What should the government do in 2023 to fill its cyber workforce shortage?

Government needs to expand where it recruits to fill open cyber positions going into 2023 as the threat of cyberattacks makes filling these positions vital, according to experts.

“For cyber talent, one of the biggest realities is that we have to increase the points of entry,” Erin Weiss Kaya, senior cyber talent and organizational strategist at Booz Allen, told Nextgov. “We don’t want to eliminate points of entry because we’re dealing with this lack of enough supply and a lack of entry level points.”

As of September 2022, there were 40,000 open positions in the public sector, a September report from the Federal Cyber Workforce Management and Coordinating Working Group found.

Additionally, the report noted that the cyber job market is expected to grow 13% from 2020 to 2030—faster than the overall average for occupations, while an aging workforce threatens those federal positions already filled. Less than 6% of the federal cyber workforce is under 30 years old and more than 30% of the cyber workforce is over 55 years old, per the report’s findings. 

“Given expected retirements, lack of entry-level and diverse talent, turnover and the growing need for new skill sets, there is a significant risk to our cyber mission effectiveness and the long-term health of our federal cyber workforce,” the report stated. 

The government has been working to fill these workforce gaps and find additional recruitment opportunities. For example, the White House launched a cybersecurity apprenticeship sprint, which ended in November, to help address workforce needs. However, according to experts, apprenticeships are “one solution” to the problem.

“They’re critical, and I think that they’re critical when they’re built to meet both entry level staff, and mid-career professionals. Right now, a lot of them really are structured for the mid-career professional. And so I think when you kind of talk about the falling short, it’s how are we going to be able to open them up for entry level staff in this space as well,” Weiss Kaya said. “The other piece of that is this is a really a nonlinear field, right? And so getting out of traditional points of entry and using apprenticeships to do that are going to be necessary in order to make sure that they’re really having the kind of impact that we want them to be able to have.”

Rick Vanover, Senior Director of Product Strategy at Veeam, told Nextgov that while apprenticeships are “critically important to put new talents, minds and mindsets in the place they need to be,” these efforts may fall short to keep people in the long-term because of things like overload, fatigue and burnout.  

According to cyber professionals, agencies need to do several things to help recruit talent, including changing their mindset from degree-focused requirements to aptitude and development-based assessments, as well as trying to attract the next generation of talent.

“Agencies really need to accept that compliance is not security, so they need to start focusing on recruiting and keeping talent…that see security as a risk management activity,” Weiss Kaya said 

She explained that aptitude-based assessments—which evaluate various elements of an applicant that often indicate likely success in a cyber role, such as cognitive ability, personality or work styles, for individuals with little or no technical skills or cybersecurity background—are one solution to finding that kind of talent, a process that she’s seen some agencies begin to adopt to expand the talent pool.

“The caveat with those is they do have to be legally defensible, but accomplishing that is feasible, as long as they’re built appropriately. And they really open up the door for a much larger talent pool and new entry points into talent,” Weiss Kaya said. 

The “other side of that coin” would be to use development-based assessments, according to Weiss Kaya, which are knowledge, skills and abilities tests that mimic on-the-job tasks and tend to be embedded in reskilling efforts.

”They can be used individually, they can be used in a team, there are tabletop versions, there are simulation based, there are kind of more traditional survey based. But, essentially, they all create this opportunity to identify, ‘where are those talent gaps? Or where are there ways to attract individuals who maybe don’t think of themselves as cyber professional,’ and move them into a cyber professional type of role.” 

Vanover noted that utilizing different entry points can be helpful when trying to scale a team. He also emphasized the importance of different recruitment efforts. 

“I think there’s a market for it right out of college, even maybe some of the technical programs from other types of education venues,” Vanover said. “Sounds crazy, but I would also look at people actually convicted of cyber crimes and learn from them. What motivates them? Why would they want to do that? That might be more of a consultancy thing. I don’t know if I’d want somebody working for me like that…but find new people and find new perspectives.”

While agencies may face recruitment challenges, Weiss Kaya noted that there are opportunities for the government to address them.

“There’s [a] really great opportunity for agencies to get more savvy at how to use the flexibilities that are provided and to advocate around regulations that maybe aren’t allowing them the flexibility that they want,” she said.

Weiss Kaya suggested that another way to attract workers is to continue to think about the future of work, such as remote or hybrid work environments and how this can work for different positions. 

“A large set of cyber professionals were already looking for a more informal environment and flexible hours, and [are] willing to surge on the periods when they need to surge. And remote work can allow for a lot of that,” she said.

According to the cyber professionals, the time to recruit is now. 

“Every organization—public sector or private sector—will at some point have to deal with a cybersecurity incident ,and I think there’s this whole perspective that ‘it won’t fall on my watch.’ But the market, the data, the reality says otherwise,” Vanover said. “My advice is there’s no better time to prepare than now for these types of things, so invest now for this from a people standpoint, from a tool standpoint, from a processes standpoint…prepare for these types of things, because the numbers indicate this will be a thing for everyone.” 

“I believe when it comes to cyber, we don’t have decades more to keep addressing this issue. The technology isn’t slowing down and the threats that we’re facing aren’t slowing down,” Weiss Kaya said. “And so, without changing how we think about who fits into these roles today, and who we’re going to need in these roles in the future, we’re not going to be able to be in a position to keep up with our threats.”