We often hear about the abundance of cybersecurity job openings in the U.S. and around the world, but it seems that many newcomers to the application security field are struggling to secure positions. Why is that?
One reason could be the college barrier. Despite calls for skills-based hiring, most job postings still require a college degree, making it challenging for career switchers and high school graduates who have invested in cybersecurity skills to land jobs.
Another issue is misaligned expectations. Some companies list requirements like the CISSP certification for entry-level positions, even though it requires five years of security experience to obtain. This creates a paradox where entry-level practitioners are expected to have experience they can’t possibly have.
Additionally, companies may struggle to accurately define roles in application security, leading to hiring freezes as they determine their needs. This, coupled with seasoned workers taking entry-level positions due to lack of opportunities elsewhere, leaves little room for new talent to enter the field.
Budget constraints and a lack of time for training also contribute to the problem, as practitioners are too overwhelmed to mentor new talent. AI-driven hiring processes and fake job postings further complicate the job market, making it difficult for qualified candidates to stand out.
To address these challenges, the application security community should educate companies on the importance of AppSec and advocate for skills-based hiring. Companies should consider hiring senior developers passionate about security and invest in their training to mentor the next generation. Candidates should focus on honing their soft skills and technical knowledge to stand out in a competitive job market.
By working together to address these issues, we can create a more inclusive and supportive environment for aspiring cybersecurity professionals.