Recruiting in cybersecurity is increasingly challenging, with 4 million jobs currently unfilled – a 13% rise from 2022 (ISC2 2023). As studies over the past three years have confirms, this challenge is only deepening, leaving CISOs struggling to recruit, manage, and retain skilled professionals. Diversifying the talent pool is also a priority, with women making up only 25% of the workforce.

At Wavestone, we’ve been actively following this subject and have developed a benchmark to assess companies’ maturity level on this subject. With data from more than 20 organizations, we’re ready to share our insights.

In this article, we’ll dive into the results and focus on key topics such as career path, recruitment, trainings, and retention plans. And for those who stick around till the end, there’s a little surprise waiting for you.

If you’re a CISO looking for practical solutions or just interested in cybersecurity talent management, this article is for you. Let’s tackle this challenge together.

A Global Maturity Score of 45% in Cyber Talent Management

Current Cyber Talent Management maturity stands at 45%, indicating significant room for improvement in this emerging field. The gap between the lowest and highest scores ranges from 27% to 62%.

On a positive note, there are strong performers in every area, suggesting that companies can benefit from sharing best practices. Ultimately, the goal is to build skilled and resilient cybersecurity teams.

The Energy sector has the highest maturity level, while Public & Institutions have the lowest. The graph above compares the maturity levels of various sectors on a scale from 0 to 100%. The sectors include Energy (58.2), Luxury & Retail (52.4), Services (50), Finance (45.9), Industry (47.2), and Public & Institutions (36.1).

Developing Career Path to Give Growth Perspectives to Talents

The cybersecurity field is facing a clear talent shortage. In 2023, 4 million cyber jobs were unfilled, and the figure is still increasing. Organizations have a real challenge to retain their cyber talents and to attract new ones. Yet a well-defined career path could help them. From an HR perspective, it empowers individuals to take charge of their own development, serves as a framework for self-assessing competencies and areas for growth, and supports individual fulfilment. However, building an effective career path requires careful planning and can take over a year to implement.

During our interviews with CISOs and Cyber Talent Managers, we observed that while 66% of the organizations have started initiatives to build their first cyber career path, these efforts are not yet fully materialized.

Real-world example based on a client assignment…

• In a client project, after several phases of reviews and workshops on cyber jobs and skills frameworks, we identified 11 new cyber skills and 6 cyber jobs and integrated them into the repositories. This then led to the creation of an initial career path dedicated to cybersecurity workforce.

A well-defined career path is the cornerstone of Talent Management and represents a strategic advantage for organizations in retaining and attracting talents, prompting many to take action.

Tips to Diversify Your Recruitment Pool

The cybersecurity talent pool is both limited and lacking in diversity, making recruitment a critical challenge for organizations. Despite women making up 50% of the global population, they represent only 25% of cyber professionals (ISC2 2023). This highlights the urgent need for more inclusive recruitment strategies.

Nowadays, traditional job descriptions often demand too much, deterring potential female candidates. Only 27% of the organizations have adapted them. Studies show men apply if they meet 60% of the criteria, while women tend to wait until they meet 100%. Rewriting descriptions to be more inclusive, with input from female reviewers, can broaden their appeal.

In addition, few companies focus on internal (5%) or external (22%) branding, yet these strategies work. Transparent branding and communication can help to demystify cybersecurity roles, attract a more diverse talent pool and boost internal mobility, making them valuable recruitment tools.

Offering Trainings to Reduce Skills Gaps Within Your Organization

Cybersecurity skills gaps are a major issue, with 92% of professionals reporting deficiencies and 75% finding the current landscape the most challenging ever (ISC2, 2023).

Our benchmark shows only 33% of companies have a skills-mapped training catalogue, and 94% address training reactively, based on demand. This reactive approach misses chances for proactive skills development. Effective training is crucial for equipping employees with the skills needed to handle evolving cybersecurity threats and trends.

Real-world example based on a client assignment…

• Automated Training Paths: implemented an automated tool that can generate personalized training paths based on employees’ needs and skills level.
• Consolidated Training Catalogue: a unified training catalogue, mapped to the 17 new cyber skills and 16 new cyber jobs, offering a clear development roadmap for employees.

Enhancing Retention Through Effective HR Collaboration

Collaborating closely with the HR team to create a robust retention plan is essential for organizational success. While many companies have processes to support talent development, these are often not formalized, leading to challenges in daily management.

Companies need to start by assessing the unique skills and strengths of each team member and determine how to best leverage them for the organization’s goals. Conducting individual interviews is a valuable strategy in this regard. Managers can gain insights into each employee’s current career stage and future aspirations. This information allows them to craft personalized development plans that align with their goals.

However, it’s important to remember that a retention plan is not a one-size-fits-all solution. It should be flexible and adaptable, capable to evolve with the changing needs of your team and the cybersecurity landscape. By working with HR to implement a tailored, adaptive plan, you ensure that your cyber talent feels valued, motivated, and committed. Remember, effective retention is as crucial as attracting top talent, so make strategic collaboration with HR a key component of your talent management strategy.

A²BCⁿ framework: A Framework to Care for your Talents and Secure your Business

In conclusion, caring for talent is essential to securing your business. The A²BCⁿ framework provides a structured approach to achieve this. By focusing on Assessing and Attracting talent, Building Trust with your talents, and Caring and Nurturing your team, this mixed approach, blending cybersecurity and HR strategies, ensures an effective and resilient team ready to meet tomorrow’s challenges.

Cet article Navigating The Cybersecurity Talent Management Maze: A Guide for Talent Management Enthusiasts est apparu en premier sur RiskInsight.

You may have seen the big headlines pointing out talent shortage issues in the latest news – that is sadly not a fake news. The talent war really exists in the cybersecurity market. Over the past months, we read numerous articles, academic papers, reports on this emerging subject; we discussed with CISO and Talent Managers (a real full-time job!) and the 3 main challenges remain the same: how to recruit, manage and nurture our talents?

In this article, we have compiled the different situations, our observations, and the initial lessons we can draw from the actions put in place to meet these challenges.

Take a moment to analyse the strengths and weaknesses of your team to identify the complementary skills and competencies you need to look for…

Beyond just filling the roles, it is essential to gain a strategic vision of the skills to draw up a sustained cyber division. Your mantra for this stage must be: “Getting the right people for today… and tomorrow!”.

When people’ skills match their roles, tasks are performed efficiently, with everyone contributing to a more (cyber)secure organization. I doubt anyone will contradict me here, but it’s often easier said than done.

Here are the first questions you can ask yourself to get moving in the right direction…

Do you know what you need? Have you defined all the cyber activities you need to run? Have you defined your “make or buy” (internalization vs outsourcing) strategy? Have you identified the skills and the people needed to run these activities?

This is a non-exhaustive list of questions that as an organisation you should ask yourself to better capture your need and know your people before launching a roadmap of actions.

Knowing your need and team is important as it: (1) helps for task allocation: before, cyber teams were smaller, therefore, versatility was crucial. Nowadays, bigger cyber teams make specialization possible and facilitate the optimization of complementary skills (2) helps to target training and development: having a clear vision on your team and its activities helps you identify skill gaps and provide the appropriate training and development opportunities to the people who need it the most. With the identified missing skills in one hand, and the identified needs in another hand, you can start seeking for your ideal candidates thanks to a job offer that speaks volumes (but don’t look for purple squirrels, they don’t exist)!

Keep an eye on the upcoming insights and focus on the cyber job descriptions topic!

Fueling Team Today, Attracting Tomorrow: The recipe for Sustained Cyber Teams

That is to concretely explain what cyber is and what its activities are. #transparency

Based on the discussions with CISO and Talent Managers, being transparent on the job description works and gives people a sense of belonging and purpose, which in turns promotes a better teamwork.

Let us share some concrete and easy actions that you can do to get things moving:

• Promote internally the cyber jobs and the people behind the jobs: by explaining concretely what working in cybersecurity means, what the positions available are, and what the people really do, you can inspire people to join your team, increase internal mobilities, strengthen the sense of belonging to the cyber division, and give perspective to your team.
• Promote externally your cybersecurity activities: make yourself visible by participating to cyber associations and key conferences (school events, collaborations with universities, research institutions, or organisations, etc.).
  • Organise/participate to upskilling/reskilling workshops (transferable skills).
• Include inspiring people in your recruitment process and branding (such as CISO, team lead, etc.

Cybersecurity is still an obscure topic for those outside the cyber world. To fix that, everyone needs to start explaining what they do.

Mastering the art of taking care of your people

By now, you must know that it’s a great asset to know who your team is, who your people are, who you really need to run the cyber activities, to have a great branding to attract people. But what will make the difference in the long run is to take good care of your people by offering a safe work environment and giving perspectives of evolution. When what is coming next is clear, it is easier for the people to project themselves in the company in the years to come.

And before taking care of their people, CISOs also need to take care of themselves. 40% of the CISOs say that they experience “high-stress” on a daily basis and 28% of them are close to burn-out (Cyber Workforce Study, ISC²). Tough to take care of people if you don’t take care of yourself first…

To avoid this, CISOs need to build a trusted relationship with their top management in order to be able to define the strategic objectives, prioritize the activities, obtain the resources, etc. And it is essential to know how to surround themselves with reliable individuals to delegate tasks and create an effective operational strategy.

Recruiting is just the beginning of the journey; nurturing is the ultimate goal. Nevertheless, organisations tend to forget (neglect) this last, but perhaps most important point. It’s like getting an ISO 27001 certification, quite easy (of course, it requires work!) but maintaining it, is the real deal.

In order to provide perspectives for team members, we need to establish career paths with their “pathways” and the means available to evolve on these paths: skills required per job and key milestones, training catalogue, internal mobilities, personalized evaluation process, etc.

Nurturing your talents means helping them to develop and strengthen their skills/capabilities through trainings, teamwork with colleagues or with cyber associations, giving them perspective of evolution/growth within your company. As a human-being, we need to know where we stand and where we are going, we need a vision to get us moving (in our life #existentialcrises).

If we take the example of the Maslow’s hierarchy of needs, people need to have a sense of belonging and feel that they are useful. Thus, part of nurturing talents also means creating a “team spirit” via rituals. It is not a secret that a friendly work environment/atmosphere is a crucial criterion when choosing a job and can increase people’ productivity by 12% (University of Warwick, UK), especially for young people nowadays.

Giving perspective of growth/evolution is essential, especially for experts. Many organizations still view management as the only path to success, but in certain sectors like industry, we can observe a shift. Expertise is increasingly valued as an alternative success route to management; some may combine both, but it is not a necessity. Therefore, expertise circles are key to give recognition to experts in and outside of their organisations – give them the opportunity to attend specific cyber events that can also enables them to grow their network and acquire more skills.

In a nutshell, attracting and nurturing talents take time, and talent recruitment emerges as a pivotal element in corporate strategies. By embracing diversity and promoting gender convergence, we venture into new dimensions to build robust, thoughtful, and resilient teams.

We aim to open the cyber field to those unfamiliar, fostering diversity, and creating vocations. Let’s reach out to people; and let’s not wait for them to come to us.

We have created a benchmark tool to explore this multi-faceted topic (along with the ongoing research) and assess organisation’s maturity. Reach out to us if you would like to be part of it! We would be very delighted to share with you the good ideas we have collected on the market… and the traps to avoid.

Unicorns (don’t misunderstand me, I am not talking about start-ups), Purple Squirrels, Ninja, Rockstars, don’t exist but if we combine diverse profiles, we can get this highly qualified team!

Cet article The Quest for Cybersecurity’s Purple Squirrels: How to Find and Keep Them est apparu en premier sur RiskInsight.