[HN Gopher] U.S. has almost 500k job openings in cybersecurity
       ___________________________________________________________________
        
       U.S. has almost 500k job openings in cybersecurity
        
       Author : WellDressed
       Score  : 52 points
       Date   : 2021-05-23 13:16 UTC (9 hours ago)
        
 (HTM) web link (www.cbsnews.com)
 (TXT) w3m dump (www.cbsnews.com)
        
       | shiftpgdn wrote:
       | I am a Sr. devops engineer and have been looking to transition to
       | a devsecops or even some sort of security ops role for a YEAR. I
       | am willing to take a pay cut and move to a more junior role but I
       | can never pass the HR filter of "prior security experience
       | needed."
        
       | bpodgursky wrote:
       | Meta on the comments: While it's true that the salaries are
       | unreasonably low, it doesn't mean that there are 500k Americans
       | capable of doing cybersecurity work just waiting for the right
       | paycheck.
       | 
       | There can be _both_ a worker shortage and unreasonable salary
       | expectations. A labor market will always have slack on both
       | sides, but even at the extreme, there could be 10 cybersecurity
       | experts, and you'd have people saying "Oh, you can find workers,
       | you just have to be willing to pay $100mm/yr."
        
         | MattGaiser wrote:
         | I wonder if it is like the rural doctor/nurse/cop shortages
         | though. Those places don't want to pay, so don't care if the
         | jobs are actually filled.
         | 
         | How many of the 465,000 jobs do companies actually care get
         | filled? Or do they just have them open just in case someone
         | cheap walks through the door?
        
           | bpodgursky wrote:
           | The rural doctor shortage is probably a really good parallel,
           | because as a society we in the abstract agree that it's Very
           | Bad to let people die without reasonable access to
           | healthcare, but poor rural communities simply can't support
           | paying doctor or even nurses to be available.
           | 
           | There's still a ton of society loss / deadweight because of
           | the consequences of not having those services; the question
           | is, how can we restructure the supply side of the argument to
           | make it possible? For doctors+nurses, it's via government
           | subsidies (income-based repayment, federal grants).
           | 
           | ie, the cost of security breaches isn't to the companies
           | being breached -- it's to the consumers who lose their
           | PII/PHI to hackers. Or who lose access to a service they love
           | using, because they can't keep running without a security
           | expert.
        
             | fmajid wrote:
             | The rural doctor shortage is caused by the American Medical
             | Association cartel deliberately restricting the supply of
             | doctors to keep prices high. When there isn't even enough
             | supply to meet the needs of desirable urban areas, what
             | chances does the middle of nowhere in the Midwest or Alaska
             | have?
             | 
             | I once dated an Indian-born MD who immigrated to the US. A
             | Senator from Missouri went to bat personally (not one of
             | his staff) to get her a green card under the proviso she
             | would settle in rural Missouri, because he understood
             | that's what it takes (she moved to Maryland after a few
             | years).
        
         | whoknew1122 wrote:
         | > There can be _both_ a worker shortage and unreasonable salary
         | expectations.
         | 
         | This is true, but unreasonable salary expectations exacerbates
         | a worker shortage.
         | 
         | I can either try to find security work with reasonable
         | expectations and salary, or I can take the skills I learned in
         | security to learn IaaC, CI/CD, and Docker (which takes maybe a
         | couple months?) and go do DevOps to make a lot more money. Sure
         | I'm not passionate about DevOps, nor do I feel I'll be making
         | more of a societal impact in DevOps. But I'll be materially
         | better off and won't have to sift through hundreds of job
         | postings to find a posting with reasonable expectations.
         | 
         | The end result? Another qualified, passionate person outside of
         | the job pool.
        
         | coryrc wrote:
         | Then they need to get off the Internet if they truly can't
         | secure their systems.
         | 
         | Or, goodness, so many people became unemployed during the
         | pandemic, they could train them for the job they "need".
        
           | bpodgursky wrote:
           | We don't put this financial burden-of-self-defense on any
           | other industry though. Why is cybersecurity different than
           | physical retailers?
           | 
           | Walgreens isn't responsible for providing their own police
           | force. Sure, they put locks on the doors, but the burden of
           | protecting businesses is on the police, which they (and we)
           | pay for via taxes.
           | 
           | You could say "Oh, a business which can't defend itself
           | against looting doesn't deserve to be in business", and maybe
           | you end up with like 5 mega-Walmarts who can afford heavily
           | armed guards, but this isn't actually a better society in the
           | end than one with robust small businesses.
           | 
           | It's the same with cybersecurity -- you can take everyone
           | except Google, Amazon, and Facebook off the internet, because
           | only those three can hire top-of-the-line security
           | professionals, but that's not actually a better internet than
           | the one we have now.
        
             | drewcoo wrote:
             | Walgreens - great example! That's a pharmacy. Pharmacies
             | have to follow strict safety regulations and are constantly
             | worried about both those and the threat of lawsuits for
             | endangering customers. And there are also both internal and
             | external threats to the business (drugs are a valuable,
             | easily portable asset).
             | 
             | Oversimplifying a lot, Walgreens has these well-paid,
             | trained workers they call "pharmacists" to deal with it.
        
               | bpodgursky wrote:
               | You are trying to whatabout this, ignoring the actual
               | point. Let's not do that.
               | 
               | The Pharmacists make only effort to prevent someone from
               | breaking into the Pharmacy with a crowbar and stealing
               | all the drugs + prescriptions. In fact, I would be
               | shocked if Walgreens even _allowed_ staff to physically
               | detain shoplifters -- that's a huge legal liability.
               | 
               | Defending those goods is the job of the police.
        
             | coryrc wrote:
             | In San Francisco, Walgreens is responsible for providing
             | their own security force, so they decided to stop operating
             | there.
             | 
             | Companies that can't secure their operations can hire
             | others, like Shopify, Paypal, etc to conduct online
             | operations for them. We've all heard the many stories of
             | professionals making security recommendations and being
             | overruled. If you don't want to invest in security, then
             | don't have valuable data in computers connected to the
             | Internet. Experian exposed our data and faced basically
             | zero consequences, so I don't have any sympathy.
        
               | bpodgursky wrote:
               | Are you seriously arguing that Walgreens leaving SF over
               | rampant shoplifting is natural, healthy outcome?
               | 
               | Literally every sane person agrees this is a symbol of
               | utter dysfunction that should never happen in a
               | functioning city.
        
               | coryrc wrote:
               | Oh, no, it's terrible.
               | 
               | But government can't secure the Internet like they could
               | physical space, so operating on the Internet is like
               | operating in SF.
        
             | fmajid wrote:
             | Well, that's one of the drivers for companies migrating
             | their apps to the cloud.
        
             | Jiro wrote:
             | Cybersecurity drastically varies depending on the actions
             | of a business in a way which physical security doesn't,
             | short of the business failing to lock its doors at night.
             | And if the business does fail to lock its doors, the
             | business is directly hurt, giving businesses incentives to
             | treat security properly, while security breaches often hurt
             | the customers, but not the company.
             | 
             | Also, you don't generally see the police demanding that
             | retailers have windows that are easy to break because the
             | police might want to rob them themselves someday, but the
             | equivalent is routine with the government and
             | cybersecurity.
        
       | a3n wrote:
       | Well that oughta get all those waiters and cashiers off
       | unemployment.
        
       | AtlasBarfed wrote:
       | Well, since ultimately this involves codewords dancing around the
       | "don't want to pay proper wage", America's companies should
       | instead hand their security over to outsourcing firms like they
       | do with everything else that is IT related?
       | 
       | What could go wrong? Make sure to diversify to China, Russia,
       | Eastern Europe, Malaysia, Israel etc.
       | 
       | Oh does that sound like a bad idea? The fact is as soon as the
       | main systems development is outsourced, you might as well have
       | outsourced the security too.
       | 
       | Probably why most enterprise security is a bunch of people buying
       | Cisco appliances and formulating checklists and policies and
       | don't even know specific vulnerabilities or the safety degree of
       | various algorithms.
       | 
       | And of course, their main job, making powerpoints for upper
       | management and occupying seats/budget such that when leaks or
       | failures occur upper management has plausible deniability.
        
       | etaioinshrdlu wrote:
       | I don't know any security professionals. Is this something that a
       | mostly-self-taught software engineer could get a job in? What are
       | interviews typically like?
        
         | codyb wrote:
         | Tom Aptek's (security company founder) pitch a few years back
         | was
         | 
         | Get through 'A Web Application Hacker's Handbook' and 'Securing
         | DevOps' and his company would probably give you six figures and
         | a brand new macbook.
         | 
         | For an extra bonus you could work through their crypto
         | challenges.
         | 
         | https://cryptopals.com/sets/1
         | 
         | https://www.manning.com/books/securing-devops
         | 
         | https://archive.org/details/TheWebApplicationHackersHandbook...
        
       | [deleted]
        
       | DigitallyFidget wrote:
       | I wish these supposed jobs existed when I finished my degree for
       | going into cybersecurity, unfortunately EVERY "entry level" job
       | required 3-5 years experience. It's probably exactly the same
       | today. Now I work in electrical engineering, because the position
       | requested (not required) a background in IT and my hobbyist
       | experience was enough to satisfy the rest of the requirements.
        
       | hparadiz wrote:
       | The salary they mentioned in the article is too low when the
       | downside is millions in payout
        
         | Trisell wrote:
         | I've noticed that Cyber Security at a lot of companies are
         | still stuck in the sys admin days of yore. They continue to
         | hold on the antiquated tooling that doesn't scale or actually
         | detect most issues. And the idea of learning or expanding into
         | security automation beyond their toolset is frowned upon by a
         | not significant number of member of the community doing the day
         | to day work. This creates an atmosphere where they SecOps teams
         | can't articulate the positives they are bringing to the
         | organization. And thus the market doesn't pay them their worth.
         | 
         | Compare this to DevOps where the sale has been done well and
         | the business is convinced that these highly paid automation
         | engineers will help the business to improve and speed up
         | software delivery providing more income to the company.
         | 
         | Until security is able to properly articulate how they are
         | helping and improving the business, not just getting in
         | everybody's way. The field is going to struggle to raise
         | salaries to comparable levels as these other disciplines.
        
         | ENOTTY wrote:
         | That's just an entry level salary
        
           | hn8788 wrote:
           | Most places where I've worked only had 1-2 security people
           | that weren't entry level. The majority of people doing
           | cybersecurity work are just going to be looking at automated
           | alerts and automated scan reports, then they pass things up
           | to the senior person to make sure it gets investigated and
           | fixed.
        
           | tootahe45 wrote:
           | I imagine lot of these would be highly laborious analytical-
           | type roles (staring at a dashboard all day) which don't lead
           | to the high paying and glamorized hacker/pentester roles.
        
       | fullshark wrote:
       | No one wants to pay big money to improve the talent in a cost
       | center.
        
       | merricksb wrote:
       | Discussed 3 days ago:
       | 
       | https://news.ycombinator.com/item?id=27219156 (88 points/94
       | comments)
        
       | iamAy0 wrote:
       | I've reading about this "security professionals shortage" for
       | quite some years, yet the reality is that there is no such
       | shortage.
       | 
       | And I think this is even expandable now to any IT field. People
       | keep saying about shortage, but what I do see is exhausting
       | hiring process most people just don't want to deal with.
        
         | Covzire wrote:
         | The security industry is unique in how much and how quickly it
         | changes. There are two kinds of companies that hire infosec
         | professionals in my experience: Those that understand that
         | change and the resulting need to plug their employees into the
         | industry training pipeline, invest in their active learning and
         | those that don't. Those that don't more often than not have
         | laughable or terribly unbalanced job descriptions where they're
         | willing to pay decently well but demand a golden platypus
         | riding a unicorn, and those types of hires might have a
         | shortage indeed.
        
         | hn8788 wrote:
         | The hiring process is definitely an issue. Cybersecurity is new
         | enough that HR has no idea what they want, so they require
         | useless certifications like CEH, and a college degree in CS.
         | There's also a wide variation in what Cybersecurity even means.
         | Some college cybersecurity programs are all about policy and
         | compliance, while some focus on offensive security and
         | vulnerability analysis.
        
           | isbvhodnvemrwvn wrote:
           | Often it's not HR that writes these job adverts, it's the
           | managers. HR is just a middleman.
        
         | hirundo wrote:
         | "Shortage" is a synonym for "costs more than I'd like to pay
         | for it".
        
           | closeparen wrote:
           | Competing harder for the limited pool of competent security
           | people might redistribute breaches away from your company
           | onto others. From a local perspective this could be rational
           | but as a society we want to be less vulnerable in aggregate.
           | 
           | (Although there I think the IT operations side is vastly
           | overblown and not nearly enough attention is paid to quality
           | control on the most popular software packages. Want to make
           | every business substantially more secure at once? Take a hard
           | look at Windows Server, Exchange, etc).
        
             | nitwit005 wrote:
             | The pool is never truly limited though. Every industry was
             | at one time tiny and had to train people to do the job.
             | 
             | But, training costs money, so they hope some other company
             | will do it for them.
        
           | missedthecue wrote:
           | Paying more just means you fill your vacancy at the expense
           | of another firm who has their employee poached. The net
           | effect is that one company is still vulnerable.
        
             | ipaddr wrote:
             | Or another country or another industry or encourages others
             | to join the field.
        
             | fmajid wrote:
             | It also creates supply, e.g. software developers in a
             | related field deciding to switch careers.
        
             | rdiddly wrote:
             | They are all in this together? Paying more means you fill
             | your vacancy.
             | 
             | Edit: The cheapskate can follow suit and maybe that
             | convinces one person to undertake the 8-week cert. No more
             | shortage. Or maybe they don't pay more and are DDoS'd out
             | of business. Again, no more shortage.
        
       | whoknew1122 wrote:
       | How many of those job postings list a CISSP or 5 years for an
       | entry-level job that pays $70k? This is stuff I see often.
       | 
       | I have extensive experience in cloud security environments, have
       | done IR, DR/BCP planning, passed SOC II audits, and have security
       | cert(s). But I'd have a hard time finding a security engineering
       | job that pays similarly to what I get paid currently as a support
       | engineer for AWS's security services. And that's largely because
       | most security jobs I see are asking for unicorns willing to get
       | paid substantially less than other IT disciplines.
        
         | secabeen wrote:
         | Security is always going to be a cost side of the business, to
         | be minimized.
        
           | mavelikara wrote:
           | If I am reading the trend correctly, we will soon see
           | Trust/Security/Assurance move into more of a GTM function for
           | B2B product companies.
        
         | MattGaiser wrote:
         | > But I'd have a hard time finding a security engineering job
         | that pays similarly to what I get paid currently as a support
         | engineer for AWS's security services.
         | 
         | I would assume that AWS would be near the top of compensation
         | no matter what job when looking at American companies.
        
           | whoknew1122 wrote:
           | Really depends on what Org you're working for. I've had a lot
           | of colleagues in support get pulled away to SaaS vendors to
           | get paid more. I actually talked with a friend the other day
           | who essentially offered me a job with 50% the workload and
           | $30k+ more per year.
           | 
           | While SDE/SDMs/etc. probably get paid the top of the
           | compensation when looking across companies, support isn't the
           | same. Also, most of that is likely tied up in RSUs.
           | 
           | But I know for a fact L4 people in AWS's SOC get paid more
           | than L5s in support. But AWS's SOC isn't a remote position,
           | and I'm not in a position to move to where the SOC teams are
           | located.
        
       ___________________________________________________________________
       (page generated 2021-05-23 23:02 UTC)