Rising Demand for IT Security Skills

CU360
December 3, 2009 | COMMENTS

As with positions in many other fields, pay for information technology (IT) and security skills declined in late 2008. But even then, and despite the recession, key skill areas saw pay increases. Current projections are that firms will pay more for skills related to internet security, compliance, and overall security architecture.

What's driving those increases? “The easy answer might be compliance, and you would be partially correct,” according to David Foote, CEO and chief research officer of Foote Partners, an IT workforce research firm. But one of the main drivers, says Foote, is a shift in budgets from external-threat defense to protecting data—and a resulting shift in demand for those skills and people.

Data security now comes up as the top issue for security decision makers, according to a Foote Partners security survey. And this year, while IT budgets are down between 7% and 9%, security budgets are increasing. In 2007, the portion of the IT operational budget devoted to security was just over 7%, but in 2009 it has risen to 12.6%.

The role of the security organization has changed from a support role to more of a business-centric view. It isn't just about operations—it's about protecting brands, protecting corporate reputations, and protecting finances, says Foote. This stems from the rise in high-volume thefts of credit card information, Social Security numbers, and personal data. The rising cost of these breaches has triggered state disclosure laws—along with negative publicity, damaged brands, and damaged reputations. The overarching need is to protect business assets and ultimately revenues.

Perimeter-focused security is missing a lot of current threats, says Foote, which has created demand for additional security skills. More than 50% of all reported vulnerabilities are in Web applications. Missing laptops and mobile devices will continue to cause security problems. Add to that malware running under the radar, social engineering, and both user and company ignorance about Web 2.0 threats.

The effect on security personnel is that security certifications have gained 1.3% in value. Overall, the 190 IT-related certifications surveyed have lost 2.8% in value, indicating that security certifications are going in an opposite direction. “Some of these certifications are up in pay between 9% and 25% in the last six months, which is really remarkable given the economy,” says Foote.

In addition to network security and data protection, Foote points to an evolving designation covering the entire area of governance, risk management, compliance, and audit—GRCA. “An interesting certification that has just come out, and hasn't been around long enough to track as far as pay is concerned, is called the Certified Governance and Enterprise IT certification, which is trying to bring qualified people into the GRCA area.”

Related areas showing strong pay demand trends include Web application security, secure software development, and the idea of proactive security programs spanning an entire application's life cycle. Data security requirements are driven by the current interest in digital records and the need to secure the newly digitized environment—a trend stemming largely from proposals for greater use of electronic medical record systems.

The interest in security architecture includes a demand for people who can construct proper security architectures. “There has been a real broadening of the view of what security means in organizations,” notes Foote.

A number of companies are hiring not just security people, but a lot of them are rearranging their workforce so they have the correct skills in place, adds Foote. “It's not simply budget reductions, but the fact that we need to have a different constitution to our workforce. Certainly security is part of that.”