Cybersecurity Keeps Asking For Experience Without Creating It
Michael Jenkins is Chief Technology Officer at ThreatLocker.
gettyβIβm hardly the first one to say it, but the cybersecurity industry has an entry-level problem, and it is a crisis of our own making.
The Wall Street Journal recently reported that entry-level roles are declining due to companies electing to recruit more seasoned cybersecurity professionals. This is linked, in part, to AI taking over some of the routine work traditionally assigned to junior employees. At the same time, the demand for security practitioners remains strong. The Bureau of Labor Statistics (BLS) projects employment for information security analysts will grow 21% from 2025 to 2035, much faster than the average occupation, and CyberSeek recorded more than 500,000 U.S. cybersecurity job listings.
Where will the experienced professionals of the future come from if they arenβt given the opportunity to get started? Senior professionals donβt appear fully formed; they start as juniors who are given opportunities to develop. From my perspective, too little of that development is happening inside companies.
Some would argue that a few years in general IT are necessary before jumping into a cybersecurity career. ISC2 found that 56% of cybersecurity professionals entered the field through IT, but the traditional pathway is under pressure. BLS projections show employment for computer support specialists declining 2.7% over the next ten years. That is an alarming trend. Given the growing need for cybersecurity professionals, those numbers donβt support continuing to treat this as the standard career path.
At ThreatLocker, weβve placed significant emphasis on hiring entry-level staff and supporting their career development. They might start in junior support, but as they grow, they become qualified for more advanced positions. Iβm proud to have personally mentored many who have moved into vital roles on our development team.
For business leaders considering this approach, start with a role your team can realistically support. Look for curiosity, sound reasoning and a willingness to learn. A practical exercise can reveal how a candidate approaches an unfamiliar problem, even when their rΓ©sumΓ© offers little experience.
Assign a mentor and protect time for training. Expecting an already stretched senior employee to fit mentoring around everything else is unlikely to work. Set clear milestones, such as resolving routine support issues independently, and review progress regularly. Give juniors supervised work with limited access, expanding responsibility as they demonstrate competence.β
The objections are understandable. Training costs money, takes experienced staff away from immediate priorities and does not guarantee every hire will succeed or stay. Smaller teams may need to begin with one hire. Leaders should budget for the learning period and assess whether employees need less supervision over time.
I still believe the investment is worthwhile. Employees who grow within a company develop knowledge of its systems and customers that an external hire must acquire. Give them a visible route to advancement and compensation that reflects their progress. Too often, leaving is the only way to get the next opportunity. Leadership can change that.
Government workforce policy also has a role. A four-year computer science degree is not the only route into cybersecurity. In my experience, certifications or a specialized associate degree can provide a faster, less expensive foundation when combined with practical experience. At ThreatLocker, weβve hired people straight out of high school who rank among our best employees.
Education systems should prioritize programs that connect training with employment. Governments can also encourage companies to hire and develop entry-level employees through tax credits and other workforce incentives.
Hire people early, teach them and give them paths to growth. That is the approach ThreatLocker has embraced since our founding, and I believe it is the best way to create the senior cybersecurity experts the industry needs.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
