I'm skeptical about the "more than 300,000 unfilled security jobs" stat. Are we talking about thousands of empty chairs for each of the big tech companies and hundreds for each of the remaining fortune 500?
The numbers don’t always reflect how many positions they actually have the budget for, or whether they’re willing to pay a realistic rate.
Arguably, if they were willing to pay market rates there couldn’t be any vacancies, because supply and demand.
In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable.
And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left.
Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.
> Nationally, there were 301,873 cybersecurity job openings in the private and public sectors during the 12-month period between April 2017 and March 2018. This included 13,610 openings in the public sector.