Security skills drought hits channel

Demand for talented penetration testing staff increasingly outstripping supply, report warns

A UK penetration testing skills drought is making life increasingly difficult for security SIs and consultancies aiming to recruit and retain top talent.

The gap between demand and supply of skilled practitioners, particularly those holding CHECK or CREST status, widened further in 2010, according to a report from Barclay Simpson.

"Both multinational and boutique consultancies have struggled to find qualified candidates to undertake CHECK work as well as unqualified but highly skilled penetration testers to undertake commercial sector work," stated the report, adding that end users in e-commerce and finance have also faced shortages.

That conclusion is backed up by security VARs on the ground, who say they are fighting tooth and nail to land talented penetration testers.

Steve Smith (pictured), managing director of security consultancy Pentura, said: "There are not too many who are sitting around without jobs. We have put a lot of time and effort into trying to create some loyalty for our guys."

Barclay Simpson laid the blame partly on the fact that exams are becoming more stringent. The introduction of the CREST scheme in 2008 - which it was anticipated would close the skills gap for CHECK Team Leaders - also failed to ease the problem because the number of other routes to accreditation decreased.

Smith added: "They have raised the bar to get CHECK Team Leader status so that it is tougher. But it proves they know their onions, so I am not against this."

Smith complained that fewer students were choosing IT as a career after being spooked by the job shortages that plagued the sector a few years ago. "The industry has never quite recovered from that," he said. "There is a huge shortage of IT employees, particularly in this field, and there is a huge opportunity for those who pursue this career."

The Barclay Simpson report, which covered the overall IT security recruitment market, said that many SIs and consultancies lifted recruitment freezes in 2010 that had been in place in 2009.

Most SIs and consultancies will continue to recruit steadily during the second half of 2011, with SIEM and IAM - as well as penetration testing - among the skills in demand, Barclay Simpson predicted.

There will also be an increase in demand for consultants with experience of PCI-DSS as the threat of financial penalties force more merchants to get their houses in order, the report added.

This will fuel a rise in the number of firms that become PCI Qualified Security Assessors (QSAs), of which there are currently only 41 registered in the UK.

Smith confirmed Pentura will be among those going for QSA status.

"Now PCI has teeth, more organisations are taking it seriously and there is more demand for PCI testing and for QSAs," he said. "It is logical for us to go down that route as it fits well with our CHECK and CREST aspirations and ISO 27001."