Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

2/15/2016
10:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How To Retain Good Security People: Keep The Work Exciting

Security managers should foster a challenging but rewarding work environment and invest in training to keep their security teams intact.

Acquiring talented IT security professionals is a big challenge for organizations grappling with growing skill shortages that impact every industry sector and government agency. Even more challenging, though, is retaining skilled workers amid a hot market where they can be easily lured elsewhere by more money or better opportunities.

It's a delicate balancing act that not only requires companies to offer appropriate compensations and work environments, but also opportunities for the workforce to learn new skills and tackle more challenging and exciting work, experts say.

According to an online survey of 132 security professionals conducted by AlienVault’s Javvad Malik, 33.9% cite “more challenging and exciting work” as the main reason they would move to another job.

“Not surprisingly, pay came in at second [23.14%] and flexible working environments [16.81%] was third,” says Malik, a-London-based IT security specialist with AlienVault, a developer of security information event management and threat management solutions. Promise of training, certification, or more education, also ranked high as an incentive for taking a new job.

One way to help make the work environment more challenging is to automate the mundane tasks, Malik says. “Every organization has boring and routine things to do, but if they [security managers] can try to automate it or give it as a project,” the security team could focus on more complex tasks, he says. 

Take vulnerability scans, which can be time-consuming: why not import them into a security information event management system or write correlation rules, he says. The outcome is two-fold: “You are removing the tedious tasks and giving them something meaningful to do. Once that is accomplished, you’ve ended up saving 10% to 20% of your time per week.”

Other key findings of the survey:

  • Having offices situated outside of major cities not only attracts local talent, but the chances of retaining that talent increases significantly due to lack of competition.  

Malik spoke to managers at two large international companies who preferred to set up their data centers or SOCs outside of major cities, ideally near a university. They knew they would get a steady flow of talented staff they could train. The staff would have few options geographically to actually leave. “They ended up with staff retention that way,” Malik says. 

  • Team culture can vary from company culture: don't assume both are the same. 

Some survey respondents enjoy working with their boss and colleagues, but thought their companies were atrocious. They’re staying in their jobs because of their boss and colleagues.  However, it is more difficult to stay in a company where your boss or immediate colleagues are unsupportive, Malik notes.

  • Nearly 65% of security pros are happy and content in their current jobs.

One security director said he had great success in finding non-security people from within the company and training them for IT or cybersecurity jobs, Malik says. Plus, the director structured the SOC team like a consultancy or cost center within the company. As a result, he could more effectively determine how many people he needed to support the various businesses.

He could say, “These are the businesses I’m supporting so where do you want me to scale back, rather than just increasing the workload on everyone,” Malik explains.

 

Top-Down

Retention initiatives start at the top, says Adam Vincent, CEO of ThreatConnect, a developer of threat intelligence platforms. Leadership must grow and foster a security team to meet their organization’s needs, and people who are being trained eventually become experts in their fields.  They are either going to grow into a new role within their organization -- or look elsewhere, he says.

“If you let them go because it is the next frontier for their career and learning experience, I view that as a win," says Vincent, who advocates training people and supporting their decision to go elsewhere for more challenging work if he couldn't provide that to them.

“However, I will also say that leadership of the security practice is what you need to look at so you don’t end up with all of your people job hopping.”

Security professional responding to The 2015 (ISC)² Global Information Security Workforce Study, meanwhile, also expressed satisfaction with their current jobs.

“Given the environment in which security professionals work, a certain amount of discontentment with their current roles would be understandable, if not expected,” according to the report, which was written by Frost and Sullivan analysts. But the study found that three out of four say they are "somewhat or very" satisfied, and 30% of the 14,000 professionals worldwide that responded to the survey say they are "very satisfied.” 

High job satisfaction facilitates employee retention, according to the report, as well as other factors. Employee churn remains a challenge for employers despite security professionals’ satisfaction with their current positions, the survey shows.

“In a single year, 2014, nearly one in five security professionals changed employers or employment status. Across the 2011, 2013, and 2015 surveys, churn of nearly 20% is the highest that has been seen,” the report says. “Correspondingly, having 14% of respondents reporting that they 'changed employers while still employed' was also the highest percentage across the three surveys. Rising churn is the first sign of rising security professional scarcity,” according to the (ISC)2 report.

Interop 2016 Las VegasFind out more about security careers at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

 

 

Offering training programs (61%) and paying for employee’s security certification expenses (59%) are the top two initiatives security managers surveyed have in place to retain professionals. Improving compensations (57%) landed third on the list. 

Offering flexible work schedules (55%) and supporting flexible working arrangements (51%) were fourth and fifth, “suggesting that employers can improve retention with initiatives that do not have a significant expense-line impact,” the reports states.

 

Related Stories

 

 

Rutrell Yasin has more than 30 years of experience writing about the application of information technology in business and government. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3931
PUBLISHED: 2020-07-08
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.