? Area Technical suitability Qualifications Stability of employment Current employer Salary Recommendation Compliance Risk Internal Audit Security Legal In order of significance, what are the key considerations when deciding to progress a candidate to offer stage? Area Technical suitability Interpersonal skills Cultural fit Keenness Qualifications HR input Compliance Risk Internal Audit Security Legal n/a (Please note that the legal results have been adjusted to match other figures as the legal survey didn t include the HR option.) How do you view your ability to recruit in relation to your competitors? Area Better placed Comparably placed Poorly placed Compliance 12% 81% 7% Risk 21% 62% 17% Internal Audit 17% 65% 18% Security 14% 75% 11% Legal 21% 61% 18% In order of significance, what do you perceive to be the reasons? Area Salary / benefits Corporate brand Quality of work Location Recruitment process Compliance Risk Internal Audit Security Legal Have you recruited or attempted to recruit externally in the last six months? Area Yes No Compliance 58% 42% Risk 72% 28% Internal Audit 72% 28% Security 47% 53% Legal 77% 23% How would you rate the availability of candidates? Area Plentiful Generally available Difficult to find Compliance 8% 28% 64% Risk 5% 57% 38% Internal Audit 2% 54% 44% Security 6% 59% 35% Legal 16% 52% 32% 19

22 How would you describe the quality of available candidates? Area Strong Acceptable Poor Compliance 4% 64% 32% Risk 10% 76% 14% Internal Audit 19% 50% 31% Security 12% 59% 29% Legal 23% 68% 9% Overall, have you found it difficult to recruit? Area Yes No Compliance 76% 24% Risk 57% 43% Internal Audit 56% 44% Security 59% 41% Legal 48% 52% What has been the greatest challenge? Area Technical skills Interpersonal skills Compliance 60% 40% Risk 29% 71% Internal Audit 31% 69% Security 47% 53% Legal 61% 39% What has been your perception of candidate salary expectations? Area Excessive / beyond budget More than anticipated but affordable Reasonable and affordable Compliance 16% 60% 24% Risk 14% 57% 29% Internal Audit 27% 45% 28% Security 12% 59% 29% Legal (A comparible question was not asked in the legal survey) What are your recruitment plans for 2014? Area Definite Likely to Unlikely to need Compliance 30% 35% 35% Risk 31% 38% 31% Internal Audit 35% 38% 27% Security 47% 25% 28% Legal 16% 48% 36% 20

23 08 Barclay ABOUT BARCLAY SIMPSON Simpson Bridewell Gate, 9 Bridewell Place London EC4V 6AW Tel: 44 (0) bs@barclaysimpson.com Barclay Simpson is an international corporate governance recruitment consultancy specialising in internal audit, risk, compliance, security, business continuity, legal and treasury appointments. Established in 1989, Barclay Simpson works with clients in all sectors throughout the UK, Europe, Middle East, North America and Asia- Pacific from our offices in London, Edinburgh, New York, Dubai, Hong Kong and Singapore. We add value by using our unique focus on corporate governance, our highly experienced specialist consultants and access to both the local and international pools of corporate governance talent. Our strength lies in our ability to understand client and candidate needs and then to use this insight to ensure our candidates are introduced to positions they want and our clients to the candidates they wish to recruit. For more in-depth coverage, comprehensive reports and compensation guides exist for the Internal Audit, Risk, Compliance, Security and Legal recruitment markets. These can be assessed from the links below. We also produce other specialist reports, each of which can be accessed for free on our website: If you would like to discuss any aspect of the reports please contact the following divisional heads: Corporate Governance Adrian Simpson as@barclaysimpson.com Internal & IT Audit Daniel Flynn df@barclaysimpson.com Risk Matt Brown mb@barclaysimpson.com Compliance Tom Boulderstone tgb@barclaysimpson.com Security Mark Ampleford ma@barclaysimpson.com Legal Jane Fry jf@barclaysimpson.com To discuss our regional and international services please contact: Scotland Liam Hughes lh@barclaysimpson.com Europe Tim Sandwell ts@barclaysimpson.com Middle East Matt Crocombe mc@barclaysimpson.com Asia Pacific Russell Bunker rb@barclaysimpson.com North America Daniel Close dc@barclaysimpson.com 21