[BreachExchange] America's IT Security Workforce Tops 100, 000 for First Time

[Destry Winant]

http://www.databreachtoday.com/blogs/americas-security-workforce-tops-100000-for-first-time-p-2510

The workforce of information security analysts in the United States
has topped 100,000 for the first time, more than doubling since the
Department of Labor's Bureau of Labor Statistics began publishing
full-year statistics for the occupation category in 2012.

The IT security analyst workforce reached an annualized 104,800 for
the second quarter of 2017, up from an annualized 45,000 from the
first quarter of 2012, the first time BLS published data for what was
then the new occupation category labeled information security
analysts, according to an Information Security Media Group analysis of
Labor Department data. That's an increase of 133 percent over that
past 5½ years.

A year ago, the annualized information security analysts workforce
stood at 80,500. In the past four quarters, the workforce soared by
24,300, a 30 percent increase.

The data suggests that more individuals saw employment opportunities
in information security occupations and began seeking jobs in the
field. "Some of this is doubtless real - recognition, finally, that
investing in cybersecurity is critical to managing organizational
risk," says Franklin Reeder, co-founder and director at the Center for
Internet Security, which manages the Multi-State Information Sharing
and Analysis Center. "Much of the increase, however, may be an
attribution game. Individuals who may have had other job titles now
are called, or call themselves, information security analysts, because
it is sexier and pays more."

Each month, the Census Bureau surveys about 60,000 households for BLS,
the same survey used to produce the monthly unemployment rate. Survey
takers interviewing households ask respondents characteristics about
their jobs and then determine their appropriate occupation category.

Suspiciously High Unemployment

Based on the latest monthly surveys, the unemployment rate among IT
security analysts has soared to a record - and suspicious - 6 percent
in the second quarter of 2017, according to our analysis,
uncharacteristically high for the IT security field. But economists
point out that as an occupation gains popularity, more people seek
jobs in their new field, reflecting higher unemployment until they
find employment in that field. Over the years, our analysis shows the
IT security analysts' unemployment rate rarely tops 3 percent; often
it's lower.

Keep in mind, because of the relatively small size of the IT security
analyst workforce, the data for this occupation classification isn't
considered statistically reliable, and that's why the bureau does not
publish the quarterly occupation figures on the BLS.gov website,
although it makes them available upon request. To boost the
statistics' reliability, BLS economists recommend annualizing each
quarter's data by adding the four last quarters' numbers and dividing
the total by four. That's the process we follow.

Statistical Anomaly?

The past quarter's jobless rate of 6 percent is more likely a
statistical anomaly, says Larry Clinton, president of the trade group
Internet Security Alliance.

"Full employment is generally considered around 4 percent
[unemployed], so I wouldn't put too much stock in 6 percent number
given the small sample size," Clinton says. "What I am seeing in the
field is a substantial demand with organizations poaching cyber
professionals, which could result in some short-term unemployment. I
think any suggestion that the cybersecurity market is in any way
saturated would be extremely premature."

Among the 840 detailed occupation categories BLS tracks, information
security analyst is the only one that specifies IT security in its
description. BLS defines information security analysts as those who
plan, implement, upgrade or monitor security measures for the
protection of computer networks and information. They may ensure
appropriate security controls are in place that will safeguard digital
files and vital electronic infrastructure and respond to computer
security breaches and viruses.

Many other occupations inside and outside the computer field, however,
include IT security as part of their responsibilities. Those include
computer network architect, software developers and network
administrators. Here's our latest calculation of the workforce size of
all BLS computer occupations:

Computer Occupations Workforce

Second quarter, 2017

Occupations, Size
Computer and information systems managers, 630,800
Computer and information research scientists, 24,300
Computer systems analysts, 551,800
Information security analysts, 104,800
Computer programmers, 475,000
Software developers, applications and systems software, 1,536,000
Web developers, 228,300
Computer support specialists, 561,800
Database administrators, 86,800
Network and computer systems administrators, 220,800
Computer network architects, 104,000
Computer occupations, all other, 653,500
Total, 5,177,500
Source: ISMG analysis of U.S. Bureau of Labor Statistics

Why do we report this information if the statistics are unreliable?
The BLS stats are the only data available that describe the size of
the IT security workforce in the United States. Our thinking: We'll
provide you with the available data, with all the caveats that go with
them, and let you decide their merits.

I've been conducting such analysis since the beginning of the century
- even before I joined ISMG - and have found BLS data to fairly
reflect employment trends in IT and IT security over the years. Still,
from one quarter to another, anomalies surface in the data, but over
the course of quarters and years, they tend to even out.