Cybersecurity skills are in short supply worldwide, and South Africa competes locally and internationally for these skills. The risks of training and then losing employees must be weighed against not having access to these skills at all, says cybersecurity multinational Intel Security South Africa and sub-Saharan Africa regional director Trevor Coetzee.

However, if staff know there is room for development, they are more likely to remain with a company.

Businesses should establish clear career paths, supported by training and internships, for cybersecurity professionals so that they are aware that, despite possibly having to start in a call centre position, they could occupy a more skilled position in the future, he explains.

Further, acquiring certification in cybersecurity skills is expensive and can be a deterrent to many entering the industry. By subsidising or completely covering certifications, businesses will more easily attract and retain talent.

Cybersecurity as a career can be made more exciting through hands-on training, hackathons and gaming. The global Intel Security and the Center for Strategic and International Studies skills survey found that hackathons are an effective way of identifying talent and developing skills.

However, once interest has been fostered, tertiary education does not provide students with the opportunity to specialise in cybersecurity or at least study it at a very limited level that includes information technology (IT) security.

Although students attain computer or information science qualifications, they have to pay additional costs for security certifications, “unless they’re lucky enough to land a job that has a solid training programme in place”, Coetzee adds.

However, while companies typically require a tertiary qualification as an entry-level requirement, many people can, in reality, be upskilled. With a relevant baseline qualification – such as a Certified Information Systems Security Professional (CISSP) – and experience or exposure to typical IT environments, people can become good, all-round security practitioners, he adds.

“Once we lower the barriers to entry, we will widen the pool of available talent and be able to offer opportunities to those who cannot afford tertiary education,” Coetzee emphasises.

Along with lowering barriers to entry, the private sector also needs to diversify the industry to attract more talent, specifically women and those from minority groups. Cybersecurity is still a male-dominated industry, but, if made more attractive to women and minorities, it will also widen the talent pool.

Available skills can further be leveraged by working smarter with the skilled people who are available.

“Too many IT professionals are bogged down by tasks that could be automated. The Intel Security study identified intrusion detection, secure software development and attack mitigation as among the most in-demand skills, yet IT departments are overwhelmed by many functions that can be consolidated and automated.

“The skills shortage, coupled with the burden of unnecessary tasks, is putting a lot of pressure on IT staff, who are at risk of burning out. By automating some of the day-to-day tasks, IT resources will be freed up to focus on more advanced threats to the organisation,” says Coetzee.

Every industry needs cybersecurity expertise, especially as more local and African businesses move into the cloud and adopt mobile working practices.

“If we are to make any difference to the massive skills shortage, we need to make immediate and long-term changes to attract and retain the best talent possible,” he advises.