Massive skills gaps in the cybersecurity sector mean that self-starters who upskill themselves now could quickly put themselves on rewarding and lucrative career paths.

This is according to Anna Collard, SVP of content strategy and evangelist at KnowBe4 Africa, who says a recent survey by KnowBe4 in South Africa and across Africa found desperate cybersecurity skills shortages, with employer’s keen to recruit in the sector.

Collard explained that the KnowBe4 Cyber Security Skills Pipeline survey found the biggest security hiring challenges facing respondents across industry sectors were finding qualified candidates with the right aptitude and level of experience. 56.7% said they could not find qualified candidates, 71.7% could not find candidates with enough practical experience and 50% said candidates did not demonstrate the necessary levels of attitude and aptitude.

The roles organisations most need to fill are cloud security professionals (58.3%), SOC analysts and threat hunting teams (53.3%) and risk, governance and compliance professionals (55%). Other top skills gaps include red teaming and offensive security professionals (48.3%), network engineering (36.7%) and security culture and awareness professionals (35%).

“On the one hand, we have massive youth unemployment, and on the other, we see a cybersecurity skills gap. Many universities have been too slow to create the skills pipeline that is needed, partly because this field changes so quickly. But the good news for people seeking opportunities in the sector is that they can start self-learning to open career doors for themselves,” elaborated Collard.

The survey found that most organisations do offer opportunities for juniors in the cybersecurity space, with 60% offering internships and 56.7% providing mentorship and training. Respondents said the certifications they found most useful for junior candidates include CompTIA Security+, Microsoft Azure Security Technologies, (ISC)² CISSP – Certified Information Systems Security Professional, CompTIA Cybersecurity Analyst CSA+, AWS Security foundation, OWASP certifications, ISACA CISM, and SANS GIAC Foundational Cybersecurity Technologies (GFACT).

Other useful certifications for junior candidates include Blue Team Security BTL1 Certification, practical product specific certifications and a B.Comm IS or Business Science degree.

“Many of these certifications can be achieved without going to a tertiary institution: self-starters can simply enrol for appropriate online training and start upskilling themselves,” she added.

Collard noted that a particularly interesting survey outcome was that employers give equal weighting to skills and attitude/aptitude when assessing candidates for cybersecurity positions. 88% looked for candidates who display logical thinking and problem-solving skills, 86.7% sought candidates described as motivated self-starters, 85% sought a positive attitude, and 68.3% said evidence of self-learning was important. In contrast, education and certifications were ranked as important by 53.3% and specific technical skills or product knowledge was rated as important by 40%. Other important attributes included self-motivation, the ability to work independently and remotely, good written and virtual communication skills, honesty, teamwork and a drive to self-study. Data analytics and some form of coding were also listed as valued skills.

“Many employers are willing to hire for aptitude more than for technical skills at this stage, which makes now the perfect time for young people to start training themselves. Among our partners, we are seeing interns being appointed on the strength of their positive attitudes and willingness to upskill themselves. We are also seeing young people opening doors for themselves by participating in hackathons and challenges, where they put themselves on the map and grow their professional networks. In this sector, you can progress very quickly, and if you show potential, you could quickly climb the career ladder to a very lucrative career,” she said.

KnowBe4 is currently collaborating with a local academic institution on potential programmes to fast-track cybersecurity skills development among local youths.