The year they stopped counting the missing millions

Three hundred and eighteen doors

The sharpest figure in this subject is not about shortage at all. An analysis of 5,260 openings found 318 that a person could actually start from — around 6% of the market. Everything else asked for experience that can only be obtained in a job like the one being advertised.

Two ordinary decisions produced it. The tasks that used to constitute a first year in this field — working through alerts, gathering evidence, writing up what happened, checking that a fix was applied — are precisely the tasks that tooling and automation absorbed first, because they are repetitive and well defined. And a team under budget pressure that loses a person replaces them with somebody senior, since one experienced hire covers more than two juniors and needs no supervision.

Each choice is defensible and the aggregate is self-harming. A profession that hires only experienced people is consuming a stock it has stopped replenishing, and the effect appears with a lag of about five years, which is comfortably beyond the horizon of anybody making the decision. Meanwhile the same organisations complain, sincerely, that they cannot find anybody.

The remedy is not charity and it is not a graduate scheme with a brochure. It is deciding that a proportion of the work will be done more slowly by somebody learning, and accepting the cost of that on purpose. Organisations that do it acquire people who understand their estate, which is the scarce commodity the market cannot supply at any price, because it does not exist until somebody has spent two years there.

Why do people leave this work?

The explanations offered are pay, hours and stress, and all three are real and none of them is the distinguishing one, because they describe most demanding jobs. What distinguishes this field is a structural mismatch: responsibility for outcomes determined by decisions somebody else takes.

An analyst who identifies a serious problem, escalates it correctly and watches it be deferred for commercial reasons has done the job perfectly and achieved nothing. Repeat that a dozen times and the rational conclusion is that the work does not matter, which is both false and unarguable from the inside. It is the same complaint the head of the function makes about the board, one level down and with less recourse.

The conditions compound it. Success is invisible by construction — nobody thanks a team for the year in which nothing happened — while failure is public, permanent and frequently personal. The work is unbounded, in that there is always more of it, so the only limit is one the person imposes, and the people who impose it well are the ones the profession describes as unambitious.

What helps is unromantic and mostly free. Write down which decisions the security function may take alone, so that some things actually get done because a person said so. Record deferred risks with a name against them, so that being overruled leaves a trace rather than a grievance. And bound the work explicitly, because a team told that everything matters will either burn out or quietly stop believing you, and the second is worse.

What a certificate is actually for

Practitioners argue about certifications with unusual heat, and both positions are correct about different things. They do not predict competence: the correlation between holding one and being good at the work is weak enough that everybody who hires has a story about it. They also open doors that stay shut otherwise, which is not nothing when the alternative is not being read.

The function they perform is filtering by people unqualified to filter. A recruiter with two hundred applications and no way to assess any of them needs a criterion, and a certificate is a criterion that exists. That is a statement about the hiring process rather than about the qualification, and it explains why the same certificate is simultaneously essential for getting interviews and irrelevant once somebody technical is in the room.

The costs land unevenly. Fees, renewals and continuing-education requirements are trivial for an employer paying them and substantial for somebody trying to enter the field from outside, which is precisely the group the profession claims to want. A requirement that costs the applicant a month's wages to satisfy is a barrier described as a standard.

The sensible position is instrumental. Get the one your target employers filter on, treat it as a key rather than an education, and take the actual learning from building things and breaking them. Employers can help by naming which certificate they filter on and admitting that is what they are doing, which is more honest than listing five as required and meaning none of them.

Getting in from outside

Advice to newcomers in this field is abundant, contradictory and mostly written by people who entered when the door was wider. What survives contact with the current market is narrower and less encouraging, and pretending otherwise wastes years of somebody's life.

The most reliable route is sideways rather than in. Support desks, system administration, network operations, software development and audit all produce people who already understand how something real works, and that understanding is the thing employers are actually short of. Somebody who has run a mail server has a better foundation than somebody who has completed four courses about attacking one, and the first group gets hired for roles the second group cannot see.

What demonstrably helps is evidence of having done something. A small piece of infrastructure built and defended, a write-up of a problem investigated properly, a tool that solves a dull task, a contribution to something other people use — each gives an interviewer material to ask about, which is what an interview is for. Certificates get an application read; artefacts get a conversation.

The advice worth resisting is specialisation before entry. A person who has decided to be a malware analyst before holding any job in the field has narrowed their options to a handful of employers, and the specialism that eventually fits is usually one they had not heard of. Breadth first, then depth chosen from experience, is slower to describe and faster in practice.

Two things are worth saying to the people already inside, because they cost nothing and almost nobody does them. Answer the message from the stranger asking how you got in; the ten minutes are trivial and the effect on somebody with no contacts is enormous. And when you interview, tell the candidate what the actual work is — including the tedious majority of it — because the field loses people who arrived expecting one job and found another, and that loss is entirely self-inflicted.

Employers can do one cheap thing as well. Say in the advert which requirements are genuine and which are aspirational, since everybody in hiring knows the list is padded and only the confident apply anyway. The people deterred by a list of nine essential technologies are disproportionately the ones who read carefully and assess themselves accurately, which is not the trait a security function should be filtering out. The same applies to the salary: publishing it costs nothing, saves both sides three conversations, and its absence is read — correctly, most of the time — as a plan to pay whatever the candidate can be persuaded to accept. A profession that spends this much energy complaining it cannot find people could start by being easier to approach.

None of this is charity either, which is worth saying because it tends to be heard that way. An organisation that answers messages, describes the work honestly, publishes what it pays and admits which requirements are optional will fill a role faster and keep the person longer than one that does none of those things and pays slightly more. The behaviours that make a profession easier to enter are the same behaviours that make an employer competitive, and the fact that they are usually argued for on moral grounds is probably why so few finance directors have heard the commercial version.

And the market rewards persistence unfairly. The applicant who is rejected forty times and applies again is not more talented than the one who stops, and does end up employed, which is a statement about hiring rather than about merit. Anybody giving career advice in this field should say that plainly instead of describing the outcome as a meritocracy.