What are the biggest career trends in cyber security?
Cybersecurity continues to be a popular career choice and understandably so. According to analyst firm Frost & Sullivan, the level of unemployment in the sector lies at just 1% and demand will continue outstripping supply.
Job site Indeed saw an increase of almost 15% in cybersecurity postings in 2018 and this growing demand is, of course, driving up wages. According to Hays 2019 Salary and Recruiting Trends Guide, last year jobs in this sector saw a 3.2% salary increase in the UK, compared to the country's average of 1.9%.
The demand for cybersecurity experts is growing for a number of reasons. As companies digitise more of their activities the role of cybersecurity increases, but it's also down to more businesses responding to the rising number of high-profile cyber attacks.
A self-imposed supply shortage?
Interestingly, several of the major analyst firms believe that the supply problem is one that's been created by the companies themselves as much as the shortage of qualified candidates.
"Companies are issuing job requisitions that have unrealistic demands of experience and technical competence, and exclusively target those with computer science," says Paul McKay, senior analyst at Forrester.
"Some hiring managers have on blinders," agrees Jarad Carleton, Frost & Sullivan's global program leader for cybersecurity. "They want 'pedigree'; people with IT degrees. But they're beginning to see that their headcount shortage isn't going to go away unless they think outside of the box. There needs to be more flexibility in how they look at potential recruits and bring in people from more varied backgrounds."
The UK's top cyber employers
Indeed recently published its list of the UK's top 20 cyber employers, which put the "big four" management consultancies – KPMG, PwC, EY and Accenture – in the top spots. Financial firms, followed closely by technology-focused businesses, dominate the top ten, but experts agree that as time goes on, recruitment for cybersecurity experts will grow across all sectors as they recruit their own staff rather than turning to consultants.
"[The consultants] are guns for hire," says Carleton. "They'll come in, evaluate what's happening and put in a solution. Once it's up and running they dust themselves off and walk out the door. Businesses need to be able to keep themselves secure."
What are employers' most sought-after cyber skills?
According to Indeed, the most sought-after cyber roles can be very lucrative, with the top five paying a combined average of £45,851 a year versus the national average salary of £27,600. According to the results of its study, IT security specialist is the most in-demand role in the UK, with nearly three times as many vacancies as the role of security engineer, which took second place. Completing the top five were security consultant, an information security analyst and IT auditor.
"In discussions, I've had, auditing systems is something that's very sought-after," notes Cathy Mulligan, a visiting researcher at Imperial College Business School. "It's a key area because so many existing systems are coming under different types of threats. Attack vectors are expanding, and morphing, on a daily basis," she points out.
But as cybersecurity encompasses so many different areas, analyst firms and recruiters agree that demand for skills in almost all of these areas will continue to grow. For example, as many companies migrate to the cloud as part of their digital transformation, hands-on cloud security experience is increasingly sought after.
At Forrester, McKay has seen a lot of demand for incident response, security operations centre (SOC) analyst, and technical security analyst roles, as well as threat intelligence and vulnerability management at present. Over at Hays Digital Technology, director James Milligan says that cybersecurity analyst tops this year's most in-demand role with security analyst, security architect, cyber threat intelligence analyst and cyber incident analyst roles also being particularly sought after.
Milligan notes there's a shortage around application security as well and increasing demand for technical candidates "with an appreciation of the software development lifecycle (SDLC) and [who] in some cases come from a development background".
Experts also believe we'll see a significant increase in the requirements for security practitioners to be able to support organisations in dealing with regulations.
"In the UK we recently introduced the General Data Protection Regulation (GDPR) into the data privacy space and the EU Network Information Systems Directive (NISD)," says McKay. "These will continue to evolve and I expect the government to continue to take a more active role in working with companies in this fashion. Having professionals on board who know how to translate regulation into practical action to satisfy regulatory demands will become popular."
The UK's cybersecurity hubs
As for where to find work in cybersecurity, opportunities are popping up in cities all over the UK. In England, there are large hubs in London and across the southeast, including Cambridge, where you'll find a lot of start-ups.
Along the M4 corridor and down to Bristol, there are many opportunities for cybersecurity specialists, then there's Cheltenham – home of GCHQ – Manchester and Birmingham. In Scotland, Glasgow and Edinburgh have active cybersecurity communities due to many large international firms having bases in these cities.Kevin Curran, a professor of cybersecurity at Ulster University, also notes that Belfast has developed one of the strongest cybersecurity hubs in the UK.
"It's become home to a large cluster of international companies delivering global security products and services. Financial services firms including Allstate, CME and Citi have each invested in cybersecurity operations in Belfast and other major players such as PwC, Deloitte, Ernst & Young and BDO have all developed a range of cybersecurity solutions that are serviced from there," he notes.
As you can see, if you have the right skills, there's work available all across the UK. And with demand continuing to grow, employers will begin to consider a wider range of applicants, not just those who've followed a very rigid cybersecurity career path to date. This is a sector overflowing with opportunity, so if cybersecurity is a career that interests you, now's the time to get ahead.
Industry: Cyber Security
- SPLUNK SOC Analyst level 3, London.
SPLUNK SOC Analyst level 3, Must be able to commute to the City of London. Onsite role. Security clearance needed. The SPLUNK SOC Analyst level 3 must have current experience working within a SOC environment with specific experience using a range of tools and techniques to investigate security incidents. Current experience with Splunk is essential. any additional experience Individuals with Elastic Security SIEM are highly desirable. Any of the following certifications are desirable Splunk Phantom certified admin, Splunk Core Certified Power User / Advanced, Splunk Certified Enterprise Security Admin, etc The role will include, but not be limited to working with sophisticated information security tools, investigating security incidents, incident management, technical escalation, process improvement, research into the latest threats, reporting etc The individual MUST currently be living in the UK and be able to achieve UK security clearance. (SC) This is a permanent role To arrange a call with Chris Holt https://calendly.com/chris-holt/arranged-call-with-chris-holt-elastic-siem-engineer-soc Chris.Holt@dclsearch.com
- ISO 27001 & Business Continuity Security Specialist, End User
- United Kingdom
CH7828 ISO 27001 & Business Continuity Security Specialist, End User, £70,000 United Kingdom ISO 27001 & Business Continuity Security Specialist needed to join a Cyber team within an end user. The ISO 27001 & Business Continuity Security Specialist will have end to end responsibility for the information security and Business Continuity management system. ISMS/BCMS. Both from an information security and technical security perspective working alongside the CISO. Experience must include, but not be limited to; a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, very occasional travel to London office This is an exclusive role to DCL Search & Selection. Looking to interview immediately. https://calendly.com/chris-holt/iso-27001-business-continuity-security-specialis
- PCI- DSS Security Consultant, End User
PCI- DSS Security Consultant needed to join a Cyber team within an end user. The PCI- DSS Security Consultant will have end to end responsibility for PCI - DSS and its continuing certification. Both from an information security and technical security perspective working alongside the CISO. Experience must include, but not be limited to; a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance. PCI objectives / 12 key requirements, OWASP top 10, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. PCI Cloud compliance, specifically someone with experience taking PCI-DSS from on premise into the cloud is HIGHLY desired. However, someone with Solid PCI experience with a strong technical background which include Cyber / Secure by design etc would be considered. Experience managing internal stakeholders and external third parties essential. Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection. 1st stage interviews to happen the week of the 14th September Arrange a call with Chris on https://calendly.com/chris-holt/arrange-a-call-chris-dcl-pci-compliance
- IAM Contractor CyberArk
Identity & Access Management Architect Contractor Flexible • Extensive PAM / IAM experience required, • MUST have CyberArk and or Beyondtrust. Privileged access management • Technical review, recommendation, design and hands on technical delivery. • 6 month contract Arrange a call with Chris Holt https://calendly.com/chris-holt/arranged-call-with-chris-holt?month=2020-09