The most optimistic projections of how many technical jobs in cybersecurity are held by women hover around 20 percent. When you consider that women make up roughly half the population, and that a cybersecurity workforce shortage is regularly described as a national security threat, the current reality is not just inequitable – it’s geopolitically unsustainable.
“Treating security as a multidisciplinary problem isn’t just about bringing in social scientists,” said Amit Elazari, director of cybersecurity policy at Intel, which has committed to increasing its percentage of women in technical roles to 40 percent by 2030. “It’s about bringing in multiple types of experiences.”
But here’s the challenge: for years, policy makers, companies and other stakeholders have addressed the gender gap as a training or culture problem, looking to find and enable women early in their career to fill junior positions. But experts and practitioners suggest it’s time to address a second problem: attrition that too often comes from a stagnant career.
Click here for complete coverage of SC Media’s 2020 Women in IT Security
“Nobody’s going to be out of work in cybersecurity. What we're dealing with is a massive imbalance in the respect and responsibility and leadership roles given to women,” said Tarah Wheeler, a 2020 Women in IT Security honoree and the author of the seminal book "Women in Tech." “You're still going to get a lot of money and have negative unemployment in cybersecurity for 10 years, but without career advancement.”
Clearly, women need a track record in technical and business experience to get noticed, “working in the security trenches and building companies,” in the words of Lynn Sakamoto, vice president of marketing for the cybersecurity division at Netenrich. Experience supporting military, national defense and federal security programs can also help.
They also need to actually apply for jobs. Reports abound about the tendency for women to question their credentials when considering opportunities. Cybersecurity does a notoriously bad job writing descriptions for mid-career and senior staff – regularly requesting, for example, 10 years' experience on technologies that are not yet 10 years old – and studies show women are less likely than men to apply for jobs when they don’t meet all the written requirements.
But even when women do tout the experience and subsequently apply for the positions, statistics would imply that it's not enough. Corporate recruitment and training programs that focus on diversity are positive steps, but most women say low yield. And women that hold the technical skills are getting tired of waiting, said Chloé Messdaghi, vice president of strategy at Point3Security. “It's fair at this point to ask why we have to keep defending women’s right to be there, or that a woman is highly skilled.”
Indeed, “while awareness, education and community are all important, they don’t help an individual,” said Lynne Doherty, executive vice president for global sales and marketing for McAfee.
More beneficial, she says, is advocacy. Even as one of the highest-ranking people at her company, Doherty still seeks out mentors to commit an hour a month for a year to answer her questions and offer input. And while she acknowledges that a mentor – which is someone who provides advice – Is different than a sponsor – who advocates on behalf of a protégé – mentorship is a personal, professional relationship that is typically easy to find and can benefit most anyone, at any point in a career.
In other words, it’s a start.
“You don’t necessarily need to know anything to be a mentor,” she said. “No one ever feels like they have anything they can add to someone’s career, but they do.”
Still, for those aspiring toward their next opportunity, sponsorship can be the gamechanger – fitting squarely within “the process of creating opportunities,” said Elazari. As described by Shamla Naidoo, managing partner at IBM and the company’s former global chief information security officer, “sponsors are the people who are going to speak for us when we are not in the room; sponsors are going to be the ones that get your next role, speak on your behalf when you are up for the next promotion.”
Unfortunately, sponsors are tougher to come by. History and studies have shown that people tend to be drawn to other people who look and act like themselves. And that can leave women, who don’t already have broad representation in higher tier positions, looking from the outside in.
“Even the words we use to describe sponsors – Godfather or Rabbi – are extremely gendered,” Wheeler said.
Realistically, getting a group of predominantly white men to take personal responsibility for other people’s success, or introspectively look at why they haven’t been doing so already, is far different than the more typical corporate recruitment efforts. But it’s a critical new place to focus. Messdaghi challenges male executives to join the pledge to have 30 percent of c-suite and board of director positions filled by women within three years, and 50 percent by 2030.
“The first step men in authority can do is to take a look at whether there’s a 50/50 percentage of women to men managers, and if not, acknowledge that there’s a problem,” she said. “It’s got to be equal representation when it comes to managers, directors and ultimate decision makers.”
In the meantime, Wheeler no longer focuses much effort on diversity initiatives at the corporate or programmatic level, describing the result as “widespread diffusion of fuzzy energy” that brings far less impact than “direct, clear sponsorship of individuals where you take personal responsibility.”
She said as much during a live broadcast and could “almost hear the microphones and tea mugs dropping.”
“Someone asked, ‘how do you mentor high school girls?’ I said ‘I don’t. That's not my problem anymore,’” Wheeler recalls. Instead, “I specifically know in my head the three names of the mid-career to senior women of color who I advocate for behind closed doors.”
Teri Robinson, SC Media executive editor, contributed to this report.
