Hacker News Reader

Comment by MattGaiser | Hacker News Reader

Are there enough Infosec people to fill every open job for it in the USA? I would imagine that it is like software development, where the unemployed software devs are the kind that can't figure out git.

View on HN

This is basically accurate but with an added problem. When devs do their job, the product is software. When security does their job, the product is “not getting hacked”, so if you act busy enough, it’s easy to appear as though you’re doing important work, until it’s too late.

Then, paradoxically, you aren’t actually punished, but usually rewarded, when you do get hacked. That’s the one time you’re needed most, and you get to act like the hero for saving the company.

I doubt there are enough infosec people which means in theory that compensation should rise which will then attract more people into the field. Until they're trained and experienced, whoever provides the best place to work (compensation and intangibles that lead to satisfaction) would get the help they need while others would be more vulnerable to attack. But from what I've seen, this isn't happening. There's lots of complaints about there not being enough workers but instead of boosting compensation and/or quality of employment, the positions simply stay open for extended periods of time.

What would be the solution to this?

If I’m a leader in a company with a culture and intangibles not yet optimized for the people working in the infosec roles, how would I aproach changing the environment for the better?

Is it viable to cooperate with other companies to share best practices? Wouldn’t they hesitate to share?

Would doing deep interviews with potential employees get me the right information?

Would some hr consultancy provide this info? Arent’t they too old-fashioned for this field yet?

Reply on news.ycombinator.com