Cy Says Blog & Podcast

In the digital age, where information is power and data breaches loom large, having a robust cybersecurity team is non-negotiable for businesses. However, the path to assembling such a team is not a one-size-fits-all scenario. Companies often face the dilemma of whether to buy, build, or borrow talent for their cybersecurity endeavors. In this blog post, we’ll explore these approaches, weighing the pros and cons to help you make an informed decision. In this week's LevelUp Cyber Live, we covered the concept of building, buying, and borrowing talent. 

Buying Talent: The Fast-Track Solution

When time is of the essence and expertise is urgently needed, buying talent seems like the logical choice. This involves recruiting seasoned cybersecurity professionals externally, sometimes at a premium cost. The advantages include immediate access to expertise, specialized skills, and an existing network of industry connections. However, the downsides encompass high expenses and potential cultural integration challenges within the existing team.

Building Talent: Cultivating Homegrown Experts

Building talent refers to investing in existing employees or new recruits and nurturing their skills through training, certifications, and hands-on experience. This approach fosters loyalty, ensures a deep understanding of the company’s systems and values, and is often cost-effective in the long run. On the flip side, it demands time, patience, and consistent investment. Additionally, the evolving nature of cybersecurity requires continuous learning and adaptation, making ongoing training a necessity.

Borrowing Talent: Collaborative Solutions for Flexibility

Borrowing talent involves outsourcing specific cybersecurity tasks or projects to third-party experts or agencies. This approach offers flexibility, scalability, and cost-efficiency. Organizations can access a pool of specialized skills without the burden of long-term commitments. However, communication challenges, potential security risks associated with sharing sensitive information, and the need for stringent vendor management are key concerns.

The Hybrid Approach: Striking the Right Balance

In reality, many organizations opt for a hybrid approach, combining elements of buying, building, and borrowing talent. This strategy allows for flexibility, enabling companies to scale their cybersecurity efforts according to their needs. For instance, they may hire experienced professionals for critical roles, invest in training programs for existing employees, and collaborate with external experts for specialized projects.

Apprenticeship Intermediaries Role in Buying, Building, or Borrowing

Apprenticeship intermediaries play a pivotal role, providing a unique solution that integrates seamlessly with the concepts of buying, building, or borrowing talent. These intermediaries act as conduits, connecting businesses with skilled professionals and fostering an environment where novices can learn from seasoned experts. For companies opting to buy talent, apprenticeship intermediaries curate a pool of pre-trained cybersecurity specialists, ensuring a swift and efficient onboarding process. In the context of building talent, these intermediaries facilitate structured apprenticeship programs, where aspiring cybersecurity professionals can gain practical experience under the guidance of mentors. This not only nurtures homegrown talent but also creates a sustainable pipeline of skilled individuals tailored to the organization’s specific needs. Moreover, for those looking to borrow talent for specific projects, apprenticeship intermediaries offer a roster of agile, adaptable apprentices who can seamlessly integrate into collaborative ventures. By bridging the gap between theory and practice, these intermediaries not only support businesses in their talent acquisition endeavors but also contribute significantly to the growth and dynamism of the cybersecurity industry as a whole. Their role is not just transactional; it's transformational, shaping the future of cybersecurity by empowering both businesses and budding professionals to thrive in the digital landscape.

Conclusion: Making the Right Choice

The choice between buying, building, or borrowing talent for your cybersecurity team depends on various factors such as budget, timeline, existing skill sets, and the nature of your cybersecurity needs. A careful evaluation of these factors, coupled with a clear understanding of your organization’s goals, can guide you toward the most suitable approach.

Ultimately, a successful cybersecurity team is not just about the individuals involved but also the collaborative spirit, continuous learning, and adaptability ingrained within the organization’s culture. By investing in the right mix of talent acquisition strategies, businesses can build a resilient cybersecurity ecosystem that safeguards their digital assets in an ever-changing threat landscape.

In the pursuit of cybersecurity excellence, the key lies in making informed decisions, leveraging the strengths of your team, and remaining agile in the face of evolving challenges. Whether you choose to buy, build, borrow, or blend these strategies, the ultimate goal remains the same: fortifying your digital fortress against the myriad threats lurking in the virtual realm.

Security teams face mounting challenges including budget cuts, staff shortages, and an overwhelming volume of alerts. It's a high-stress environment demanding efficient use of limited resources. A recent article from CSO Online outlined the daily struggles of these teams - it's clear they're bogged down. But in focusing on the problems, the author overlooked a major opportunity: apprenticeship programs.

The article highlighted specific tasks that consume security teams, like responding to alerts, reviewing suspicious emails, and compiling audit data. To identify which activities are slowing your team down, regularly ask which tasks they would delegate to new staff if given the chance. Bringing on apprentices could provide real relief in these areas. With proper training, they can efficiently triage alerts to reduce senior staff workloads. Apprentices will competently handle initial phishing investigations too. And they can prepare audit materials while learning systems firsthand. 

Before launching any program, we get to know our employer partners in depth - their culture, talent needs, and key initiatives. This diligent discovery process lets us hand-pick applicants who will hit the ground running and create value immediately through their contributions.

For example, CyberUp recently placed a cohort of apprentices across various departments with Centene Corporation, including roles in security operations, incident response, and compliance. This allowed Centene to bring in extra support and new perspectives tailored to their unique needs.

The CyberUp apprentice at the Federal Reserve Bank of St. Louis performed so well that they were converted to a permanent position months ahead of schedule. This demonstrates how apprentices can quickly become invaluable contributors. The apprentice rotated through several departments which not only taught them more in a short amount of time but also increased the entire team's bandwidth. Their passion and accelerated on-the-job learning resulted in their early promotion.

At Barry Wehmiller, a CyberUp apprentice assists with managing quarterly phishing simulation campaigns. This gives Barry Wehmiller’s security team valuable help with this crucial awareness activity while developing new talent. The apprentice handles administrative tasks like campaign scheduling, reporting, and training coordination. They also gained hands-on experience developing phishing email templates and landing pages. This freed up a significant amount of time for the security team and allowed them to focus on higher-value tasks.

These real-world examples show the power of apprenticeships for cost-effectively expanding security teams. By leveraging CyberUp's expertise, leading organizations have driven productivity gains and strengthened their talent pipelines.

Apprenticeships are a low-risk investment because of their low cost and flexible structure. They provide capable help for essential tasks. Bringing in new perspectives and energy also reinvigorates teams. It’s a win-win - you cultivate junior talent while alleviating pressure on veterans. 

Rather than waiting for others to solve staffing problems, security managers should take the initiative and build apprentice programs now. Start small if needed, but get talent in the door. Give them hands-on work that drives learning. Doing so may uncover your next rockstar while taking pressure off the senior team.

It's time to take control and build the future security team you need. CyberUp makes launching an apprenticeship program easy, and the long-term benefits of an expanded, well-rounded team make this investment in new talent worthwhile.

Dillon Jareo joined the CyberUp team in December 2022. He is part of our LevelUp Apprenticeship Team and supports our candidates and employer partners in meeting their current and future hiring needs. He brings a passion and commitment to serving others and growing the nation's non-traditional workforce in cybersecurity. 

What do you do at CyberUp?

As a business development manager at CyberUp, I focus on building strong relationships with our employer partners. I serve as a liaison between our partners and our organization, conducting meetings, preparing candidates for interviews, and staying current on industry trends. I enjoy collaborating with our partners to understand their hiring needs and match them with qualified candidates from our training programs.

What is your favorite part of your job?

My favorite part of the job is finding the perfect candidates for our employer partners' open roles. I love collaborating with our partners to fully understand their needs, and then working to identify applicants who are a great fit. It's incredibly rewarding to see these candidates develop their skills through our apprenticeship program and thrive in their new positions. Being able to facilitate strong matches between candidates and employers is the most fulfilling aspect of my role.

What did you want to be when you were growing up as a kid?

I was interested in so many different things as a kid that I never settled on one career aspiration. But no matter what, I've always enjoyed helping people. I'm grateful to have found a career where I get to focus on building relationships and helping our partners and candidates succeed.

What is your go-to song for karaoke?

With my tone-deaf vocals, I wouldn't dare subject anyone to my karaoke skills! I prefer to let my tunefully gifted friends take the mic while I cheer them on. Though I lack singing abilities, I make up for it with spirited audience participation. I'm always down for a fun karaoke night - I just save the singing for my car and shower!

What is your favorite book to recommend?

My 2023 top book recommendation is To Sleep in a Sea of Stars by Christopher Paolini. This epic sci-fi adventure follows an astronaut who makes a discovery that propels her into an intergalactic war. Paolini builds a stunning space opera universe packed with action, mystery, and imaginative concepts. For an immersive read unlike any other, I highly recommend this thrilling saga.

What is one piece of advice you would give someone to “LevelUp” their career?

My advice for leveling up your career is to set clear goals and hold yourself accountable. Identify specific skills you want to develop or positions you aspire to, and map out the steps needed to get there. Track your progress and routinely assess if you're on pace. Stay focused on your objectives, and don't let setbacks derail you. Share your goals with a mentor who can advise you and keep you motivated. With drive, self-discipline, and determination, you can elevate your career to new heights. Defining your aims and following through is crucial for advancement.

In today's dynamic job market, the technology sector continues to experience rapid growth, with cybersecurity emerging as a critical domain. As organizations grapple with the challenge of finding skilled cybersecurity professionals, various approaches have been devised to bridge the talent gap. Two prominent methods are traditional staffing firms and apprenticeship placement models like CyberUp's. In this blog, we'll delve into the key differences between these two approaches, shedding light on their distinct characteristics, benefits, and considerations.

Defining the Models:

Staffing Firms: Staffing firms, also known as recruitment agencies or employment agencies, act as intermediaries between employers and job seekers. They source, evaluate, and present candidates to companies seeking to fill specific positions. Staffing firms operate across various industries and domains, connecting companies with temporary, permanent, or contract employees.

CyberUp's Apprenticeship: CyberUp's apprenticeship placement model focuses on developing talent through hands-on training and real-world experience. It provides a structured pathway for individuals looking to enter the cybersecurity field, particularly those with strong professional skills but who are simply new to cybersecurity. Apprentices work under the guidance of experienced mentors, gaining skills through practical projects and tasks. This model aims to bridge the skills gap while helping apprentices transition into permanent roles.

What are the 4 Differences:

• Approach to Skill Development:
  • Staffing Firms: Staffing firms primarily match candidates' existing skills and qualifications with job requirements. While they may provide some training and resources, their main focus is on identifying candidates who are already equipped with the necessary skills.
  • CyberUp's Apprenticeship: CyberUp's approach emphasizes skill development through hands-on training and mentorship. Apprentices gain practical experience working on real projects, enhancing their skills in a real-world context. This model is particularly beneficial for individuals looking to transition into cybersecurity from different backgrounds, as it offers a learning pathway that bridges the skills gap.
• Duration and Nature of Engagement:
  • Staffing Firms: Staffing firms often facilitate short-term or contract-based placements. While some placements may lead to permanent positions, many are temporary in nature, which may not provide long-term stability for job seekers.
  • CyberUp's Apprenticeship: Apprenticeships typically span a more extended period, often ranging from several months to a year or more. This longer engagement allows apprentices to immerse themselves in the cybersecurity domain, acquire practical skills, and build a solid foundation for future career growth.
• Alignment with Industry Needs:
• • Staffing Firms: Staffing firms focus on immediate job placements, aiming to meet employers' immediate staffing needs. They may not always have a direct focus on skill development to address the broader skills gap in the industry.
  • CyberUp's Apprenticeship: CyberUp's model is designed to address the cybersecurity skills shortage by fostering skill development from the ground up. By providing apprentices with relevant training and mentorship, contributes to building a more skilled and capable cybersecurity workforce.
• Potential for Long-Term Employment:
  • Staffing Firms: While staffing firms can lead to permanent placements, the focus is often on filling immediate vacancies rather than cultivating long-term career growth.
  • CyberUp's Apprenticeship: CyberUp's model aims to not only prepare apprentices for cybersecurity roles but also to facilitate their transition into long-term employment within the industry. By offering practical experience and mentorship, it positions apprentices for sustained success in the field.

Conclusion:

Both staffing firms and CyberUp's apprenticeship placement model have their own merits, catering to different needs within the cybersecurity job market. Staffing firms provide immediate placement solutions, while CyberUp's innovative model offers a more comprehensive approach to skill development and addressing the industry's talent shortage. As the technology landscape evolves, exploring these different models can help job seekers and employers make informed decisions about the pathways that align with their goals and needs.

Kyauna Cambell joined the CyberUp team in May 2021. The team met her in 2020 when she participated in our first LevelUp Training cohort in St. Louis. Her passion and dedication to others shined throughout the class and when the role opened up she was the first person who came to mind to hire. She has grown tremendously in her role with us and continues to drive all recruitment and training for our apprentice candidates. 

What do you do at CyberUp?

I am the LevelUp Training Coordinator.

What is your favorite part of your job?

Helping Candidates through their journey of self-discovery while they are learning new life-changing technical skills.

What did you want to be when you were growing up as a kid?

A Lawyer!

What is your go-to song for karaoke?

The Fugees - Killing Me Softly

What is your favorite book to recommend?

Anything by Toni Morrison

What is one piece of advice you would give someone to “LevelUp” their career?

While technical skills can be learned, life/soft skills are still quite important. Companies are still searching for Customer Service, Management/ Leadership, and Communication skills. Continue to build these and many other soft/life skills that remain in high demand.