As the cybersecurity industry tries to overcome a shortage of skilled workers, some professionals advocate for soft-skills based hiring, skills-based evaluation, and a pay-for-results work model, which they say will also improve diversity in the field.

The latest research conducted by the Enterprise Strategy Group (ESG) and the Information Systems Security Association (ISSA) found that almost all (95%) of respondents agreed that the cybersecurity skills shortage has not improved over the past few years, and 44% say it has gotten worse.

It's true that there is a shortage of people to work in cybersecurity roles, and this is largely due to the way those roles have been defined for last 30 years, said Sammy Migues, principal scientist at Synopsys. “Part of the issue today is we continue to look for people with those historically-viewed skills … to fill roles that address problems that are probably best addressed with automation and other processes,” he explained.  

The industry should change the nature of cybersecurity staffing to meet the risk management needs of today, he said. This includes considering work-from-anywhere candidates and paying for results as opposed to paying for effort. Additionally, organizations should combine the “old-school” skills with the “new-school” ones to meet the required amount of governance.

“If we did that, would we find the same skills shortage? Personally, I believe the answer is no,” Migues said. "The skill shortage will not evaporate, but it'll shift to something that we can manage.” 

Migues suggested that cybersecurity companies should embrace candidates who haven’t followed traditional and specific paths through education and certification, but still are equipped with soft skills that are mandatory for many cybersecurity jobs — up to and including the CISO level. He explained that soft skills “are way better indicators of future success for many cybersecurity jobs than whether the candidate has memorized command line sequences in five flavors of Unix.”

Migues explained that at the CISO level, these soft skills include being able to bridge the gap between the technical and the executive teams. A CISO at a software security company should have the ability to explain cyber risks to executives, hopefully using numbers, and then “translate that into a resourcing plan that keeps the software portfolio safe,” he said. These skills would ensure “the organization produces software at scale with the appropriate level of security."

Similarly, Black Hat cybersecurity event founder Jeff Moss advocated for “skills-based evaluation,” during his closing remarks. Also at this year’s conference, Homeland Security Secretary Alejandro Mayorkas announced the launch of the Cybersecurity Talent Management System (CTMS), which grants DHS more flexibility to hire cyber talent. In wake of the announcement, Moss said, “almost a decade later, they're finally organizing in such a way that … you don’t have to have a college degree," to be paid for a job in security. Instead, "you have to pass the skills tests. That's what we were advocating for.”

Currently, Migues hasn’t seen this type of “soft-skills evaluation” broadly adopted in the cybersecurity industry. “What I see broadly is organizations thinking about whether executives are a cultural fit,” he said. “In my opinion, it's not for long-term success.”

Migues urges organizations to start narrowing the cybersecurity skills gap by hiring candidates who can become part of the culture while driving inclusion by bringing in their differences and diversity in geography, culture, religion, gender, and more.

“If you want to get all the people who are skilled to apply for your job, then your job has to account for all the people who are skilled,” Migues said. And he added that if the companies can offer flexible work arrangements, they can attract people from different privileges, commitments, and restrictions in life.

Migues said that if the industry focuses on “the rounded-up skill set,” which includes technical experience as well as the soft skills of solving problems within a team and driving culture, that the number of people who feel comfortable applying for jobs will grow exponentially. “And it'll start to take on a life of its own over time,” he said. Those people will move up the chain over time within the company and repeat this positive hiring pattern. 

Migues also notes that cybersecurity organizations should be explicit about the hours, travel, work-life balance, and salary for the role during the hiring process. He pointed out that “salary advertisements of [$50,000 to $120,000] just tell candidates that you'll try to lowball if you can.” This ties in with the findings of ESG and ISSA’s survey, which showed that 38% of respondents believe that lack of competitive compensation is the No. 1 reason for the skills shortage.

Recently, several tech companies announced that they plan to cut the pay of employees who work remotely. Migues argued, “lots of organizations have location-based pay adjustments, I get it. But when we get to pay for results, as opposed to paying for effort or paying for showing up, jobs have to pay what they pay. It doesn't really matter that I do it from Boise, Idaho, or from San Francisco."