Cybersecurity continues to be a popular career choice and understandably so. According to analyst firm Frost & Sullivan, the level of unemployment in the sector lies at just 1% and demand will continue outstripping supply.
Job site Indeed saw an increase of almost 15% in cybersecurity postings in 2018 and this growing demand is of course driving up wages. According to Hays 2019 Salary and Recruiting Trends Guide, last year jobs in this sector saw a 3.2% salary increase in the UK, compared to the country's average of 1.9%.
The demand for cybersecurity experts is growing for a number of reasons. As companies digitise more of their activities the role of cybersecurity increases, but it's also down to more businesses responding to the rising number of high-profile cyber attacks.
A self-imposed supply shortage?
Interestingly, several of the major analyst firms believe that the supply problem is one that's been created by the companies themselves as much as the shortage of qualified candidates.
"Companies are issuing job requisitions that have unrealistic demands of experience and technical competence, and exclusively target those with computer science," says Paul McKay, senior analyst at Forrester.
"Some hiring managers have on blinders," agrees Jarad Carleton, Frost & Sullivan's global program leader for cybersecurity. "They want 'pedigree'; people with IT degrees. But they're beginning to see that their headcount shortage isn't going to go away unless they think outside of the box. There needs to be more flexibility in how they look at potential recruits and bring in people from more varied backgrounds."
The UK's top cyber employers
Indeed recently published its list of the UK's top 20 cyber employers, which put the "big four" management consultancies KPMG, PwC, EY and Accenture in the top spots. Financial firms, followed closely by technology-focused businesses, dominate the top ten, but experts agree that as time goes on, recruitment for cybersecurity experts will grow across all sectors as they recruit their own staff rather than turning to consultants.
"[The consultants] are guns for hire," says Carleton. "They'll come in, evaluate what's happening and put in a solution. Once it's up and running they dust themselves off and walk out the door. Businesses need to be able to keep themselves secure."
What are employers' most sought-after cyber skills?
According to Indeed the most sought-after cyber roles can be very lucrative, with the top five paying a combined average of 45,851 a year versus the national average salary of 27,600. According to the results of its study, IT security specialist is the most in-demand role in the UK, with nearly three times as many vacancies as the role of security engineer, which took second place. Completing the top five were security consultant, information security analyst and IT auditor.
"In discussions I've had, auditing systems is something that's very sought-after," notes Cathy Mulligan, a visiting researcher at Imperial College Business School. "It's a key area because so many existing systems are coming under different types of threats. Attack vectors are expanding, and morphing, on a daily basis," she points out.
But as cybersecurity encompasses so many different areas, analyst firms and recruiters agree that demand for skills in almost all of these areas will continue to grow. For example, as many companies migrate to the cloud as part of their digital transformation, hands-on cloud security experience is increasingly sought after.
At Forrester, McKay has seen a lot of demand for incident response, security operations centre (SOC) analyst, and technical security analyst roles, as well as threat intelligence and vulnerability management at present. Over at Hays Digital Technology, director James Milligan says that cybersecurity analyst tops this year's most in-demand role with security analyst, security architect, cyber threat intelligence analyst and cyber incident analyst roles also being particularly sought after.
Milligan notes there's a shortage around application security as well and an increasing demand for technical candidates "with an appreciation of the software development lifecycle (SDLC) and [who] in some cases come from a development background".
Experts also believe we'll see a significant increase in the requirements for security practitioners to be able to support organisations in dealing with regulations.
"In the UK we recently introduced the General Data Protection Regulation (GDPR) into the data privacy space and the EU Network Information Systems Directive (NISD)," says McKay. "These will continue to evolve and I expect government to continue to take a more active role in working with companies in this fashion. Having professionals on board who know how to translate regulation into practical action to satisfy regulatory demands will become popular."
The UK's cybersecurity hubs
As for where to find work in cybersecurity, opportunities are popping up in cities all over the UK. In England, there are large hubs in London and across the southeast, including Cambridge, where you'll find a lot of start-ups.
Along the M4 corridor and down to Bristol, there are many opportunities for cybersecurity specialists, then there's Cheltenham home of GCHQ Manchester and Birmingham. In Scotland, Glasgow and Edinburgh have active cybersecurity communities due to many large international firms having bases in these cities.
Kevin Curran, senior member of the IEEE and professor of cyber security at Ulster University, also notes that Belfast has developed one of the strongest cybersecurity hubs in the UK.
"It's become home to a large cluster of international companies delivering global security products and services. Financial services firms including Allstate, CME and Citi have each invested in cybersecurity operations in Belfast and other major players such as PwC, Deloitte, Ernst & Young and BDO have all developed a range of cybersecurity solutions that are serviced from there," he notes.
As you can see, if you have the right skills, there's work available all across the UK. And with demand continuing to grow, employers will begin to consider a wider range of applicants, not just those who've followed a very rigid cybersecurity career path to date. This is a sector overflowing with opportunity, so if cybersecurity is a career that interests you, now's the time to get ahead.
