How to Plan a Cybersecurity Career Using Data

TL;DR

Cybersecurity, risk, governance, and audit offered their strongest job security and growth prospects in twenty years, according to the analyst’s research. Professionals should independently evaluate employer data, market forecasts, assumptions, skill demand, and certification premiums because most employers provide limited career roadmaps outside engineering, while fast-changing technologies increasingly require internal talent development.

Transcript

Who here is not following what's happening in the market? 'Cause this has a bead on what I'm talking about today. Yeah. The market's lost about thirteen percent of its value. Things that are happening in the market today are-- haven't happened since two thousand and eight. Now, would you give all of your money to one person who says, "Trust me, I'm... Read More

Key Insights

• Career planning is comparable to investment planning because both require forecasts, assumptions, evidence, and an assessment of past results. A professional should not place an entire career in the hands of one recruiter who promises success without supporting the recommendation with credible market information.
• Cybersecurity, risk, governance, audit, and information security offered the strongest job security and growth prospects the analyst had observed in twenty years. However, professionals remain largely responsible for constructing their own career plans because many employers provide limited guidance for roles that are not directly customer-facing.
• Falling certification premiums can reflect increasing labor supply rather than declining occupational demand. Security certification values had fallen across several quarters because professionals from networking, systems administration, engineering, and other disciplines were entering the field and obtaining credentials, narrowing the gap between supply and demand.
• Reliable compensation research depends on validated employer information rather than self-reported crowdsourced figures. Foote Partners gathers detailed confidential data from 5,500 companies in 15 countries, primarily in North America, and protects participating organizations through nondisclosure agreements that support trust and continued information sharing.
• Skills and certifications can generate compensation outside base salary. More than 2,000 companies in the analyst’s dataset paid almost 80,000 workers additional amounts for particular credentials or capabilities, enabling quarterly comparisons of which skills were gaining or losing market value.
• Quarterly market tracking is useful because changes over three, six, and twelve months can reveal shifts in skill scarcity and compensation. The analyst uses those patterns, combined with forecasts and assumptions, to judge which capabilities may continue rising and which declines require careful interpretation.
• Internal talent development is necessary when disruptive technologies expand faster than the experienced labor pool. Employers cannot recruit professionals with four to six years of experience in areas that have not existed long enough, so they must prepare current employees to perform emerging work.
• Rapid growth creates a material risk of employee burnout. The analyst observed that workers in exceptional-growth companies can be pushed continuously until serious problems emerge, making sustainable workforce development and management essential when organizations pursue revenue and profitability through disruptive technology.

Questions & Answers

Q: How should professionals evaluate cybersecurity career advice?

Professionals should treat cybersecurity career advice like investment advice. They should examine the adviser’s forecasts, underlying assumptions, supporting numbers, and record of results rather than relying on a single recruiter or headhunter who promises success. They should also compare expected growth in relevant industries and sectors with the broader market before choosing jobs, skills, or certifications for the next three to five years.

Q: Why can falling cybersecurity certification pay be misleading?

Falling certification pay does not necessarily mean cybersecurity is becoming a poor career choice. The analyst says certification values had declined for several quarters because many professionals from networking, systems administration, engineering, and other backgrounds were entering security and becoming certified. Their arrival increased the supply of qualified workers, narrowed the scarcity gap, and reduced the extra price employers paid for some credentials.

Q: How strong are cybersecurity and governance career prospects?

The analyst describes job security and growth across cybersecurity, information security, risk, governance, and audit as the strongest he had seen in twenty years of studying the field. He still warns that favorable market conditions do not provide an automatic career path. Professionals need to interpret labor data, follow disruptive technology trends, and actively decide which roles and capabilities fit the coming three to five years.

Q: Why must cybersecurity professionals manage their own career plans?

Cybersecurity professionals often need to manage their own career development because many employers can barely provide roadmaps outside software engineering and development. Companies tend to prioritize engineers and developers because they are viewed as customer-facing and connected to revenue. Security practitioners may receive less structured guidance, except in settings such as professional services firms, where employee expertise is the organization’s central asset.

Q: What data supports the analyst’s cybersecurity job forecasts?

Foote Partners collects detailed confidential information from 5,500 companies in 15 countries, with its work focused primarily on North America. It also tracks additional skills and certification payments from more than 2,000 companies covering almost 80,000 workers. The firm updates its analysis every three months and examines changes across three-month, six-month, and twelve-month periods to identify rising and declining values.

Q: Why does employer-supplied compensation data matter?

Employer-supplied compensation data matters because research requires validation and reliability. The analyst distinguishes his firm’s information from compensation figures gathered through crowdsourcing, which relies on individual submissions. Participating companies provide detailed confidential records under nondisclosure agreements, allowing the research firm to study salaries and separate payments for skills and certifications while protecting the identities of the organizations that supplied the information.

Q: Why should companies develop cybersecurity talent internally?

Companies should develop cybersecurity and emerging-technology talent internally because rapid technological change can create demand before an experienced external labor pool exists. Employers cannot always find candidates with four to six years of experience in newer areas such as blockchain or AI. Preparing existing employees helps organizations field the people needed for disruptive work and reduces dependence on recruiting talent that may not yet be available.

Q: How does rapid technology growth affect workforce management?

Rapid technology growth can increase revenue and profitability opportunities, but it can also push employees toward burnout. The analyst compares workers in exceptional-growth companies to hamsters running continuously, with serious problems eventually emerging. Effective management therefore requires attention to business goals, technology needs, compensation, career development, and the long-term ability to maintain capable teams without exhausting the people performing the work.

Summary & Key Takeaways

• Career decisions should be evaluated like investment decisions, using forecasts, assumptions, historical performance, and reliable evidence instead of depending on one recruiter or adviser. The analyst examines how disruptive technologies and changing talent supply affect cybersecurity, information security, risk, governance, and audit jobs, compensation, skills, and certifications over several years.

• Foote Partners bases its analysis on detailed confidential information from 5,500 companies across 15 countries, primarily in North America. Its compensation evidence is supplied by employers rather than crowdsourced. Data from more than 2,000 companies and almost 80,000 workers also tracks additional payments for individual skills and professional certifications.

• Cybersecurity certifications have recently declined in market value even while the field remains attractive. The analyst attributes this pattern to professionals moving from networking, systems administration, engineering, and other areas into security and earning certifications. Expanding supply reduces scarcity, so falling certification premiums do not necessarily indicate weakening demand for security talent.