Home » Security Leadership » Career/Staffing

Career Advisor: The Most-Wanted Security Skills of 2007 (and Beyond)

An information security recruiter reports that risk management, threat modeling and metrics expertise are in high demand

December 17, 2007 — CSO — 2007 turned out to be good year for information security professionals looking to advance their careers. Corporations, professional services firms and product vendors all showed an increase in hiring activity in a variety of areas. Part of this is due to the fact that new technologies, services and regulations are requiring security professionals to get involved in a multitude of activities that will enable their companies to be competitive while remaining secure.

Not that everything was rosy. Many firms were determined to reduce the number of security professionals on their team or to remain stagnant; others expressed a desire to relocate some of their security services offshore. We anticipate this trend to continue in 2008, creating a tighter and more competitive market. That’s why it’s useful for security professionals to note the skills in hottest demand among our corporate clients in 2007--many of which will also help them make themselves attractive in the coming year. Here are the highlights of the most-wanted skills of the past year.

* E-discovery and litigation support. Electronic data is a component in virtually all civil and criminal litigation. Companies started focusing efforts on developing ways to better manage and catalog their data. This increased the demand for security professionals experienced in digital forensics and data protection who have knowledge of related legal requirements.

* Application security assessment and remediation. Application security has continued to be a major focus, as companies address the significant threats they face from application-related vulnerabilities and exposures. Candidates with the ability to develop internal programs to assess and remediate application vulnerabilities were in great demand, as were those who can educate developers on secure software engineering practices

* Threat modeling. Organizations whose business is based on information assets such as personally identifiable information, financial data and intellectual property began leveraging threat modeling techniques to understand and forecast their technology related risks. We expect to see continued strategic hiring of security professionals who have the ability and perspective to apply threat modeling and risk forecasting methodologies within the enterprise.

* Identity and access management. Hands-on identity and access management (IdAM) professionals continued to be in high demand, but those with a strategic focus were increasingly sought. It’s clear that managing user access is critical to meeting regulatory controls requirements. However, IdAM also is beginning to play a bigger role with increasing IT efficiency through process improvement, performance metrics and enhanced audit capabilities. IdAM professionals focu