Survey surfaces hiring resiliency

A global survey of 1,000 C-level business executives finds that despite an uncertain economy, 42% said they still expect to increase the size of their cybersecurity teams, with only 10% looking to reduce staffing.
Conducted by the nonprofit (ISC)² association of cybersecurity professionals, the survey also finds many organizations (41%) will be investing in automation if there is a recession. 40% of respondents expect their cybersecurity teams to work longer hours.

Whether there is an officially declared recession or not, many organizations are becoming much more cautious about hiring full-time employees. In fact, many organizations are likely to rely more on contractors and external service providers whenever there is an economic downturn.

A full 90% of respondents said their organization has increased investments in cybersecurity staffing over the last two years. It’s difficult to say to what degree organizations view that investment as perhaps for the time being to be sufficient, but in the event of a recession, just under a third (30%) said they would freeze raises and promotions.

Organizations may not be as willing as they once were, however, to pay top dollar for cybersecurity professionals. Over a third of survey respondents (36%) said that in the event of a recession, they would be hiring more junior members for cybersecurity teams. At the same time, the survey suggests junior staff will be impacted by any potential layoffs at a higher rate (63%) than senior team members (41%), managers (29%), and cybersecurity executives (21%).

Regardless of the state of the global economy, it’s apparent there are still millions of unfulfilled cybersecurity positions. In fact, 81% of respondents did note they expect cybersecurity threats to increase over the next two years so there is still plenty of awareness of the critical role cybersecurity now plays in enabling businesses to operate. It’s also worth noting that not all vertical industries are equally affected by a recession. The energy sector, for example, appears to be more resilient during a downturn than, for example, retail.

The days when cybersecurity professionals routinely ignore calls from recruiters because most of them felt secure in their current position are, for the time being, probably over. There are going to be fewer of those calls as more organizations from a hiring perspective look to stand pat as much as possible. At the same time, the number of efforts being made to automate as many cybersecurity processes as possible will only increase. In fact, some organizations are already starting to rely on generative artificial intelligence (AI) platforms to write controls.

Many cybersecurity professionals have weathered economic slumps before, but there are also many who have only entered the field in the last few years. There is always going to be a natural tendency to be concerned whenever an organization finds it necessary to retrench. Each cybersecurity professional will need to decide for themselves just how economically viable the entity they currently work for is both today and in the future.

In the meantime, cybersecurity professionals can take some comfort in the fact that compared to other job functions within their organization, their job is, by comparison, a lot more secure than almost any other.