the it security director manager: balancing the strategic and ......nnthe most commonly cited hard...

16
The IT Security Director/Manager: Balancing the Strategic and the Tactical REPORT Understanding the Cybersecurity Skills Shortage An Analysis of Employer and Jobseeker Skills and Occupational Demographics

Upload: others

Post on 07-Aug-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

The IT Security Director/Manager: Balancing the Strategic and the Tactical

REPORT

Understanding the Cybersecurity Skills ShortageAn Analysis of Employer and Jobseeker Skills and Occupational Demographics

Page 2: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

2

Table of Contents

Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

What Skills Matter to Employers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Top Skills—Hard, Soft, and in Aggregate . . . . . . . . . . . . . . . . . . . . . . . . 4

Soft Skills Quadrants for Employers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Examining the Candidate: IT Security Director/Manager Resumes . . . . . . . . 7

Top Skills—Hard, Soft, and in Aggregate . . . . . . . . . . . . . . . . . . . . . . . . 7

Soft Skills Quadrants for IT Security Director/Manager Jobseekers . . . . 9

Analyzing the Gaps Between Employers and IT Security Director/Manager Jobseekers . . . . . . . . . . . . . . . . . . . . . . . 10

Hard Skills Deviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Soft Skills Deviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Education and Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Career Tenure and Job-Hopping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Gender Gap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Concluding Thoughts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Page 3: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

3

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Executive SummaryThis report is a part of a series that provides a snapshot of various IT and cybersecurity occupations using natural language processing (NLP).1 This particular study examines the role of IT security director or manager from the perspective of both employers and jobseekers. Findings show that the IT security director/manager is seen as skilled in both tactics and strategy—a seasoned technologist who can see the big picture.

Core takeaways from the analysis include:

Employers

nn Employers mention a balanced variety of hard and soft skills in job ads for head of network engineering and operations, with eight of the 20 most cited skills identified as soft skills.

nn Hard skills referenced in job ads are balanced between the strategic (such as compliance and risk management) and the tactical (such as implementation and maintenance).

nn Employers include soft skills in the Analytical and Personal Characteristics Quadrants more frequently than the other two quadrants. Analytical skills are necessary for the technical nature of the role, and the Personal Characteristics suggest a well-rounded professional.

nn However, two soft skills in the other two quadrants rank in the top four: Leadership and Collaboration. This, along with the other hard and soft skills emphasized, suggests that employers are seeking a well-rounded professional with the skills of a technologist.

Jobseekers

nn Resumes for candidates seeking IT security director and managerial roles cite 10 more hard skills on average than are found in job listings, but underrepresent soft skills by about 25%.

nn Only two of the 20 most cited skills on candidates’ resumes are soft skills, and neither ranks in the top 10.

nn The most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with different parts of an enterprise network.

nn Overall, resumes for IT security directors/managers suggest that they see themselves primarily as tacticians and service providers.

Comparison of Employers vs. Jobseekers

nn All of the 20 most overemphasized skills on resumes for IT security director/manager candidates are hard skills, and all of them are tactical in nature.

nn Jobseekers mostly underemphasize soft skills in every quadrant, but a handful of exceptions suggests semantic differences between resumes and job ads.

About This Series

This report series is based on an analysis of thousands of job ads and resumes using natural language processing (NLP) to highlight skill-set gaps (including hard and soft skills), educational attainment and certifications, average career tenure, and gender breakdown. The result is actionable insights for executives and board members that can help them hone their recruiting approach and hire the most qualified candidates.

IT security director/manager roles are becoming more complex as the attack surface grows and threat actors gain sophistication. They are also in high demand, as the cybersecurity skills shortage has resulted in many security teams being understaffed. As the attack surface grows, they will be called upon to help with cybersecurity strategy—reducing complexity, eliminating silos, and making security operations more efficient.

Page 4: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

4

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Demographics

nn Employers and IT security director/manager jobseekers tend to agree on educational attainment, with resumes and job listings averaging very close to one degree. However, the average jobseeker exceeds employers’ requirements on the number of certifications.

nn Jobseekers typically had two jobs in the past five years, and average job tenure stands at six years. This reflects a lower rate of job-hopping than with the majority of occupations studied for this series. The typical resume reflects a 22-year length of career to date, indicating candidates who are at mid-career.

nn 11% of the resumes we studied belong to women. There seems to be a definitive gender bias, with job postings reflecting 50% more male-oriented terms than female-oriented ones.

This report examines the role of the IT security director/manager. Typically, the IT security director/manager reports to the CIO, CTO, or to the VP of IT Infrastructure and Operations and assumes many of the functions of the CISO, but not in a senior leadership role and with diminished resources. As a mid-level position, the IT security director/manager usually supervises a team of security administrators and specialists.3

Our research identified hundreds of distinct skills in the resumes and job listings we analyzed for such positions. The median job listing included 32 unique skills, while the average resume referenced 40 unique skills. The middle 50% of resumes included as many as 60 unique skills, and the upper quadrant included resumes with as many as 90 skills.

What Skills Matter to EmployersBesides information security—naturally found on 100% of resumes for the position—compliance was the most commonly cited skill in job ads, appearing in three-quarters of job listings. Two other skills appeared on more than two-thirds of job ads: leadership and procedure management (Figure 1). These strategic skills are important for a people manager who must ensure that all team members are following proper processes to protect the organization.

Top Skills—Hard, Soft, and in Aggregate

Besides compliance and procedure management, three other hard skills were cited on 55% or more of job listings: standards, risk management, and design. These skills make sense for an IT security director/manager. Security best practices are based on various standards, and the team manager needs to understand them. The IT security director/manager is best managed as a part of an organization’s overall risk management portfolio. And someone in this position can potentially play a part in the design of an organization’s security architecture. As the costs and risks brought by cybersecurity increase, employers are looking for strategic skills in prioritizing security initiatives according to business goals and risk tolerance.

In addition to leadership, three other soft skills are cited on more than half of job listings: assessment, analytics, and collaboration. Such skills are essential for a mid-level leadership position that directs individual contributors and also serves on a team of peers.

The skills most commonly cited by employers paint a picture of someone equally comfortable and effective in the strategic realm and the tactical one, who can lead a team through transitions as an organization becomes more holistic and strategic in its approach to security.

“Cyber professionals face a harsh reality: Threats outpace security capabilities, security capabilities

outpace regulations, threats that lead to breaches and court

battles are increasing.”2

Page 5: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

5

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Rank Top Hard and Soft Skills Combined Top Hard Skills Top Soft Skills

1 Information Security (100%) Information Security (100%) Leadership (68%)

2 Compliance (75%) Compliance (75%) Assessment (65%)

3 Leadership (68%) Procedure Management (68%) Analytics (63%)

4 Procedure Management (68%) Standards (63%) Collaboration (55%)

5 Assessment (65%) Risk Management (60%) Recommendation (45%)

6 Analytical (63%) Design (55%) Confidence (35%)

7 Standards (63%) Implementation (40%) Integrity (35%)

8 Risk Management (60%) Incident Response (38%) Interpersonal Skills (35%)

9 Collaboration (55%) Security Policies (38%) Drive (33%)

10 Design (55%) Training (38%) Overseeing (33%)

11 Recommendation (45%) Maintenance (35%) Planning (33%)

12 Implementation (40%) Services (35%) Professionalism (33%)

13 Incident Response (38%) Best Practices (33%) Complexity (30%)

14 Security Policies (38%) Security Awareness (33%) Evaluation (30%)

15 Training (38%) Project Management (30%) Writing (30%)

16 Confidence (35%) Reporting (30%) Problem Solving (28%)

17 Integrity (35%) Security Architecture (30%) Consultation (25%)

18 Interpersonal Skills (35%) Security Controls (30%) Partnership (25%)

19 Maintenance (35%) Detection (25%) Scheduling (25%)

20 Services (35%) Disaster Recovery (23%) Working Independently (25%)

Figure 1: Top 20 hard and soft skills for employers.

Page 6: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

6

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Soft Skills Quadrants for Employers

Soft skills account for four of the 10 skills most cited by employers, and eight of the top 20. When soft skills are divided into four quadrants, the Analytical and Personal Characteristics Quadrants are most commonly cited. In fact, more Personal Characteristics Quadrant skills are listed on IT security director/manager job listings than any other job title we surveyed, and IT security director/manager job ads rank number two for Analytical skills. The average job ads cite 3.8 Personal Characteristics, and half of job listings mentioned five or more (Figure 2). There were 3.3 Analytical skills per job ad on average.

These emphases are appropriate for a position that touches both the strategic and the technical. Personal traits like confidence, drive, and professionalism are critical for such a position. Likewise, analytical skills like assessment, dealing with complexity, and problem solving are important as well.

Analytical

Personal Characteristics

Leadership

Communications/Interpersonal

Figure 2: Job ad soft skills quadrant matrix.

3.3

3.8

2.4

2.8

93%

80%

90%

85%

Average Skills Per Job Ad

Average Skills Per Job Ad

Average Skills Per Job Ad

Average Skills Per Job Ad

Occurrence in Job Ads

Occurrence in Job Ads

Occurrence in Job Ads

Occurrence in Job Ads

0-2

5+

0-2

0-2

3

0-1

3

3-4

4+

2-4

4+

5+

Number of skills in job ads

Number of skills in job ads

Number of skills in job ads

Number of skills in job ads

Page 7: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

7

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

While Analytical and Personal Characteristics are more frequently found in the top 20, leadership (obviously in the Leadership Quadrant) is the most cited soft skill and collaboration (in the Interpersonal Quadrant) comes in at number four. Overall, the soft skills cited by employers reflect a well-rounded professional who can do both technical and leadership tasks.

The top 10 soft skills are distributed across the quadrants quite evenly by employers:

nn 3 in Analytical (assessment, analytics, recommendation)

nn 3 in Personal Characteristics (confidence, integrity, drive)

nn 2 in Leadership (leadership, overseeing)

nn 2 in Interpersonal/Communications (collaboration, interpersonal)

The next 10 soft skills fall into exactly the same quadrant distribution, resulting in the same proportion among quadrants for the top 20. This distribution is typical for mid-level management positions we surveyed.

Skills in the Personal Characteristics Quadrant are most commonly cited overall and represent six of the top 20 skills cited. However, the most cited skills from that quadrant (confidence and integrity) are cited by just 35% of employers—tied for the sixth position. Analytical skills, on the other hand, cover three of the top five soft skills cited. There seems to be less agreement across employers on which specific Personal Characteristics to emphasize, but most agree that they are important.

Analytical soft skills are cited in 93% of job ads—more than any other quadrant, and the average number of skills from that quadrant is nearly as high as with Personal Characteristics. For mid-level management positions, tactical skills are still necessary. In cybersecurity, those tactics involve analytical work.

Examining the Candidate: IT Security Director/Manager ResumesWhile employers’ job listings are quite balanced between hard and soft skills, jobseekers place heavy emphasis on hard skills. In fact, only two soft skills rank among the top 20 skills most cited on resumes—assessment (59%) and analytics (52%), both in the Analytical Quadrant. Neither of these soft skills is among the top 10 skills on resumes (Figure 3). Applicants’ heavy emphasis on hard skills and analytical soft skills is not surprising given the likelihood that they come from computer science or engineering backgrounds.

Top Skills—Hard, Soft, and in Aggregate

Six hard skills were cited on more than two-thirds of resumes, and these could be seen as a mix of strategic and tactical. Compliance, design, and procedure management are more strategic, while implementation, software, and servers read as more tactical. This balance fits well with positions at this level. As one moves down the list, the skills cited tend to be more technical—as with maintenance, documentation, hardware, installation, and Windows.

As is the case with employers, compliance is by far the most cited skill by jobseekers, found on 77% of IT security director/manager resumes. As regulations proliferate across different jurisdictions,4 and companies look to industry standards such as the National Institute of Standards and Technology (NIST) as a way to manage risk, employers and jobseekers agree on the importance of compliance. On a related note, another strategic skill, cited on 48% of resumes, is risk management.

77% of IT security directors/managers list compliance as a hard skill on their resumes, followed by implementation (71%), design (69%), and procedure management (69%).

Page 8: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

8

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Rank Top Hard and Soft Skills Combined Top Hard Skills Top Soft Skills

1 Compliance (77%) Compliance (77%) Assessment (59%)

2 Implementation (71%) Implementation (71%) Analytical (52%)

3 Design (69%) Design (69%) Leadership (45%)

4 Procedure Management (69%) Procedure Management (69%) Recommendation (43%)

5 Software (68%) Software (68%) Planning (41%)

6 Servers (67%) Servers (67%) Vision (41%)

7 Information Security (64%) Information Security (64%) Communications (37%)

8 Network Operations Center (61%) Network Operations Center (61%) Evaluation (35%)

9 Maintenance (60%) Maintenance (60%) Consultation (31%)

10 Training (60%) Training (60%) Initiative (27%)

11 Assessment (59%) Documentation (53%) Liaison (27%)

12 Documentation (53%) Testing (53%) Mentor (27%)

13 Testing (53%) Services (52%) Collaboration (24%)

14 Analytical (52%) Standards (52%) Integrity (24%)

15 Services (52%) Hardware (51%) Scheduling (24%)

16 Standards (52%) Installation (51%) Professional (23%)

17 Hardware (51%) Risk Management (48%) Crisis Management (19%)

18 Installation (51%) Windows (47%) Research (19%)

19 Risk Management (48%) Database (42%) Overseeing (17%)

20 Windows (47%) Networks (42%) Strategizing (17%)

Figure 3: Top hard and soft skills for IT security director/manager jobseekers.

Page 9: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

9

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Soft Skills Quadrants for IT Security Director/Manager Jobseekers

Despite the predominance of hard skills, jobseekers for IT security director/manager positions do list some soft skills on their resumes. The median resume mentioned three unique skills in the Analytical Quadrant, two each in the Leadership and Personal Characteristics Quadrants, and one in the Interpersonal Quadrant. These numbers are typical for the mid-level management roles we surveyed—and higher than for both the individual contributor and leadership roles we surveyed. Nevertheless, the number of soft skills is small compared with the dozens of total skills listed in resumes for this role.

While Analytical skills are most commonly cited on resumes, a subset of resumes we examined placed heavy emphasis on Leadership Quadrant skills (Figure 4). Specifically, one-quarter of resumes cited seven or more skills in that category, although the average resume barely cited two. It is possible that these applicants are emphasizing these skills in hopes of relatively rapid career growth into higher job grades. Interpersonal Quadrant skills were the least cited, with an average of 1.7 skills per resume and three-quarters of resumes citing three or fewer skills from this quadrant.

Analytical

Personal Characteristics

Leadership

Communications/Interpersonal

2.9

2.4

2.1

1.7

92%

80%

92%

83%

Average Skills Per Resume

Average Skills Per Resume

Average Skills Per Resume

Average Skills Per Resume

Occurrence in Resumes

Occurrence in Resumes

Occurrence in Resumes

Occurrence in Resumes

0-1

0-1

1-2

0-1

2-3

2

7+

2-3

4+

3+

3-6

4+

Number of skills in resumes

Number of skills in resumes

Number of skills in resumes

Number of skills in resumes

Figure 4: Resume soft skills quadrant matrix.

Page 10: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

10

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Analyzing the Gaps Between Employers and JobseekersWhile many of the occupations we surveyed for this series had more unique skills in job ads than in resumes, the opposite is true here (Figure 5). Job candidates, on average, cite 10 more skills overall than employers. However, as we have shown, IT security director/manager applicants cite far fewer soft skills than hiring managers.

The result is a massive overemphasis on hard skills on the part of jobseekers, with the average jobseeker listing nearly 26 hard skills and employers citing only 22. And among hard skills, applicants heavily overemphasize skills on the tactical side while hiring managers have more of a balance between strategic and tactical skills. Again, this is likely explained by the highly technical background from which most of these jobseekers come.

Figure 5: Average number of skills per job ad and resume.

for Employers Per Job Ad

for Employers Per Job Ad

for Employers Per Job Ad

for Jobseekers Per Resume

for Jobseekers Per Resume

for Jobseekers Per Resume

34 22 12

45 36 9

Total Unique Skills Hard Skills Soft Skills

Page 11: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

11

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Hard Skills Deviations

One immediate takeaway of our analysis is that IT security director/manager jobseekers overemphasize their technical hard skills to a great degree compared with the job ads to which they respond. The following skills were all cited by at least 30% more jobseekers than employers: servers, software, installation, Windows, hardware, networks, documentation, testing, and implementation (Figure 6). These skills are related to tactical processes and experience with different parts of an IT infrastructure. The trend continues across the top 20, with all the hard skills overemphasized by applicants being less holistic in nature.

Soft Skills Deviations

A look at the top requested skills missing on applicants’ resumes yields an almost opposite result, with soft skills occupying almost all the top 20 positions. Interpersonal skills, collaboration, writing, leadership, and confidence were all underemphasized by applicants, as compared to employers, by at least 20 percentage points.

However, there are a handful of soft skills that were overemphasized by jobseekers, and these become clearer when the soft skills are divided by quadrant. In the Analytical Quadrant, as compared to job ads, jobseekers underemphasize the skill of dealing with complexity by 14%, while overciting business process by 13.5%. The two skills are not unrelated, and applicants might do well to adjust the wording in their resumes and call out examples where they exercised these skills to achieve successful outcomes. Other underemphasized Analytical Quadrant skills by jobseekers include problem solving, analytics, and assessment.

A similar phenomenon occurs in the Leadership Quadrant. Applicants overuse vision by nearly 19 percentage points, but underemphasize leadership by more than 22. Again, these skills are related but refer to different aspects of program and people management.5 It is possible that hiring managers are looking more for day-to-day management skills while IT security director/manager applicants want to emphasize their forward-looking innovation. Partnership, overseeing, and coaching are other leadership skills missing on many candidates’ resumes.

With the Personal Characteristics Quadrant, jobseekers tend not to mention skills like confidence, drive, time management, and working independently—while tending to overemphasize their organizational skills. And in the Interpersonal Quadrant, interpersonal, collaboration, and writing skills are underused by more than 20 points, while the more generic skill of communication is overemphasized by job candidates by 17 points. The fact that applicants use more generic skills descriptions in these quadrants may again reflect their technical background. IT security directors/managers sense that they should list these types of skills but have more trouble articulating them at a more detailed level.

IT security directors/managers list 32% more skills on their resumes compared to the number of skills employers include in their job ads.

Soft skills are underrepresented in IT security director/manager resumes. Despite listing almost one-third more total skills on their resumes, IT security directors/managers list one-third

fewer soft skills on their resumes than employers include in their job ads.

Page 12: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

12

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Skills Cited by Employers More Often Skills Cited by Jobseekers More Often

Information Security (36%) Server (54%)

Interpersonal Skills (35%) Software (53%)

Collaboration (31%) Installation (46%)

Writing (23%) Windows (42%)

Leadership (22%) Hardware (41%)

Confidence (20%) Networks (31%)

Partnership (18%) Implementation (31%)

Drive (18%) Testing (31%)

Time Management (16%) Documentation (31%)

Best Practices (15%) Accreditation (30%)

Overseeing (15%) Cisco (27%)

Track Record (15%) Troubleshooting (27%)

Working Independently (14%) Deployment (26%)

Complexity (14%) Information Assurance (25%)

Security Awareness (14%) Maintenance (25%)

Verbal Communication (14%) Linux (24%)

Data Protection (13%) LAN (23%)

Problem Solving (13%) Training (23%)

Team Orientation (12%) Database (21%)

Risk Management (12%) Routers (19%)

Figure 6: Percent difference in top 20 skills listed by employers and IT security director/manager jobseekers.

Page 13: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

13

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Education and CertificationOur analysis of job ads shows that employers and IT security director/manager candidates are in close alignment when it comes to formal education: employers request approximately one college degree on average, and the average jobseeker has a single degree as well. This is typical for manager-level positions and candidates seeking them, but differs from the more senior-level positions we analyzed in other studies.

In terms of certifications, IT security director/manager jobseekers tend to exceed employers’ requirements somewhat, with the average resume listing 3.6 certifications and the average job ad requesting just under three. Of course, in some settings, which certifications are earned is more important than the number attained. Since a resume posted on a job board is not tailored to a specific job listing, the incentive is to list everything in order to appeal to varying requirements. Conversely, employers only list certifications relevant to the position they are hiring.

Career Tenure and Job-HoppingApplicants for IT security director/manager roles started their careers an average of 22 years ago, when IT security was just emerging as something organizations should heed. Jobseekers we analyzed had an average of 1.5 jobs in the past two years, but only 1.9 jobs in the past five years. When these numbers are compared to other network and network security professions in this report series, we discover that IT security directors/managers have a slightly longer job tenure than average—especially over a five-year time frame. And while this is the case, our data—as with the other professions in our report series—indicates job-hopping is becoming worse (when comparing the past two years versus a five-year window).

The data is mixed as to whether job-hopping is getting worse in the overall economy,6 and there is some evidence that the problem decreases with age and tenure (something proven out by the analysis in this report series).7 But job-hopping is undoubtedly costly to companies when it does happen, and the cybersecurity skills shortage makes it relatively easy for IT security directors/managers to move if they are not satisfied in their current position.

Figure 7: Job tenure in IT security director/manager resumes.

Average years since first job

Number of jobs in past 2 years

Number of jobs in past 5 years

Number of total jobs on resume

22.3

1.5

1.9

5.6

Job-hopping for IT security directors/managers appears to be getting worse, with the average number of jobs held over the past two years at 1.5 compared to 1.9 over the past five years.

Page 14: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

14

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

Figure 8: Gender-oriented language in IT security director/manager job ads.

Gender GapThe gender gap in technology—and in cybersecurity in particular—is a cause of widespread concern.8 This is unfortunate, because women as a group tend to excel at many of the soft skills that are now recognized as crucial in the field.9

Approximately 10.7% of the resumes we randomly selected and analyzed for IT security director/manager positions belonged to women—a higher percentage than with most of the occupations we analyzed for this series. As a group, the women’s resumes in our sample tended to include significantly more soft skills in the Analytical Quadrant, while their male counterparts cited considerably more skills from the Personal Characteristics Quadrant.

As they write new job listings for IT security directors/managers, hiring managers will do well to include more female-oriented terms such as “collaborate” and “mentor” alongside male-oriented terms such as “strong” and “leader.” And jobseekers can portray themselves as balanced and sensitive to diversity by including both male-oriented and female-oriented terms on their resumes.

Concluding ThoughtsLife has probably never been more complex for professionals in IT security director/manager positions. Threats are becoming more advanced, the attack surface is growing, and enterprise networks are broadening into multiple clouds and out to myriad Internet-of-Things (IoT) devices. Companies hiring this position will do well to seek candidates who are comfortable in both the strategic and the tactical realms and possess a balance of hard and soft skills. Jobseekers will do well to emphasize their strategic and interpersonal skills along with their technological experience.

In the current environment, the IT security director/manager will not be successful without a broad, integrated, and automated security infrastructure. The Fortinet Security Fabric enables security teams to focus on proactive threat prevention rather than reactive remediation. For more information on the Fortinet Security Fabric, check out the white paper, “Fortinet Security Fabric Powers Digital Transformation.”10

Male-Gendered Terms Per Job Ad

Female-Gendered Terms Per Job Ad

7.8 4.9

Page 15: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

15

REPORT | The IT Security Director/Manager: Balancing the Strategic and the Tactical

References

1 “The CISO Ascends from Technologist to Strategic Business Enabler,” Understanding the Cybersecurity Skills Shortage: An Analysis of Employer and Jobseeker Skills and Occupational Demographics, Fortinet, August 3, 2018.

2 “Cyber Security Challenges, Focuses for 2019,” Cyber Security Hub, accessed April 14, 2019.

3 “Information Security Manager Roles and Responsibilities,” InfoSec Institute, accessed May 8, 2019.

4 E.g., Cynthia Brumfield, “The cybersecurity legislation agenda: 5 areas to watch,” CSO, February 21, 2019.

5 Ron Ashkenas and Brook Manville, “The Fundamentals of Leadership Still Haven’t Changed,” Harvard Business Review, November 7, 2018.

6 David Weedmark, “Job Tenure and the Myth of Job Hopping,” The Balance Careers, March 4, 2019.

7 “2018 Job Hopping Report: An Analysis of Job Ads & Resumes,” LiveCareer, accessed October 17, 2018.

8 Gillian Tans, “Why it’s vital we close the tech gender gap,” World Economic Forum, January 19, 2018.

9 “Your Career in Cybersecurity and How Soft Skills Can Boost Your Salary,” Careers in Cybersecurity, accessed May 8, 2019.

10 “Fortinet Security Fabric Powers Digital Transformation,” Fortinet, March 29, 2019.

Page 16: The IT Security Director Manager: Balancing the Strategic and ......nnThe most commonly cited hard skills are very tactical in nature, depicting technical tasks and experience with

Copyright © 2019 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.

www.fortinet.com

June 19, 2019 9:00 PM

D:\Fortinet\Work\2019\June\061920\report-cybersecurity-skills-shortage411541-0-0-EN