The ’Future of Work’(in Cybersecurity) Is Probably Not What Folks Think
- [Lecturer] We're gonna get started here pretty quickly. The way I'm gonna run this session is I'm probably gonna be walking around. It's gonna be very different than the sessions I've done at other RSAs, where I've talked about your pay and what I think the hot jobs are.
If you know anything about our firm, you know, we get into very deep current data on what certifications are worth and all that stuff. We put all that in the addendum. There's an addendum. If you look at the slides at the very end. I'm not gonna be presenting from that addendum, but I'm gonna give you, there's a lot of data that may help you if you're thinking about your career in terms of your pay. And if you're thinking in terms of getting a certification or another certification or what skills are in most demand right now.
We measure that to the nth degree and we put it in terms of cash. So all that at is at the end. But the presentation then I'm gonna make today, is gonna be, it's very different. This presentation has created a lot of storm in audiences I've presented it to, because you know, the future arrives unannounced and you've heard a lot in the media about technology, things like generative AI and all of that and the implications of that. But I wanna talk about what I never read because I'm an analyst. I've been an analyst for, you know, 25 years.
I was at Gartner, I was at another company. I started my own firm 25 years ago to improve the quality of research, not driven by vendors, but independent thinking. And I talk to 4,200 companies across all industries in the public sector, and they tell me things, so I can't repeat them and attribute them directly to them because of NDAs. But a lot of what I read about the future of work, I'm not buying into, I don't think it's right, it's not what I'm hearing. It might be what vendors want you to think or institutions want you to think.
And we're very independent and I wanted to present some points of view, but I'm gonna do it in a way that's gonna, in a very specific ways, there are five things that you can do when you're thinking about your job or your career going forward, given the incredible uncertainty about the future, not just about technology, but social shifts, generational shifts. How many people in this room are under the age of 27? Anybody? Who's, those are the Gen Zs. How about from 25, 27 to 42? How many people in this room? Okay, what generation are you? You're the Millennials, right? So there are big generational changes in terms of employment and jobs.
So we're gonna talk about some of that and we're gonna talk about some of the social changes too, 'cause all of this is germane to how you decide to choose the work that you do. But I'm gonna give you five specific choices you have to make and I'm gonna do it over the next 10 years. But I'm gonna give you a lot of information that'll help you to make those choices hopefully, if you want to be successful in your career.
If that's something and you want to be happy. So it's all predicated on that. I wanna start with this very interesting McKinsey & Company finding or prediction. Does this seem unusual to you? "More than 50% of all revenues over the next five years will come from things that don't even exist today."
Make sense to you? That's pretty stunning when you think of it, particularly if you're working in something that exists today and you're being told that half of you will be earning money, probably working for companies that are not in existence today, or products and services not in existence. So what does that mean for all of you? It means you're gonna be involved in design and build a lot more than you're gonna be involved in maintenance and support, including if you work in cybersecurity. 'Cause cybersecurity has become a business issue now.
It's talked all the time at the board level. They run through filters all the time about if we launch this product or service, will it be secure? Are people going to complain? Is it going to be an issue? Security, as an example. Here's the CEO of Google Alphabet, Sundar, and look what he's saying. "Five to ten years from now, you're gonna have an AI collaborator working for you." You're gonna come to work and you're gonna be working with a machine. There'll be other humans you're working with, but a machine will be informing you about some aspect of your job.
He used an example of a radiologist. So a radiologist comes in, he's got 100 cases, but he's only got 8 hours, 10 hours in his day. Which of those 100 cases, which are essentially saving of lives, which of those should he prioritize? The idea of an AI collaborator saying, "Of all 100 cases that you have there, you can review them, but there are 10 where you have the best chance of saving a life." Wouldn't you like to have that Superpower Assistant? Well that's in five years, according to this guy. This SVP of technology and society at Google has a slightly different view.
He takes it one step further. I want you to listen to this. This was on "60 Minutes" two weeks ago, about AI. - A lot of people can be replaced by this technology. - Yes, there are some job occupations that will start to decline over time.
There are also new job categories that will grow over time. But the biggest change will be the jobs that will be changed. Something like more than 2/3 will have their definitions change, not go away, but change because they're now being assisted by AI and by automation.
So this is a profound change which has implications for skills, how do we assist people, build new skills, learn to work alongside machines and how do these complement what people do today? - [Lecturer] So the media likes to talk about the jobs that are going away. Not so much the jobs that are created, but it's always about, is your job going away, is your job going away? The issue really is not how your job is going away, it's how your job is changing. And if you understand the changes that are gonna be happening, whether you're working in data privacy, or risk, or governance, or information security, or cyber security, I'm gonna try to help you understand how these changes are gonna happen over the next 5 to 10 years. The questions I think we should be answering is, what is it that most people don't understand about this so-called future work? In fact, what is the future work? So I'll give you that definition.
A variety of fast-moving technologies are changing everything I mentioned just one, AI. There are nine more I want to talk about today in the time that we have. How will they impact, you know, your job and career choices? And lastly, how should you be thinking about your job and career going forward in this scenario? Okay, so these are the questions that I wanna try to answer today. Now when you see that figure, that little man and those decision points, these are, when you see that, that to me is a decision tree. So focus. So that is a slide that I want you to think more about.
This is where you have a decision to make. All right, but your time has arrived because right now there's a shortfall of you know, 3.5 million jobs in the world, about a half million in North America in terms of a workforce gap. They want, they don't have these people to hire. It's good for you. It's the best I've seen in 25 years, and I've been strictly an analyst on tech workforce for 30 years.
So it's really the best I've ever seen. But you're completely on your own. I don't see a lot of companies yet helping people think through their jobs and career choices in this area.
And this is what we're gonna talk about today. Okay? Here's the bottom line. I'm gonna get to the very bottom, very end of this presentation right here. I think you have specific choices in five areas.
Your ability to be successful in your job and career choices is how well you make choices in terms of the industry you choose to work in. 'Cause in terms of, particularly technology, it's not affecting all industries the same. Like right now I would say, you know, this generative AI is probably hitting the automotive industry, the wealth management industry, and pharmaceutical industries having the most impact at this moment. Three months from now, it's gonna be different 'cause it's working very, very fast. So the idea is you have to choose the right industry, I think for your success, personal success.
What are the emerging technologies that you have to choose from? Which ones will you focus on? So we'll talk about 10. The next is how well you, this is really important, this third one, how well you match up to the culture of your employer. So many people choose the wrong employer for them and it holds them back in terms of what makes them different. It's the distinction they bring to their jobs.
They just make a terrible job of choosing employers that don't support them in the way that they need to be supported. This is really important and it's coming up again and again and again, post COVID because people have gotten very specific now that they've worked at home and they've had a chance to think about it. They've got very specific as what they need to be successful. So this is, and employers are really paying attention to this 'cause they're losing people right and left over cultural, basic culture issues. The form of employment you choose, full-time.
How many of you are full-time in this room? Work full-time? How many of you work in some other capacity? Part-time, consultant? You know, so not many. There's this new designation called career nomad. It's also called an interim professional. You don't have to be 27 years old or you know, a Gen Z to be in this job. I know people who are Millennials that are in this job and it's not the same as a gig worker. So we're gonna talk about that choice that you have to make and the kind of person you have to be to succeed in that.
And lastly, soft skills. Soft skills is talked about all the time, but companies are telling me, we're willing to pay for this. We're willing to pay money for soft skills.
In fact, when we review CVs that we get from LinkedIn or you know, analyses we get from our recruiters, we are focusing on soft skills. We're asking questions like we wanna know how they manage under stress? How good are they under stress, for instance? They're very specific. It's not that the technical skills and stuff that you've done doesn't matter, but they're realizing their ability to bring in a certain number of soft skills that have become more important to them than they were two or three years ago are important. Soft skills are compensable and it's tough because a lot of soft skills that we have, the best ones, we learn from our parents, frankly, it's very hard to learn.
You can learn a technical skill anytime. A business skill, anytime. A soft skill you can learn. It's just harder.
But I'm gonna go through the ones that we're hearing are the ones that they're looking for, the most important for you guys in this room. A little bit, I mentioned a little bit of this. I just want you to know that some of the insights today are coming from our research, fresh research, it involves 6,300 companies, 15 countries. I'm gonna talk mostly about North America research today and this is what we focus on.
So it's not gonna be stuff I've just pulled out of third parties, other people's, some of it I have because I want to, I want to make it not just about our point of view, but other points of view. So what does future work really look like? Well, here's the definition. I've kind of already talked about this. It's the technological, generational and social shifts that are impacting our work, what we do and how we do it, heavily influencing what we do.
This is an interesting slide if you can, if you guys can't see it in the back of the room. On the left is pretty much the job families we have today, the departments and companies. You know, we have engineering, we have HR, we have research, we have product development, we have sales, we have finance, we have accounting, stuff like that. Look where they're going.
Let's say just focus on information technology. So in the future, your job function in IT will probably be heavily either in cloud computing, you will be moving into really focusing more on a cloud computing environment. Specific cloud computing platform or data management, data security, data privacy, AI and those are those, I'm sorry I don't have a pointer, but those are those thicker blue lines.
And then you know, at the top and in the middle. And then the other sort of most prominent areas that you'll be feeding into are product development, and many of you will continue in engineering. So think about this. You're not just IT people. You're not just techies, you're basically business.
You're on the business side. Many of you are right now, but this is where we think the feeders are going right now. And the McKinsey Global Institute put some numbers on it. See, that's very different. Think of yourself at what part of the, where in the business you're gonna be working. Not where in the field of technology you're gonna be working or security, but what part of the business are you gonna be working in, applying the skills that you have? This is the one I talked about, career paths being less linear.
Those of you that have children, you know, in their late 20s or under, anybody in this room? They're very different their job searches. They don't wanna work for companies for a long time. They're suspicious. They have friends that have worked at Google and had spectacular reviews, done very well and got laid off.
They no longer trust employers. But what they want to do is work maybe once you know, every year, change their job and they want to be able to have side hustles. These are two examples. One woman on the left, woman on the right, they have full-time jobs, but when they're not working that job, evenings, nights, they're influencers.
They have a second career making money. Why is this a good thing? It's a good thing because number one, they're not asking you for more money. They're not hitting you up for a higher pay because they're supplementing their pay.
The other thing they're doing is they're learning skills that they can use on the job. They're learning skills as entrepreneurs. And that's not just, you know, influencers. There's all kinds of people in their 20s that you should encourage to work, have occupations outside of the full-time work. It's not taking away anything from the job they're doing for you. It's adding to it. It's giving them skills.
And by way, if you think that you can keep them, you can't. These are, I mean, I have a 24-year-old daughter who has gotten three promotions in 18 months in a really good tech company in the music industry. But she's leaving.
She said, "No, it's, I love working here, but I'm moving on to the next thing." Horrible to think, you know, how can you do this? But they're very confident about what they know and what they don't know and how they can get information. They're a digital generation. They have no fear when it comes to work and not working. They know that they're, they have skills, they're confident in a way that we weren't, if you're a Boomer in the room.
It's a whole different way of thinking. And mainly it's knowledge workers that have this opportunity. But it's really, it's a big thing.
Okay, can you be an interim professional? Can you be a career nomad? Companies are hiring them for four main reasons. To fill in for workers that are on extended leave. It could be a pregnancy, it could be a mental health leave, it could be because you're taking care of disabled, your older parents or a disabled household member. They'll fill that in with these career nomads.
They'll use it to test new markets, pilot programs, you know, low risk initiatives, you know roles, and they're not sure they want to hire full-time. They'll test and companies sometimes just need disruption. Interesting thing to become one of these. It's not a consultant, it's not a contingent worker. It's an interim professional and how are they different? This is how they're different. These are the critical success factors you have to have if you want to be one of these.
Anyone in this room can be one of these, if you're not happy in what you're doing. But if you love a passion, you have a passion for new challenges and solving problems, you have an ability to understand very and access very quickly and assimilate into organizations without getting caught up in politics. If you have the technical skills, high emotional intelligence, emotional intelligence, or your ability to read people, their emotions, to process that, that's very important.
Companies are dying to get people with high emotional intelligence and I'll tell you why in a second. What is happening right now and will be intensifying in the future to make soft skills and emotional intelligence so important. And they're just people who can, they're confident with ambiguity and it's not everybody who can be one of these and they want a flexible work schedule. This is an option for you. What's your play? This could be you.
Pandemic exhaustion. I have to talk about this. It's changed everything. Do you know about half of the CISOs that we talked to are burned out enough, they're thinking about leaving, not being a CISO and not being a leader in the security field.
It's very high risk. Here's a stat that 1 out of 4 CISOs right now want to say goodbye to security. Just burned out. So companies are aware of this and I think this is not something you haven't heard of before because this idea of paying more attention to the human side of things has been become very important, particularly with remote work and workers not wanting to come back to the office and stuff. They're paying attention. But this is how we've quantified it.
Here's a chart that shows on the bottom, this is about what employers think their employers want. So on the bottom are employers, the X axis. The Y axis is employees. So everything here, from here over, employers think are the most important things that their employees want.
Same up there at the top. Most important, going horizontally. Ideally, this should be a straight line and all the points should be on that line that employers and employees completely agree on what employees want. But it's not. It's all over the map. Most employers will say what they most want is work-life balance and more pay.
That's what they believe employees want, their employees want. What happens when you ask employees, that's what they want. That's the most important thing they want, is to be valued by the organization, valued by their manager, and have a sense of belonging in the organization. What a mismatch. What a mismatch. Now this has been going on for years, but it's really hurting companies that don't get it. It's Abraham Maslow's Hierarchy of Needs.
This was done in 1943. Most if you've ever had a course in psychology, you've studied Maslow's Hierarchy of Needs. It was a paper he wrote on the theory of motivation, what motivates people. So for a long time companies just felt, "Oh, the psychological needs of the employees, we're okay with that."
The physiological needs, the safety needs. They just assumed that. And they were always looking for self-actualized people, people that really wanted to be high performers, but they were wrong. And they saw that during the pandemic years. What they saw is that they were completely wrong.
They were not taking care of the psychological needs. And what happened is their workers started leaving, it became an employee's market. They just said, "Look, I'm working from home. You want me to come in the office? I quit." There were so many quits, you know about this.
The great resignation. I'm not telling you something you already know, but I look at in terms of how badly employers were connected to what their employees wanted. And I also look at, in terms of the Hierarchy of Needs. Let's drill it down to cybersecurity. ISC Squared study last year. They said, "Here's what's unique about the cybersecurity workforce.
They have a passion for what they do." Not that a lot of people don't have passion, but they specifically have a passion for what they do, 'cause it's hard. And that, "Employees need to be supported by their organizations in this passion." So what's interesting, that's happening now, is that what we see is these changes in teaming and sort of managerial jobs. I'm gonna cite Gartner now.
I could cite our own data, but I think our data's pretty close to what Gartner's saying. "Almost 3/4 of all managerial tasks will be automated by the year after next." If you're a manager, what does that mean to you? If you aspire to be a manager, what does that mean to you? "By 2024, 30% of corporate teams will be without a boss. This will require an environment of trust, collaboration, and high-performance work teams."
My daughter's in one of these ones or one of these high-performance teams right now. She's 24 years old. Their manager left. They never replaced. I says, "Well how do you guys manage your team?" They said, "Well we go, you know, everybody gets a chance to lead." And I said, "Well how's your performance after the manager left?" They said, "Our performance level is higher now that we're managing our own performance, better than when." "So what do you miss most about the manager having left?" They said, "Well, he was older than we are.
He was kind of a mentor and a coach. And we sort of miss going to this guy and asking questions. But we can go to other people in the company to get those." These are 20 somethings that are performing without a manager and they like it. So what I'm talking about here, no longer doing day-to-day stuff, team performance manager and emerging. This is really important. It's the performance part.
How do you evaluate performance if there's no manager? Can a team of individuals set management performance goals and measure them? It seems that they can, but what's happening, I think what's changing in the future of work is more performance will be not just your work but managing how well you're doing with your personal goals. They wanna know what your personal goals are. Not just work but personal and they'll care about that. It could be learning new skills, it could be focusing on something outside of work, could be prioritizing wellness goals.
They care about that. They want you to be happy. They want you to belong. They want you to know that you're valued in the company and they care about not just what you do, but who you are. It's a tug-of-war right now that employees seem to be winning. If you look at the numbers of defining where people work, when they work, how much they work, clearly the majority of workers want that kind of control. Are managers willing or companies willing to give them that? It's a fight right now.
I think companies are losing, although JP Morgan just said everyone has to come back to work. All their top management managers have to come in. Just like before the pandemic. I wonder how many they're gonna keep. Time will tell.
I think the surviving employers in the future work will have much greater empathy. They'll be demonstrating their ability to do relationship building, cultural sensitivity, all that stuff. This is for real guys.
You've heard of this, but this is for real. I talk to companies about this. They talk endlessly to me about how they're just scrambling to retain people by trying to kind of define the workers. Not so much as to what they do, but who they are. More of the verb, "to be" than, "to do."
And they're spending a lot of time on consultants to get there too. So I think for you, you know, how much does it matter to you how you choose your employer? Let's talk a little bit more about this. Okay, here's an interesting study, the American Opportunity Index. Do you know that if you make a bad choice in your employer, you could be giving up as much as $1.5 million in your career? So the people that are choosing employers in the top quintile in terms of wages, almost 2.5 times more, they will earn almost 2.5 more than their peers who are not working in that quintile.
And that could be worth over a $1.5 million to you. Employees at companies that are good at launching careers are over 60% more likely to land a better job when they leave. So you want to work for companies that absolutely, positively will develop your career.
And we'll talk a little more about this as we go along. A worker at a firm that lags how fast it advances employees would need a full year longer of work to be promoted into the next job. That's a year of your career working for a company that lags in terms of development. Soft skills. How we doing on time?
How much time do we have? - [Speaker] 25. - 25, okay. So soft skills. Look at this chart for a second and look at what the symbol is for what companies want. They want Swiss Army Knife employees. They like your specializations, but they like you to specialize in four or five things, not just one or two. And these things matter to them.
I'm gonna talk a little bit more about what I mean by some of these next, but that's the kind of view. It's not getting re-certified in an area that you've been certified in for a while or choosing another certification, it could be. These are soft skills. These are things that they're looking for in a world where there'll be more self-directed work teams, fewer managers, more people. Listen, going forward, it's innovation.
You have a bunch of... you're in teams right now where nobody has any experience innovating anything or innovating what your goal is on this team or what your company has given you as your objective in this team. Nobody has experience.
How are you gonna work in an area with such uncertainty? Just think about it. You need to have strong negotiating skills, communication skills. So you have to, there's a certain amount of authenticity to what you do. You're gonna be working in teams of people on solutions that are brand new. You wanna work with people. These are some of the skills you have.
Ability to communicate, listen, distill down very technical things to non-technical people and do it effectively. Speak at conferences by the way, which I'm gonna get to in a second. Self-awareness. How can you possibly know where you're going if you aren't exactly sure of what people think about you? What are your strengths and weaknesses? You might think you're very good at assessing your own, but what you need is someone to tell you you need to do better in that area.
Your peers can tell you that. So can your coaches and colleagues and mentors too. You need to have a very, very careful analysis of who you are and whether what you aspire to be is, you know, you have the personality for it, you have the skills for it. People would buy you as authentic in that job. Your ability to influence and advocate. Companies love to hire people that can go out and speak at conferences for one thing.
Go out and evangelize. They love it. How you manage stress? I mentioned this before. They'll ask you very specific questions now in interviews or try to get at how well you can manage stress 'cause there's gonna be a lot of stress. There's a lot of stress in this field already, but there's gonna be more stress as we saw from those burnout numbers before.
Good time management. That makes sense. Ability to unlearn and learn. Be very adaptable. Change course. Attention to detail, that makes sense. Solid work ethic. Ability to negotiate I think 'cause there's gonna be a lot of negotiation going on in your career in terms of your work. Not just your salary with HR but being able to be present and powerful and influential in a team working on a problem.
A couple of others here. Okay, now as I said, one of the choices you have to make is your industry. So 10 technology trends that are high momentum right now. And I'm gonna ask, I'm gonna say that you're gonna have to choose one or two and focus just on that.
So there's two over to the upper left which are next-level process automation and process virtualization. So that's all the automation that's happening. The hyper automation. We probably moved beyond RPA a little bit now, we're into hyper automation. But that's happening.
It has been happening, it's gonna continue to happen. The future of connectivity. By the way, I think this one is probably the one for this particular group in this room. You're probably more focused on cloud edge distributed infrastructure and also on zero trust architecture among all of these. Which isn't to say that you won't have a play in applied AI, which is number five, or next-generation computing or any of these industry specific trends.
Some of which you're aware of because of how fast we got the vaccine, the COVID vaccine, how fast that happened, Not a live vaccine, a manufactured vaccine. But in clean tech and in materials in the bio revolution. Those are the industry specific. And I want to just look at these 10, I wish we had more time 'cause there are more to talk about and I'd love to get into a little deeper into this, but we just don't have that time. What's interesting here is that not these technologies do not impact or influence industries equally. The blue sign, the blue boxes there are where those technologies will be a major influence.
And I just looked at, I mean we track 40 and report on 40 industries, but we're just looking at the healthcare sector here, the mobility sector, the enabling sector, and what we call Industry 4.0. So I just wanna look at those nine. Is that nine there? Yeah, nine. So if you're down here in trust architecture and distributed infrastructure, those are the industries right now where I think the greatest impact is being felt by those high momentum technologies, specifically in this case, trust architecture and distributed infrastructure. But if you are working in any of these other areas, pay attention. So you have to choose your industry right.
Also, if you look at this Momentum Index from McKinsey on the X axis is technical maturity. On the right axis is industry applicability. So you wanna get something that has very high industry applicability. So you have more leeway and then of course to the right is technical maturity. And so right now the most applicability and why you're hearing so much is applied AI.
But it's limited in terms of technical maturity right now. But distributed architecture or infrastructure and trust architecture are right in there. You know, kind of high in industry applicability. Sure. You know, kind of midway in technical. So the idea is they combine and that's what's important here, that you're gonna be working in combinational technology, not just one.
So over there you've got three cross industry horizontals, automation and productivity transformations across value chains, next-generation customer experience transformation and product research and development. This is over on the left and new business models, products and services. And then you've got some of what the disruptions are and what some of the relevant trends are.
I can't spend a lot of time on this chart, but I did want to point out to you a couple that you should be thinking about in this room. People that are working in your, you know, in risk and in cybersecurity and in data privacy and information security. And this is why these multidimensional hybrid sets are so important. So we see a very powerful combination.
Again, combinational technology and edge, Internet of Things, cloud and mobile. Also advanced data analytics, Internet of Things and artificial intelligence. So cybersecurity is injected into everything in these.
So you know, in a lot of ways you guys have more choice than a lot of other people and audiences I talk to 'cause cybersecurity is injected into everything. So you can choose across many industries and many different technology platforms you can focus on and you will find jobs. The question is again, you know, is it the right company for you to work for? Career drivers, okay. Macro trends. How many of you knew about killware before you know, the Ukraine war? I didn't know that drones could do what they were doing, but they can. So just a macro list of things that are driving interest in employment and opportunity in security.
I think overall security, we've been more integrated with new business models. That's been happening a lot of time. But you know, I know because of who we talk to, you know, board of directors, senior business management, they talk about this all the time. Security is no longer a compliance spend, a regulation spend. It is a business spend.
And they wanna know if what they're introducing will have any repercussions in the customer base. They want to know the customers will not complain about security when they're thinking about buying that product or service. So I think right now, application development, security and cloud security are probably the two fastest growing areas.
There's some numbers right there that proved that DevSecOps projected to grow almost 174% over the next five years. Analysts probably the largest, you know, that role in the company for growth right now. I think edge computing will continue to drive challenges, I think.
We gave you an example. If you are, basically you're trying to create a small, you're shrinking security capabilities into a smaller footprint. I mean that's what this is all about.
How do you do that? Well we think some of the knowledge areas you need are those in the middle there. And eventually security at the edge will be built into edge deployments. But right now it's a great opportunity to be working in edge for all of you. Digital advances, you know, what's your play? Is your play gonna be in compliance and regulation? Is it gonna be in business continuity? Is it gonna be in securing open-source tech? Is it gonna be baking security? These are all areas that they're looking to increase their capabilities.
Women, you know, 25% of the global cybersecurity workforce is women. On average they're earning 21% less. But for the women in the room today, we think it'll be up to 35% by 2021 or 2031 and 30% by 2025. So there's gonna be quite a large increase. 40% increase in women in cybersecurity. Why is that? Because companies are starting to realize that women have a lot of these soft skills that they're looking for.
They have them already, they have high emotional intelligence and you're smiling (laughing). Oh there's a woman smiling and it's true. They're starting to believe that women can do things that men find more difficult in a world of more self-directed work teams, in innovation where you really need people who are, can work well with people, can really produce. Here's so if you're a network administrator, you're getting into it, you're probably coming from help desk, security administration, network administration, just some skills that we think you ought to add if people want to do that. AI, these are, what are some of the most common support, what we call supported use cases in AI right now.
There's a lot of them, but we think the ones in red are the ones that companies are telling us they're trying to hire into, to create increased capabilities. These are as many of you, I dunno if you know or your companies have purchased our IT Skills and Certification Pay Index. We're tracking the cash market value. Companies are literally telling us the cash they're paying, usually outside of salary, for about 1,300 certified and non-certified technical skills. So I just took out the security-related certifications that are earning well above average right now.
I think on average across all the certifications, they're earning the equivalent of about 6.7% of base pay. Non-certified skills are earning the equivalent of about between 9 and 10%. They're worth a lot more than certifications.
But we say, which certifications are paying well above average and still growing? And these are the ones. These are hot certifications to have right now and probably over the next couple of years. So let's just take a look at that for a second. Any questions, any observations? This is bottom line, what companies are willing to pay in cash over and above your salary for that certification. And this, as you can see, is coming from having established and verified almost 93,000 people getting these premiums. So those are 6 month vectors.
Over here is 12 month where we've seen 45% growth in pay for Okta certified professionals. 37, almost 38% increase in pay over the last 12 months in terms of the premium for the CGEIT from Osaka. Pretty cool. - [Speaker 2] (indistinct) - [Lecturer] I'm sorry, there's actually... Can you shout it? - [Speaker 2] Oh, sorry.
So CISSP is not there. One thing I noticed. - [Lecturer] Yes. - [Speaker 2] And the second thing is there's more focus on the offensive security.
- [Lecturer] Right, well, because that's what companies are willing to pay more money for right now. But as you can see in the, if we have time and if there's a question, I can go into the addendum and show you exactly all the, what you're talking about that they're not all offensive. But right now many of them are. All right, highest paying certifications. Again, this is out of 606.
Most of them are security. So the ones up there at the top, that first group, that's about on average, about 13% of base pay. The next grouping is, which is number two, that's about 12% and then 11% and 10%. So that's earning between the equivalent of 10 to 13%.
Interesting. So I would say take a look at that. That's it. All right. Bye. 2025 audit as we know it, will be almost unrecognizable. That's just not our opinion. That's other opinions that we've heard from other analysts.
These are the reasons why. So if you're in audit, it's gonna be a very different game in a couple of years and most of you that I talk to are seeing it changing very rapidly right now. Okay? What we've learned today.
Your job security is changing a lot faster than you're probably aware. We're gonna have 10 minutes of questions and answers now. But this is what I wanted you to get.
Your job security is changing. It's faster, more dramatic than you probably realize. Hence the title of this presentation. You have to be more out-of-the-box.
Forget what you have known about getting a job and planning a career. Just put that aside. It's a different ballgame now.
To enjoy your best, you know, job and career, five things. The industry you chose, the technology cluster you're focusing on or technology, the cultural match with your employer. We saw some of that, the numbers that could not only cost you a lot of money, but it could really hold you back time-wise from advancing your career. The form of your employment.
Whether it's you want to be one of these interim professionals or career nomads or continue to work full-time and your mastery of soft skills. I think you need to get a better sense of your sweet spot by networking. Being at places like this. Keep networking like crazy.
You'll learn so much about people that are kind of already there. I think Abraham Lincoln said that "If you wanna predict the future, then the best way to predict the future is to create it." So talk to people who have created, who are already in some of these areas. They're creating their future and what did they do that's different than you? They took more risks.
Emulate those who are in jobs that you'd like to have. And at minimum recalibrate on a pretty regular basis. - [Interviewee] I'm a roofer.
- [Interviewer] And how much do you make? - About 70,000 a year. - [Interviewer] Okay. How many years of experience? - 7 years of.
- [Interviewer] Any career advice? - Don't be a roofer. - [Interviewer] Why? - It's tough on the body. I'm 32 years old and I feel like I'm 90. - I'm a math teacher. High school.
- [Interviewer] Oh, high school, okay. How much do you make? - $78,000. - [Interviewer] Nice. How many years of experience? - 10.
- I'm a GIS Administrator. - [Interviewer] Oh cool. How many or how much do you make? - I make $90,000 a year with bonuses. - I'm gonna be a data analyst.
- [Lecturer] Now pay attention - [Interviewer] And how much are you gonna make? - [Lecturer] to the one that comes after this guy. - [Interviewer] Nice and how many years of experience? - Currently none. It's just entry level. - I'm a technical recruiter. - [Interviewer] Cool. And how much do you make? - 90. - [Interviewer] Okay and how many years of experience? - Three.
- [Interviewer] And any career advice? - Change companies as often as you can, push for and always negotiate your pay and always be in an environment that wants to develop you. - [Lecturer] Bingo. Bingo. Put it right on the money. I put you some, you know, how to apply what you've learned. There's all kinds of things. But I want to get right into, and by the way, and this is the addendum.
We're going into questions now. So if you have any questions you need to come up to these microphones. In this addendum you'll see a lot of pay charts.
You'll see... You'll see tables of, here we go right here. You'll see actually we've given you the highest paying certifications and what their growth or decline has been over the last 3, 6, 9 months. We've given you biggest gainers over the last 6 months. These are the hot, hot security certifications. And again, as you, as you'll see, it's all over the map in terms of offensive, defensive.
You'll see the biggest decliners, you'll look at non-certified, which is, as I said, was paying quite a bit more, almost 50% more on average than certifications. And we pulled out all the security certification or non-certified security skills. Again, this is all available to you. And that's it. Any questions?
Is there anything you didn't understand or you want to challenge back? Well first of all, you have to come up to this speaker here 'cause I can't, the whole room has to hear you. (microphone thumping) Right, thanks. And fill out your surveys by the way.
- [Speaker 3] I was just curious, you were talking about Gen Z and Millennials. How does age factor into any of this? - [Lecturer] How to age? Well I think you mean - [Speaker 3] How does age factor in, I mean is it a level playing field now in terms of age? If you're a seasoned professional versus a young professional just entering? - [Lecturer] Well, number one, it depends on your job. Number two, it depends very much on the company. My daughter works for a company where the average age is 27, so they're probably not looking at Millennials even in management jobs.
So it's very much how the employer perceives age. And you can get all that information off of Glassdoor and a lot, you know, you can network and you can go on the web to ask a lot of questions about who does this company tend to like, who are they hiring? What seems to be their focus in terms of hiring? I presume that's what you're looking at is how to look for opportunities where your age might not be a barrier? - [Speaker 3] Exactly. Yeah, yeah, thanks. - [Lecturer] It's very dependent, again on the culture of the company. Have you ever worked for a company where you felt, where you aged out? I see people aging out of jobs all the time. They're incredibly good at what they do, but they're just too old. There are certain industries that will not tolerate people in their 50s and they just age out.
It's sad when it happens. The one I'm thinking about is the fashion industry. I know someone that worked at, was an executive at Chanel and in her 50s launched the entire digital transformation of Chanel and how it presented itself on the web. She did this in her 50s. They still canned her because people underneath her wanted a younger person. See they wanted to be managed by a younger person who they felt understood them better.
So it's interesting this thing about age. Age shouldn't be a barrier and increasingly it probably isn't, but there is ageism as well as sexism and genderism that exists in the world. And it's gonna be slow, but it's, companies are starting to get the message that sometimes they have fired too many older workers and the culture is now in some kind of unbalance. Sometimes they bring them back after they've, you know, they've either retired, they bring them back. As they say, some of these younger workers don't seem to understand exactly kind of where this company has been and how our culture developed over time. So I've seen them hiring some retirees back in to sort of help bridge the gap between the old and the new.
I hope that helps. Any other questions or comments? If not questions, comments. Tell me if any of this is total BS. I would love to hear it. I would love to hear what resonated with you and what didn't. And in your surveys you can help.
And we had very little time. What I just presented to you today is usually a 3.5 hour presentation. I thought I could try to do it in 50 minutes, so I hope it worked.
But there's a lot, there's a lot of thinking you need to do. Get a hold of slides, just look at them, look at them, see if they resonate. Okay, go ahead. - [Speaker 4] So my question is, you know, mostly for the young professionals or the people coming out of the colleges and universities. Now the question is, you know, what is the, they are interested in cybersecurity, they would like to get a job in there, right? But they, you know, and they would like to follow a path, which is at less risk, a safer job, you know? So, my question again is from the offensive and defensive perspective, you know, what is the route that they should take? The reason is, I can see in here there is a lot of focus on the offensive security and these guys must be paid very high.
But how many professionals are really capable of reaching to that level right? And you know, because I work for an MSSP, my question is that, you know, when you look at the organizations around you, all of them are looking for some kind or the other, the defensive experts, right? But not all of them are looking for the offensive professionals because you do a penetration test once in a month, you know, a year or so. So how do you guide these young professionals or the young graduates that are coming out? - [Lecturer] Well, let me talk about young professionals coming into the field. For many years there wasn't much happening academically that was any good in terms of teaching people cybersecurity, information security, to an extent.
And I was on a couple of advisory boards at universities. I think the best thing for them is that I think cybersecurity is kind of a being. Not just a doing, but a being.
There's a lot of technical parts about it, but I think they're hiring based on personality now where they'll hire defense attorneys, they're looking for defense attorneys 'cause they seem to be the kind of people who do very well in terms of understanding how criminal minds think. And you know, they're...hey anyone who could get OJ off for that murder is awfully good at figuring out, you know, the minds of jurors, how people think, influencers.
So I always say to young people, I said, "Look, come into a job where security is a part of what you do, but it's not 100% of what you do." And those usually are in systems administration, network administration, things like that. Get a taste of it. And if you like it and you like the people you meet in it, if you, just find out, if you think you have what it, the stuff it takes to work in security when so many people, when you know people are burning out and you know, that half of all leaders right now, are a little burned out and thinking whether they even want to work in security anymore.
But I'd say, you know, dip your toe in it even before. You might even get a entry-level certification just to prove that, you know, you want to be at the table but don't work in it 100%. Get a job where it's just a part of what you do. That's what I tell people. Now there's some people think they're hot shit and they can go right in. And I said, "Well that's great, but you have to convince the company that what, that you have something special."
And some of them have been able to do it on sheer force of personality, have been able to get jobs, pretty cool jobs in cybersecurity. But at some point you need the technical part of it because you're working with technical people who will not have any respect for you if you don't show some kind of technical abilities. They just, they don't wanna work with you. But that's what I say, start low and then move. Move as quickly as you can if you like it.
Don't assume that if it's a hot area you're gonna like to work in it, just meet people. - [Speaker 4] Thank you. - [Lecturer] That's what I think.
I am gonna be around this conference for the next two days. If you see me and you have any specific questions, things that you didn't want to bring up in a public room, I'll sit down and talk to you about it and I'd love to hear about it. So just pull me aside or I guess you can probably, we can probably meet through the app, right? Can you get put together meetings through the app? All right. My information, on my slide is my information how to get ahold of me. It's my number, it's text, everything. Just find me while I'm here. We'll set up a meeting.
We'll talk. All right, thank and thank you for coming. (audience clapping)