Tony Bryan doesn’t believe in the traditional notion of a cyber skills gap.
In fact, he thinks educational institutions and vocational training programs have done a pretty solid job of creating new legions of skilled and talented cyber workers. But what these up-and-coming candidates lack, he says, is actual on-the-job experience. And he believes it is for this reason that employers are not enthusiastic about hiring them, preferring instead to seek out more battle-tested job candidates.
Not everyone would agree with this theory. Indeed, plenty of experts say that smaller cities, rural areas and socioeconomically struggling neighborhoods genuinely suffer from a shortage of local cyber talent. However, that is not to say Bryan, the executive director of St. Louis-based apprenticeship organization CyberUp, doesn't also have a point: In addition to a cyber skills gap, perhaps there is also a cyber “experience” gap that results in less-seasoned infosec workers struggling to be welcomed into the fold.
But there are ways to bridge this disconnect in the talent pipeline. And while internships might be the first solution that comes to mind, there’s another form of “ship” that in the U.S. has sailed under the radar: apprenticeships.
CyberUp, for example, was created three years ago to help cultivate the cyber talent pipeline – with a particular focus on women, people of color and veterans. Bryan said CyberUp’s cyber apprenticeship program was the third-ever such program to be registered with the U.S. Department Labor, but claims it is the first one to be primarily focused on security analyst positions.
CyberUp collaborates with employers and educational partners nationwide to place prospective employees with jobs that match their interests, abilities and aptitudes. Candidates received certified training through a pre-apprenticeship program and then are placed in a paid apprenticeship role with an employer for a 12-month period, during which time they earn a salary, plus receive additional instruction customized for the employer. CyberUp’s goal in 2021 is to place about 50 individuals in roles at partnering companies like Boeing and Equifax.
As an early U.S. trendsetter, Bryan understands the leg up that apprenticeships can provide people. Oftentimes, entry-level employees holding cyber college degrees or training certificates “are having a real hard time transitioning that piece of paper into a job,” he said. “You have some technical skills, but you haven’t applied said skills.”
Moreover, there are dozens of individual job functions with cybersecurity that require their own specific level of experience, from SOC analyst to incident response to pen testers, said Bryan. And with cyber still a new concept to many organizations, hiring managers have wildly inconsistent ideas about what they should be looking for, which makes the pathway to employment all the more uncharted and confusing for inexperienced workers.
But apprenticeship programs are an effective way to clear a path to employment and unblock that talent pipeline. Apprentices are given a fair shot to hone their craft and prove their value – and the companies they work for are given a golden opportunity to build from within and develop a deep roster of skilled professionals.
CyberUp is just one of a growing lot of apprenticeship-style programs in the U.S. Indeed, Bryan is co-chair of the Apprenticeships in Cybersecurity Community of Interest – a federal forum established by the National Initiative for Cybersecurity Education, a division of the National Institute of Standards and Technology (NIST).
On a state level, the State University of New York (SUNY) and New York State Department of Labor (NYSDOL) have worked together to create in-state cyber apprenticeship opportunities for local employers – including the SUNY Apprenticeship Program and the NY College Apprenticeship Network (enabled via a U.S. Department of Labor grant).
And then there are professional service providers such as Franklin Apprenticeships, a self-described consulting and capacity-building firm that matches IT workers with employers offering modern-day tech apprentice programs.
SC Media spoke to representatives from these various “matchmaking” institutions for their take on why apprenticeships are increasingly opening up promising opportunities for aspiring infosec professionals.
Apprenticeships vs. internships
First, it’s important to understand key differences between internships and apprenticeships. Both can potentially brighten prospects for future employment – but the latter is essentially having a paying job already in hand.
“Apprentices are... employees that have specific job responsibilities, whereas the intern only has a short window of time with the employer and does not have the same responsibility or accountability,” said vice president for apprenticeships, Andy Smyth, at Franklin Apprenticeships in Washington D.C. “It is the development process of off-the job technical training and on-the-job work development that enables the apprentice to take theory and put in into practice every day at work.”
For apprentices, this means having a genuine role on the team. “Oftentimes an intern is going to come in, they might be assigned to a person and they're not going to necessarily have an actual job function,” said Bryan. “With an apprenticeship, 99% of the time that individual is part of the functioning team. They’re doing the day-in, day-out stuff and they’re treated as an employee, an equal.”
Marian Merritt, deputy director and lead for industry engagement at NICE, agreed that apprenticeships are more “structured” compared to internships, which are often “more casual, short-term and may lack the opportunity for the participant to acquire new skills and knowledge.” With apprenticeships, “there are milestones of learning and skill acquisition along the way,” helping candidates refine their abilities and carve out a niche for themselves – perhaps selecting one of those dozens of cyber job functions to which Bryan was referring.
“The apprentice also has the opportunity to solve real-world problems that they haven’t encountered before and take that to the learning environment to gain insight that will help them,” said Smyth. “Conversely, they are able to share their real-world experience with their apprentice peers so that everyone gains throughout the programs. This accelerated learning and input process, which is also structured and supported, means that every apprentice completes their program with the most contemporary knowledge and skills that other learning processes can never replicate.”
Along the way, apprentices also receive plenty of guidance from their dedicated workplace mentor, who also communicates with the partnering education institution or training program to ensure the participant is getting the education he or she needs to succeed.
This all "requires a coordinated approach that involves the senior leaders to approve the investment; human resources to know how to on-board, pay and support the apprentices and the mentors; and the direct line managers and co-workers,” said Merritt. “AT&T and IBM are examples of companies that do this well and they are supported by internal training and management development organizations.”
Terms of apprenticeships can vary. CyberUp apprentices earn an average of $40,000 per year (more in big markets like New York) over a 12-month period, but other apprenticeships can last even longer, giving participants even more time to refine their craft. For instance, apprenticeships orchestrated through SUNY and the New York Department of Labor can stretch out for as long as five years, while participants also complete 144 hours of related instruction. “They also receive at least one incremental wage increase during the training program,” according to spokespersons from SUNY and the NY Dept. of Labor, who sent joint responses to a series of questions sent by SC Media.
For apprenticeship programs that are officially registered with government agencies such as the Department of Labor, individuals who complete the program earn “industry-recognized credentials,” said Bryan, and in doing so “they become journeyman much like you would be if you were a carpenter, or an electrician.” Interns receive no such certificate, nor do they have the guarantee of continued employment.
That said, many apprentices ultimately remain with their companies. For instance, in the three years the CyberUp program has operated, only one apprentice didn’t stick with the company to which he or she was originally assigned. And in the case of Franklin Apprenticeships, “all apprenticeships result in a full-time position at the same company,” said Smyth.
Considering its advantages, apprenticeships might sound like a no-brainer for budding cyber professionals, but not every place of employment is sold on the idea. For some corporations, “the short-term approach of internships may often be easier for a large corporation to establish and fund, and – in particular for the tech sector – is simply more familiar,” said Merritt. What these organizations may not realize, however, is how much they can benefit from them too.
“Cybersecurity apprenticeships are a very effective workforce development solution, but there is still a need to help people learn about them and how they work,” said Merritt. “We need, in particular, more employers of all sizes to consider investing in apprenticeships. It requires a vision of long-term investment in staff development, a clear sense of which work roles you need to fill, as well as a corporate commitment to provide existing staff with guidance and training on how to mentor an apprentice and help them succeed.”
Talent development, loyalty and diversity
In the corporate world, competition to recruit cyber talent is fierce, and it’s often the companies with the deepest pockets who are best positioned to lure and land the best candidates who come with the highest salary demands.
But apprenticeships are a way to inexpensively develop skilled employees from within.
“It’s a well-understood model in European countries such as Great Britain, Germany and Switzerland,” said Merritt. “Apprenticeships are highly beneficial to an employer who needs particular or unique skills; who finds it challenging to find talent when competing against better financed organizations (who can pay more); or who are in regions with less available skilled talent. Additionally, because apprentices tend to become loyal to their employer-trainer, retention is high and the return on investment is terrific.”
“The data also shows that the majority of apprentices progress up through the ranks more quickly than non-apprentices,” said Smyth. “All of this points to the fact that investing in apprenticeships not only enables organizations to attract and retain key talent, they also enable them to develop and grow their future leaders who are both technical experts and business savvy.”
Diversity is another plus. “Our own data shows that apprenticeships attract a more diverse pool of talent than traditional recruitment channels, Smyth continued. “At Franklin, around 50 percent of our apprentices and pre-apprentices are diverse in terms of their key characteristics. And in the tech space we have over 30 percent female participation, which is well ahead of the industry norms.”
Government programs can also help cover some of the costs of operating an apprenticeship program, adding further incentive. For instead, New York State offers an Empire State Apprentice Tax Credit for cyber and IT apprenticeship programs. “The tax credit is for employers who have an apprentice on for at least six months – and the credit increases each year the employer has the apprentice, the NY Department of Labor noted. “There is also an enhanced credit for disadvantaged youth ages 16 to 24 who have certain barriers to employment and an enhancement for mentors as well.”
The state also offers an Apprentice Expansion Grant, which provides up to $10,000 per apprentice to cover instruction, training, book and tools – with a maximum award of $300,000. “This is for sponsors outside of the building and construction trades and really focuses on our new and emerging industries,” the NY Department of Labor explained.
From a talent development perspective, the company also benefits when the apprenticeship program takes care to pair the right employee with the right organization.
“It's like a snowflake. Not everybody's the same. Everybody has a little different flavor and the things that they're looking for. So it's important to understand what's important to that employer… We really lean in, getting to know their organization, we get to know their culture, and what things they are looking for in candidates,” said Bryan of CyberUp, which sources talent from community organizations, military instillations, universities and community colleges, and the coding bootcamp Fullstack Academy. “I oftentimes feel like we're a little bit like a Match.com.
Bryan believes it’s this attention to detail that has contributed to the CyberUp program’s nearly perfect retention rate.
“I'm confident at the end of that one-year apprenticeship… that that person is set for the rest of their life to be able to move into different roles, regardless if they stayed or didn't stay,” Bryan said. “But historically we've had really good success in those individuals staying on board with those organizations.”
Due to these and other success stories, Bryan believes the perception of apprenticeships is beginning to improve. Three years ago, when CyberUp first started, apprenticeships were often “equated to be something as lesser than or below entry-level,” said Bryan. But “the federal government's done a really good job of continuing to make investments into apprenticeships, and to advocate through different channels to those employers to highlight the importance of apprenticeships. So it’s made that conversation for us with employers much easier.”
Now, “when you do say the word ‘apprenticeship,’ their ears open up and they're much more receptive to the idea.”
