The New York Times reports that a stunning statistic is reverberating in cybersecurity: Cybersecurity Ventures’ prediction that there will be 3.5 million unfilled cybersecurity jobs globally by 2021, up from one million positions in 2014.
The cyber employment figure has been corroborated by hundreds of media outlets, including the world’s largest, as well as industry associations, universities, governments, vendors, recruitment firms, and security experts, since our original report was published in May 2017.
Soon after our employment data was released, the World Economic Forum (WEF) republished an article with permission from Knowledge@Wharton, the online research and business analysis journal of the Wharton School of the University of Pennsylvania, which shared our report, and observed “nowhere is the workforce-skills gap more pronounced than in cybersecurity.”
Earlier this year, the Harvard Business Review shared our report, and summed up the plight: “The majority of chief information security officers around the world are worried about the cybersecurity skills gap, with 58 percent of CISOs believing the problem of not having an expert cyber staff will worsen.”
Cybersecurity Ventures arrived at our original estimation of unfilled positions after reviewing and synthesizing dozens of employment figures from the media, analysts, job boards, vendors, governments, and organizations globally. In 2019, we’ve conducted similar research, and we stand firmly behind the two-and-a-half-year-old prediction.
Over the eight-year period tracked, the number of unfilled cybersecurity jobs is expected to grow by 350 percent, from one million positions in 2013 to 3.5 million in 2021. And of the candidates who are applying for these positions, fewer than one in four are even qualified, according to the MIT Technology Review.
Despite industry-wide efforts to reduce the skills gap, the open cybersecurity headcount in 2021 will be enough to fill 50 NFL stadiums. A Forbes Technology Council post states that the number would be in the top 100 for the size of work populations of countries worldwide — not just industries.
Every IT position is also a cybersecurity position now. Every IT worker, every technology worker, needs to be involved with protecting and defending apps, data, devices, infrastructure, and people.
“It’s a full-on war for cybertalent” one industry veteran who specializes in recruiting and placing senior-level information security executives told the Los Angeles Times.
Robert Herjavec, founder and CEO at Herjavec Group, said, ”Unfortunately the pipeline of security talent isn’t where it needs to be to help curb the cybercrime epidemic. Until we can rectify the quality of education and training that our new cyber experts receive, we will continue to be outpaced by the Black Hats.”
“There is a zero-percent unemployment rate in cybersecurity and the opportunities in this field are endless,” added Herjavec. “Gone are the days of siloed IT and security teams. All IT professionals need to know security – full stop. Given the complexity of today’s interconnected world, we all have to work together to support the protection of the enterprise.”
Numerous pundits from industry associations and vendors have chimed in on the cybersecurity jobs dilemma, with adjustments to shortfalls in their previous estimates, which now align more closely with Cybersecurity Ventures’ steady forecast.
ISC(2), an international, nonprofit membership association for information security leaders, produced research in 2018 which estimated the cyber worker shortage at nearly 3 million — on the heels of a report they put out just a year earlier, which stated a drastically lower 1.8 million figure by 2022.
Members of the ISC(2) leadership team recently posted a blog on their website which states “the cybersecurity skills shortage is expected to result in 3.5 million unfilled positions by 2021” (according to Cybersecurity Ventures via Forbes) — which underscores ISC(2)’s alignment to our research.
“By Cybersecurity Ventures’ predictions, and we agree from everything we see, there will be 3.5 million unfilled cybersecurity jobs in the next couple of years worldwide,” said Mark Aiello, a cybersecurity recruiting expert and representative for the eastern Massachusetts chapter of ISC(2) at a recent cybersecurity conference held in Boston.
Our estimate has solidified as the de facto figure which the cybersecurity industry and the media relies upon for projected job openings.
WIRED highlights our jobs data in a recent story and concludes that despite looming threats of an ever smarter and technologically advanced hacking landscape, the security industry is not resourced to fight hackers or AI-powered exploits.
A Forbes Business Development Council post asserts that if you aren’t prioritizing hiring or training for IT security in 2019, then it’s time to rethink your company’s core priorities. If you agree, then read on…
The editors at Cybersecurity Ventures have compiled the most important facts, figures, statistics, and predictions to help frame the global cybersecurity labor shortage, and what is being done in an attempt to close the gap.
UNFILLED JOBS
No matter how you crunch the numbers, there’s a huge need for cybersecurity workers over the next decade.
Out of the 3.5 million open cybersecurity positions expected by 2021, Cybersecurity Ventures estimates more than 2 million openings will be in the Asia-Pac region, and nearly 400,000 will be in Europe.
The U.S. has a total employed cybersecurity workforce consisting of 715,000 people, and there are currently 314,000 unfilled positions, according to Cyber Seek, a project supported by the National Initiative for Cybersecurity Education (NICE), a program of the National Institute of Standards and Technology (NIST) in the U.S. Department of Commerce.
Members of the CNBC Tech Council put the number of U.S. technology job openings at 700,000 to 1 million over the past 12 to 24 months. Based on those figures, cybersecurity positions made up 32-45 percent of all U.S. tech job openings.
At the end of 2018, there were more than 26,000 openings for cybersecurity analysts in the U.S.
Cybersecurity isn’t alone in the labor crunch, although it’s one of the hardest hit STEM fields. Between 2017 and 2027, STEM jobs will grow 13 percent, compared to 9 percent for all other jobs. However, it was estimated that in 2018, 4 million STEM jobs in the U.S. went unfilled.
U.S. METROS
There are many new initiatives across the U.S. that are aimed at bolstering our nation’s future pipeline of cybersecurity candidates.
Government Technology recently reported that Massachusetts has more than 9,000 open cybersecurity jobs. The MassCyberCenter is looking to boost the state’s cyber resilience and economic growth and to partner with businesses, academia and the public sector to train new cybersecurity workers.
To develop the cyber workforce of the future, the New York City Economic Development Corporation (NYCEDC) launched Cyber NYC, which is supposed to catalyze 10,000 cyber jobs, help fuel new startups, and protect the city’s anchor employers. The project is among the nation’s most ambitious cybersecurity initiatives, which over the next decade could transform New York City into a global leader of cybersecurity innovation and job creation.
The New York metro area (NY-NJ-CT) has the second-largest absolute number of cybersecurity job openings – roughly 20,000.
Employers in the Philadelphia area struggled to fill more than 10,000 open roles requiring cybersecurity skills last year. In Philadelphia, the biggest skill shortages fall within the following areas: security analysis and investigation, application security, and cloud computing security.
The population of cyber engineers and analysts throughout the Washington D.C. Beltway is 3.5 times as big as the rest of the U.S. combined.
With more than 150,000 cyber-related engineering and data science professionals, Maryland has the number one cyber workforce in the world, and leads the U.S. in cyber employment for classified nation-state jobs. Maryland also has the largest concentration of university-trained cyber engineering graduates in the world.
There are currently over 15,000 open cybersecurity jobs in Maryland — and that number is growing by the day, according to the Maryland Chamber of Commerce.
The Northern Virginia Technology Council noted that employers in the region are struggling to find candidates who have both the technical and soft skill competencies they need. Employers cite soft skills deficiencies as their primary pain point outside of the obvious shortage of qualified candidates.
The top five states for cybersecurity jobs are Virginia, Texas, Colorado, New York and North Carolina — where average annual salaries for cybersecurity roles exceed $100,000, according to DarkReading’s analysis of a recent report.
- The Georgia Cyber Center, a $100 million facility, the country’s largest cyber investment of its kind by a state government, is intended to train the IT security workforce of the future.
- The University System of Georgia signed an agreement with the U.S. Army Cyber Center that will allow active duty and reserve military members to work toward a degree in cyber fields at several of Georgia’s universities during their service. The Army intends for the program to help fill over 11,000 open cyber jobs in the state, both inside and outside the armed forces.
- The Cyber Innovation Center in Bossier City, Louisiana, which has new Homeland Security funding, expects to broaden its cyber skills preparation to 10 million students and 50,000 teachers in K-12 across the U.S — which should eventually bolster the pipeline of young cyber workers.
- Tech employment in Chicago grew by nearly 6,000 jobs last year, and cybersecurity analyst is one of the top 3 tech positions in the windy city.
- San Antonio is home to the nation’s second-largest concentration of cybersecurity experts. With a pipeline of cybersecurity talent from San Antonio’s K-12, up through top higher education programs and advanced military backgrounds, the city, a.k.a. Cyber City, USA, is preparing for jobs employers need to fill today and in the future.
- Texas has the most cybersecurity growth potential in the U.S., according to Business Facilities’ 15th Annual Rankings Report.
- Arizona, which the Federal Trade Commission ranked as one of the top 10 in cybersecurity, has roughly 7,000 cybersecurity job openings.
- San Diego, home to the U.S. Space and Naval Warfare Systems Command (SPAWAR), and home to more than 150 cybersecurity companies, has around 8,450 cybersecurity jobs, which is up by 11 percent from three years ago, according to the region’s Cyber Center of Excellence.
- California has 50 companies (33 percent) named on Cybersecurity Ventures’ Hot 150 Cybersecurity Companies To Watch In 2020 list, the bulk of whom are located in or in close proximity to Silicon Valley. These plus hundreds of others in this region have created an extraordinarily competitive market for sales, marketing, and engineering talent.
INTERNATIONAL
Help Wanted: Cybersecurity experience preferred. This is the consistent theme across regions globally.
India — by far — had the largest growth in cybersecurity job openings from 2017 to 2018, followed by Sweden, Ireland, Italy and the UK.
The National Association of Software and Services Companies (NASSCOM) estimates that India — a country with a population of approximately 1.34 billion people — alone will need 1 million cybersecurity professionals by 2020 to meet the demands of its rapidly growing economy.
Skill shortages in Europe are damaging the growth prospects of companies and the continent’s economy, according to an EY survey. The most alarming talent shortages are in digital skills, with cybersecurity (48 percent) identified as one of the scarcest skills.
A recent parliamentary inquiry found the cybersecurity worker shortage is “verging on a crisis” in the UK. The joint committee on the national security strategy’s review found even the National Cyber Security Centre (NCSC), the government body charged with providing cybersecurity advice and support, faces a constant challenge to recruit the expertise it needs.
Ireland’s skills gap continues to increase, particularly in the area of cybersecurity, where there’s growing demand for roles year on year. The country is unable to keep up with its 18 percent increase in the demand for cybersecurity roles.
Israel, the world’s no. 2 exporter of cyber technology and one of the top 10 global cybersecurity hubs for 2019, is experiencing a worker shortage that is the most significant problem the sector is facing today. This shortage is causing local salaries to surge and is pushing firms to seek workers abroad, according to a recent report by Start-Up Nation Central and the Israel Innovation Authority.
A report coming out of Australia found that 88 percent of IT decision-makers believe there is a shortage of cybersecurity skills within their own organization, but also nationally.
To address its cyber skills shortage in South Africa, Absa has collaborated with the Maharishi Institute (MI) to set up a Cybersecurity Academy. The program is aimed at empowering marginalized youth, who would otherwise not have had access to tertiary education. The learners who participate become certified cybersecurity analysts.
Nigeria has a chronic shortage of cybersecurity workers. With an estimated population close to 200 million, the number of certified cybersecurity professionals in Nigeria was a mere 1,800 as of last year. Microsoft has called for safer online community in Nigeria for improved economic growth.
Research from Deloitte shows a lack of talent is being felt across corporate Canada. Critical roles are going unfilled, and it’s expected that organizations across Canada will need to fill an estimated 8,000 additional cybersecurity positions by 2021.
To help grow a security-trained workforce, the Cisco Networking Academy has partnered with 1,550 academies and 3,800 instructors to provide cybersecurity training across Latin America. As of last year, some 1.6 million had already completed the coursework.
TRENDS
If there’s one trend that everyone can agree on, it’s that cybersecurity is a fast-growing market with tremendous career opportunities.
The cybersecurity unemployment rate is at zero percent in 2019, where it’s been since 2011.
Cybersecurity Ventures forecasts that 100 percent of large corporations (Fortune 500, Global 2000) globally will have a CISO or equivalent position by 2021 (up from 70 percent in 2018), although many of them will be unfilled due to a lack of experienced candidates.
The U.S. Bureau of Labor and Statistics projects that employment for information security analysts will grow at 32 percent between 2018 and 2028, which is higher than the average for all other occupations.
Readers Digest named cybersecurity project managers and blockchain developers on its list of the 21 most in-demand jobs for 2020.
Jobs requesting public cloud security skills remain open 79 days on average — longer than almost any other IT skills, according to Cyber Seek.
A Forbes HR Council post observes that 74 percent of companies recently surveyed said that the skills shortage is impacting their business, including the ability to keep their information secure.
Tech executives on the CNBC Technology Executive Council said it has become harder to fill IT and cybersecurity positions, so candidates with liberal arts degrees, or no college degree, are now being hired.
CISSPs (Certified Information Systems Security Professionals) rank sixth out of the top 20 fastest-growing skills for freelancers.
According to a DarkReading report published last year, only 14 percent of IT security managers felt there were enough cybersecurity professionals in the field with the needed skills to hunt down and respond to threats.
The cybersecurity labor shortage is felt most acutely in the government workforce. Federal agencies, such as the Department of Defense — which houses both the National Security Agency and the U.S. Cyber Command — have a hard time competing with the private sector for top cyber talent.
One of the 5 biggest trends in the job market is a rise in cybercrime, which is spurring growth in security skills, according to CNBC.
Debby Carreau, CEO & founder of Inspired HR and a member of the CNBC-YPO Chief Executive Network, lists cybersecurity as one of five hot industries that are a safe bet for a career that’s future-proof.
Retention is a major issue for employers. According to a McAfee survey of 950 cybersecurity managers and professionals at organizations with 500 or more employees in the U.S., U.K., Germany, France, Singapore, Australia, and Japan, a full 89 percent of respondents would consider leaving their roles if offered the right type of incentive.
For more read: https://cybersecurityventures.com/jobs/