According to Cyberseek.org's cybersecurity job tracker, there were more than 7,000 cybersecurity-related job listings in Michigan from April 2017 through March 2018, with more than 400 of those in the Ann Arbor area. But local cybersecurity experts say there simply isn't enough local talent to fill them.
Nicol Pasuit is the CEO of TechStak, an Ann Arbor-based B2B platform that helps small and midsize businesses outsource their tech work to vetted providers in fields ranging from web design and development to ongoing IT support, including cybersecurity.
According to Pasuit, that last part can be especially difficult for her clients, partly because many are thinking about cybersecurity for the first time and partly because there aren't enough certified providers to do all the work.
"The cybersecurity landscape is just expanding," Pasuit says. "Because it's a very complex and growing industry, there's this talent gap."
The problem isn't limited to the Ann Arbor area, as national and international trends show demand for cybersecurity workers outpacing available workforce. But local experts, organizers, and employers say our region also faces unique talent gap challenges, which they're working to overcome through education, inclusivity, and personal connections.
Planting the flag
Last week in Detroit, top students from across Michigan competed in the Governor's High School Cyber Challenge as part of the North American International Cyber Summit 2018. Competitors faced off inside Cobo Hall, but the real action took place in a virtual city called Alphaville, where students worked to claim as much real estate as they could, planting flags in different locations – city hall, the public library, public utilities – by manipulating lines of computer code. The group of 30 students was narrowed down from 600 who competed in a first round of the competition organized by nonprofit network Merit, as part of its K-12 educational outreach.
"It's basically a competition to see who can get into the most things, and it mimics real-world systems," says Merit spokesperson Pierrette Dagg. "In order to understand how to defend something, you have to understand how to penetrate it."
Founded more than 60 years ago, Merit is the longest-running research and education computer network in the United States. In addition to providing networking, security, and services to other nonprofits, government offices, and schools, the Ann Arbor-based nonprofit also houses and operates the Michigan Cyber Range, which is the largest unclassified cloud-based cybersecurity training environment in North America.
The secure, networked environment is used to teach response planning, team exercises, and cybersecurity, including more than 40 industry-recognized certifications.
One mission of the Cyber Range is to form public-private partnerships to help fill what Dagg calls the "cybertalent ecosystem." Programming is available for K-12 students, college and university students, workforce retraining, and veterans. Although all housed online, Merit also has physical "hubs" people can visit to take courses, including the Pinckney Cyber Training Institute at Pinckney Community High School, 10255 Dexter-Pinckney Rd. in Pinckney.
Dagg says the main reason for the region's cybersecurity talent shortage is lack of exposure.
"Since it's such a new industry, high school and college students don't really understand the career pathways that are out there," she says. "They don't understand it's not just one job. It's 30, 40, 50 different jobs they could be doing in all these different industries."
Another problem is lack of qualified teachers and instructors, which the Cyber Range also helps to fill. At the collegiate level, the organization's Merit Academy Program works with two- and four-year institutions, including Wayne State University and Western Michigan University, to convert its weeklong "bootcamp" sessions into semester-long courses students can take not only for college credit but also cybersecurity certification.
"It's a big challenge for colleges to offer these courses. ... You may not have enough interested students to take a course, or you may have three students in one area, but because the talent gap is so wide, there's a drastic shortage of teachers that are qualified to teach the material," Dagg says.
Making connections
Even with a certification, it's not always easy for job seekers to get plugged into the workforce.
That's according to Kristin Judge, CEO and president of the Ann Arbor-based nonprofit Cybercrime Support Network. Judge has also worked with the University of Detroit Mercy's (UMD) Cybersecurity and Intelligence Studies Center's advisory board, as well as the National Initiative for Cybersecurity Education launched by President Obama.
Judge also mentors university students, and she says schools and companies could communicate better with each other to help students transition to the workforce.
"There are some good companies that say, 'We can't find the interns,' and some universities that say, 'We can't find the companies who want interns,'" Judge says. "No one's connecting the two."
Judge also says HR managers might need to reevaluate their job postings when hiring cybersecurity workers, since the best talent may not fit their traditional search. She points out that passing over talent like this could leave them open to recruitment by criminals who are less concerned with appearances and degrees than raw ability.
"You have to be willing to take someone who may have a piercing or who may not have a four-year degree, but they may have a certification that's really important," she says. "The kids who have grown up with computers and were writing Linux code by the time they were 10, they may not look like your typical candidate for a job, but you still want them on your team."
Underscoring that point, Trey Boynton, diversity and inclusion manager at Ann Arbor's Duo Security, says the one question asked of every Duo hire is: "What makes you unique?"
"Cybersecurity requires divergent thinking to keep us one step ahead of attackers," Boynton says. "Security engineering isn't like traditional engineering, in that people have to consider what other people are not thinking about."
All Duo job postings are accessible and feature an inclusion statement, and Boynton says the company has shifted from focusing on culture fit to who can bring new perspectives, ideas, and backgrounds.
"We have plenty of team members who come from 'non-traditional' backgrounds, such as music majors, teachers, and artists, who develop our software," she says. "Our primary focus is attracting individuals that can come in and add to our capabilities and strengths, while also making sure that we can help them excel in their careers and goals."
Stopping the drain
As director of UMD's Center for Cyber Security and Intelligence Studies, Tamara Shoemaker has spent years training students for jobs they weren't likely to find in Michigan once they graduated.
"I hate to say this, but we in the Midwest are really behind," she says. "We have not taken it to heart like the D.C. area and the East Coast and the California folks have. ... You have to prove it to us before we need it, but the minute they started hacking cars, everybody got religion. They're now on board. We're just playing catch-up."
For the last four years, Shoemaker has been doing outreach work in schools across Michigan. She brings cyber safety and awareness curriculum to grades K-5, and CyberPatriot, a national youth cyber defense competition, to middle and high schoolers.
She says working with kids early helps get them involved and keep them engaged through middle school, when many educators tell her they see the biggest dropoffs in diversity and inclusion of young women.
In a time when everyone wants more STEM education, Shoemaker says cybersecurity is "STEM on a plate and served up."
Shoemaker says a common misconception is that cybersecurity work is all "one and zeros" and only appeals to a "programmer type of a personality." But many jobs actually feature little to no programming. For example, a systems auditor might need to be aware of all the components and policy that make for good cybersecurity without ever working with code. Working through CyberPatriot, students are exposed to a variety of roles. Many who didn't plan to work in STEM when they started the program report that they're considering it when they finish.
Shoemaker knows many of her students will still migrate to the coasts where they can make more money after graduating. But she believes CyberPatriot's focus on service to community and building and maintaining infrastructure will encourage more of them to stick around and help grow Michigan's talent pool.
"I'm happy as heck. We've all been training our kids and sending them out of the state," she says. "There wasn't anybody here who wanted to hire them, but now they're screaming for them. … We stopped the brain drain finally."
Eric Gallippo is an Ypsilanti-based freelance writer.
All photos by Doug Coombe.