In January 2023, the Canadian Centre for Cyber Security (CCCS) delivered its baseline cyber threat assessment with a stark warning: organized cybercrime, it said, “will very likely pose a threat to Canada’s national security and economic prosperity over the next two years.”
Possible targets cited by CCCS included hospitals, where cyberattacks can disrupt patient care and delay tests; goods and services, where they can drive up prices and short supply; and of course, banking attacks, payment card frauds, and identity theft.
Cybersecurity, consequently, is a fast-growing field where the stakes are already relentlessly high and only promise to grow — but not only because the threats are multiplying.
The number of vacant cybersecurity positions globally outpace the skilled workers available to fill them, and according to IT World Canada, this means the escalating likelihood of cyberattacks are expected to be exacerbated even further by the sector’s chronic talent shortage.
Canada is not exempt from this problem. The Information and Communications Technology Council (ICTC), a digital research-based not-for-profit, reported in a 2021 study that despite offering robust, competitive salaries, one in six Canadian cybersecurity positions go unfilled.
That represents about 25,000 jobs left open — attributed partly to burnout, students opting out of cybersecurity programs while they’re still in school, and competition from U.S. companies offering higher salaries, the study read.
But while the nation faces a shortage of workers, ICTC’s research also suggested a lack of diversity in the talent pool could prolong it: those identifying as Black, Indigenous, or people of colour represented only 25% of cybersecurity workers.
Those identifying as women had the least representation — just 20%.
“We need to pull more women in,” Rushmi Hasham told DX Journal in September.
Hasham is the director of cybersecurity workforce training at Toronto Metropolitan University’s Rogers Cybersecure Catalyst, which offers innovative training and certification programs aimed at boosting Canada’s competitiveness in the sector.
And although Hasham says more women are beginning to pursue cybersecurity, increased representation is necessary to perpetuate that progress — and the valuable contributions women make to the field.
“We want to have their opinions heard, we want their unique perspective, and women offer new solutions that we need, frankly, across the entire industry,” she said.
“But we also need to make sure that we’re creating the space, that they feel the inclusion.”
The value women bring to cybersecurity
Cultivating a gender-diverse staff offers a litany of benefits for companies, and when it comes to cybersecurity, there are practical, research-based incentives to hire women.
Université du Québec à Montréal professors Camélia Radu and Nadia Smaili found “evidence of a positive association between the level of cybersecurity disclosure and board gender diversity” in their 2021 research study, Board Gender Diversity and Corporate Response to Cyber Risk: Evidence from Cybersecurity Related Disclosure.
“The presence of women IT experts on boards resulted in improved cyber risk management — board monitoring, management supervision and corporate governance in particular,” Radu and Smaili wrote for The Conversation in December of 2022.
In addition to bringing new perspectives to the decision-making process and adding a greater variety of skills and capabilities, they said their research also found that women “had lower risk tolerance, enhanced ethical practices and engaged less in fraudulent practices.”
“These specific skills, combined with their IT expertise, meant women improved the cybersecurity risk monitoring of their companies,” Radu and Smaili said.
But despite all they bring to the table, The Globe and Mail’s Tayo Bero wrote in August 2022 that women continue to face barriers in the industry that include being talked over in meetings, having their ideas ignored or co-opted by their male colleagues, and never being recognized for their work.
The effects on women’s cybersecurity careers are detrimental.
“Obviously, if a [young woman] sees this type of treatment towards her where she is constantly reminded that she has to prove herself [and prove] that she actually knows something, she would think twice whether this is a good career for her,” Natalia Stakhanova, an associate professor of computer science at the University of Saskatchewan and a Canada Research Chair in security and privacy, told Bero.
Research also suggests women are also less likely to apply for cybersecurity jobs in the first place.
According to a survey commissioned by Microsoft Security, men are more likely than women to feel qualified to apply for a cybersecurity job posting, while many respondents “indicated a bias that cybersecurity isn’t a traditional career choice for women.”
“Some women expressed these biases themselves,” Vasu Jakkal, the corporate vice president of security, compliance, identity, and management with Microsoft, wrote in a March 2022 blog post.
“The survey indicated women are more likely than men … to think that cybersecurity is ‘too complex’ of a career.”
This perception could be influenced by the shortage of women in the industry — possibly creating a self-fulfilling, and perpetuating, prophecy.
“A lack of representation can then reinforce the gender gap by dissuading women from entering cybersecurity,” Jakkal said.
How to improve equity and inclusion in cybersecurity
With challenges like these at play, Hasham believes that we can start attracting women to cybersecurity jobs by lowering barriers to entry.
“If we’re looking at the mid-career woman making a pivot, she’s looking at: can I put my family aside? How do I do this?” Hasham said. “So, time is a barrier.”
Hasham’s work has been closely tied to the development of solutions that include rapid workforce programs like Toronto Metropolitan University’s Accelerated Cybersecurity Training Program, which took students six months rather than years to complete.
It has since been replaced by Certifications for Leadership in Cybersecurity (CLIC), but the goal, she explains, remains the same: to boost the number of qualified individuals entering the cybersecurity workforce while increasing representation.
Delivered online and taken part-time, CLIC is both self-directed and instructor-led, has a focus on mentorship, and is designed to be thorough: within six months, graduates join the labour pool having attained two globally-recognized SANS GIAC certifications.
“Women always think, ‘If I’m going into training, what will the return be?’ And then: ‘That investment is coming out of my family budget. Can I really do this?’” Hasham said.
“It’s about putting ourselves first. We really don’t.”
Hasham also suggests that women who don’t apply for cybersecurity roles because they don’t exactly meet the qualifications in the job description should reconsider.
“A woman will say, ‘Oh, they wanted these certifications, but my certifications are [different],’” she said. “And then, she doesn’t apply. But meanwhile, all of the skill requirements are what she has, and more.”
Once women secure jobs in cybersecurity, they need allies in the workplace, Hasham said. And here, men and management have an important role to play in lifting their female counterparts up.
“We need men to be collaborating with us in that learning process, for them to be part of the solution,” Hasham said.
“We’ve gone through this notion that if we created women-only cohorts, women would succeed more. And we learned that men need to be part of that, because you’re going to work in a collaborative co-ed environment anyway. So, we need to create that in our training.”
Finally, Hasham said that women in the industry need to be seen and heard so that others can imagine themselves in a similar role.
“It’s the full belief of: ‘If I see a woman in this profession, I can be a woman in this profession,” she said.
“We need to amplify the women who are in the industry. We need to give them a voice, we need to give them a platform. We need to help them shine.”
DX Journal covers the impact of digital transformation (DX) initiatives worldwide across multiple industries.
How and why companies are choosing to upskill their employees
“Our services are our people. So the more educated, the more qualified I make them, the better it is for my business,” says Matrickz GmbH CEO Dr. Hasan Akram
Jesse Gold, eager for career growth, decided to take matters into his own hands, and, rather than wait for an employer to offer new training, he pursued upskilling independently.
“I believe that continually striving to develop skills and improve yourself is not only fulfilling, but a key way to differentiate yourself in a crowded job market,” he said, explaining that he self-funded a number of business and technical certifications.
Today, he is Director, Strategy and Transformation for UJA Federation of Greater Toronto. Previously, he held multiple roles in Rogers Business over the previous decade. “I believe that my certifications, collectively, showed that I was willing to think critically, but also put in the work,” he said.
In his career experience, he’s felt as though employers should contribute to employee satisfaction, growth and development, with “some sort of program that covers some or all of a training opportunity,” or a conference every year or two.
“While it would be great to have any and all training or certification covered, this is not realistic,” he said.
Yet, an unfortunate aspect of employer upskilling is that “generally, employers who provide such programs provide specific training on-premises, offering only certain courses or training that are deemed to support the company’s current goals,” rather than planning ahead for burgeoning technology.
Call it professional development, call it upskilling, the concept is virtually the same. This can mean courses, lunch and learns, conferences, mentoring, peer coaching, or self-learning. Today, many companies and organizations are proactively giving these kinds of learning opportunities to their staff as a matter of course.
Essential skills in in an ever-changing tech landscape
But what’s behind the trend? In the constantly evolving landscape of technology, the rise of automation, the digital world’s blink-of-an-eye changes, upskilling today has become less an option and more of a must-have for companies in order to keep up. In fact, more than 40% of skills will change over the next few years, says one study. No one – not employees or employers – wants to discover they’ve been a laggard, asleep at the switch, while other industries make them obsolete.
One report estimates that the most in-demand skill areas include big data, analytics, AI (in risk assessment or fraud detection), and machine learning. Still another report says cybersecurity, cloud and customer-user experience skills are “essential.”
New training has become increasingly non-negotiable for employees – to the extent that some are willing to walk away from a job if upskilling isn’t offered. About a fifth of employees in one study have reported leaving an organization because of a lack of development opportunities. In a Gallup study, nearly half said they would be willing to leave their current job for a new one that included skills training.
Upskilling is “one of the core values of all my companies because of several reasons. Our services are our people. So the more educated, the more qualified I make them, the better it is for my business,” noted Dr. Hasan Akram, serial entrepreneur and CEO of automotive software company Matrickz GmbH. “I’m training everyone in AI. It’s always on the top of our priority.”
While there is no formal program, he recognizes that several times a year there is a new innovation with AI. To maintain this knowledge in-house, he created The AI Squad – where employees are updated with new AI tools and technologies.
“And we are teaching them,” said Akram. “This is a constant process.”
What upskilling means for employers
On the employer end, the advantages are clear: an average of two-thirds see a return on investment within twelve months. Nine out of 10 CEOs who brought in upskilling opportunities reported subsequent increased productivity and better retention.
In addition to boosting employee engagement, there’s also a cost benefit to an organization: it obviates the need to hire new staff, and the expenses associated with it, such as advertising the position, time to vet the candidates, and onboarding.
“Too often, employers look outside for new recruits to fill new roles. Employers might realize that they are sitting on incredible talent within its organization that can be better deployed,” said Jake Levant, co-founder of online learning portal Salesclass.co.
His company creates upskilling programs where new immigrants can develop their existing skills to forge new careers in the high tech industry. “We don’t just theorize, we have lots of role play and practice. These are critiqued by co-learners and by professionals that coach those types of roles in industry,” he said.
The company has trained hundreds of people and seen a 70% placement rate in careers that have “incredible growth trajectories,” said Levant. On average, he added, graduates more than double their salary coming out of the program.
“The challenge to unleashing that talent is knowing people’s desires, matching with opportunities, and ensuring there are the right programs to help them upskill to fulfill those new roles.”
Gold, for his part, adds to this word of caution: Upskilling for upskilling’s sake is not a good idea. A critical point before even embarking a new learning journey is to know how or if the new skill will translate to the work environment, so as to ensure the entire exercise isn’t a waste of time.
“Regardless of what type of upskilling you’re looking to undertake, it is important to do the research, to understand what skills the market is looking for, and what skills or certifications people hold that have the job title you’re seeking,” said Gold.
“Being laser-focused in this way can help you hone in on what type of training, mentoring, coaching or support you need to successfully upskill.”
Offering new challenges
Still, one business leader feels differently.
Lauren Imparato, CMO of the all-female led impact investing group Delphos Capital, leads a staff of 120, and believes that there is a form of upskilling that doesn’t involve a formal course or training. Rather, it’s about immersing an employee in a new challenge.
“I always really keep my eye out for initiative – somebody that takes initiative and someone who thinks outside the box. If you take those two things together, they usually point to a prime candidate for upskilling, either in the type of role they do or role out of left field,” said the former Morgan Stanley Fixed Income Vice-President and founder of I.AM.YOU, a wellness company.
“I like to give the person a project. I often think these things like mentorship and courses can take so much time, and have so many steps to get through, that in that time the candidate can lose interest, or even move on to another job. So I start by giving the pinpointed person a project, and if that goes well, even if it is medium well, and they continue with that initiative, then we discuss next level training or a move of position. I’m a big believer in giving someone as much rope as they think they can take,” Imparato said.
“I think that having them understand that you are giving them something outside their box, but you think they can handle it, engenders the best results. Not ‘If you don’t get it you’ve failed and you are out’.”
How to build an upskilling program at your organization
Assess skill gaps and improvements
This evaluation can be carried out through surveys, performance appraisals, and engaging in dialogues with employees.
Establishing upskilling objectives
These objectives should align with the organization’s strategic ambitions and target the recognized skill deficiencies. Well-defined objectives will serve as a compass for the upskilling program and gauge its efficacy.
Customizing training to individual requirements
Recognize that not all employees have identical training needs. Therefore, customize upskilling programs to cater to the specific requirements of each individual, taking into consideration their current skill levels and career aspirations. Personalized training plans are more potent in nurturing employees.
Ensuring access to learning resources
This may encompass in-house training, online courses, workshops, and mentorship. Employees can select the methods that best align with their preferred learning styles.
Articulating the advantages
Outline how it can lead to career advancement, heightened job stability, and personal growth. In doing so, it is likelier to incentivize the learning.
Cultivating a supportive atmosphere
Foster an environment that endorses upskilling; for example, where employees feel at ease asking questions, learning from their errors, and seeking assistance when required. A culture that prizes learning and development naturally motivates employees to upskill.
Employees often have diverse commitments and responsibilities outside work. Provide flexibility in the upskilling process by presenting part-time courses, remote learning alternatives, or accommodating different timetables.
Dave is a journalist whose work has appeared in more than 100 media outlets around the world, including BBC, National Post, Washington Times, Globe and Mail, New York Times, Baltimore Sun.
Bigger paycheques are nice, but upskilling can also increase diversity and smooth over economic shifts
“No one is going to be…untouched by this next wave of technological change,” says one expert.
Even if a worker defies the odds and stays with the same company for their entire career, there is no such thing as a lifelong job anymore.
Technology changes too fast — and so do positions and expectations. Entire sectors come and go at a pace that would have been inconceivable mere decades ago, as markets whip employers and employees about with abandon.
It’s why companies, workers, and even governments are starting to think more and more about the critical role of upskilling and reskilling.
While it would be easy to dismiss these terms as simply the latest buzzwords in a world of digital transformation and workplace upheaval, the stakes can be higher and more significant than either a better bottom line or a higher paycheque. That’s particularly true as technology continues to change and AI rises to challenge almost every aspect of work.
The right upskilling can help older workers remain critical to the companies they already know and understand, help younger workers chase their career dreams, improve retention and fill worker shortage. But upskilling, and reskilling in particular, can also be a powerful tool for diversity and inclusion or to smooth over economic shifts.
It all boils down to managing risks and finding payoffs, both big and small.
“One of the things that we understand in all of our work is that when it comes to hiring for companies, particularly for SMEs — which a lot of our tech companies are — it’s as much about managing risk and the perception of risk as it is about acquiring talent and skills,” says AJ Tibando, the chief strategy officer at Palette Skills, a Canadian not-for-profit focused on upskilling.
Understanding perception of risk and how that plays out in workplaces can be a powerful tool, ushering in untapped potential and retaining workers already well versed in a particular company.
Why do workers and employers want to upgrade?
Tibando says there’s not one kind of worker who seeks additional training or help transitioning to a new career.
“No one is going to be…untouched by this next wave of technological change, whether it’s in your job or in your life,” she says. “It’s kind of coming for all of us in different ways.”
Her organization focuses on people with “potential or untapped potential,” who might have the right sort of underlying skills, but who might lack proper training or experience. They then try to overcome that risk aversion in employers who might usually balk at the candidate.
Abu Batasi, who oversees corporate training in his role as director of sales for Lighthouse Labs, says there is no one reason why individuals and businesses seek out his company for bootcamps — ranging from cybersecurity to data analytics.
The company not only provides training, but also connections to employers for job seekers at the end of their course — a key “value proposition,” says Batasi.
Workers gain new skills and, hopefully, a new job.
A recent report from upskiller PluralSight suggests there’s no shortage of demand for those kinds of services.
In the State of Upskilling 2023, 52% of respondents who work in tech say it’s important to learn new skills in times of economic uncertainty, but that same study also indicated 42% of respondents said they were too busy to upskill.
That poses a challenge for companies that don’t focus on continuous upskilling for employees, and can lead to big costs when retention plummets.
“I think it’s about six times more expensive to hire externally, when you consider the premium that you have to pay, and the recruitment fees and all that stuff, versus if you were strategic about just skilling the right people in your company that are already showing a lot of promise,” says Batasi.
The PluralSight report suggests that benefit is well understood by companies, with 97% of HR and learning and development respondents saying they prioritize internal talent over outside hiring for open positions.
That sort of value crosses generational lines, with workers both young and older seeking new skills. Batasi says it’s often younger workers looking for upskilling while older workers tend to seek reskilling, but, he added, that dichotomy is only a broad generalization.
Bringing in new faces and experiences
While consistency can be a powerful advantage for a company, it can also act as a barrier.
In order to attract new workers and expand the pool of talent across Canada, there have to be targeted interventions tailored to the right circumstances according to Rob Davidson, the director of data science at the Information and Communications Technology Council, a not-for-profit focused on Canada’s place in a digital economy.
“I’ll use cybersecurity as an example,” he says. “They all want to have cybersecurity people with experience, which does not provide any entry points for new talents. So everybody is just recycling the same people, and the gaps are never filled, which is not a good thing if you consider cybersecurity a strategic and national imperative for Canada.”
The benefits of new faces, however, goes beyond new recruits into an exclusive industry. It also allows for a breadth of experiences and backgrounds. But overcoming those barriers, conscious or otherwise, can be a challenge.
Tibando says risk perception gets down to the granular level when companies are on the hunt for new hires. Palette Skill’s data shows there are challenges across almost all demographic categories.
“Despite the fact that everybody goes through the same process, once they hit the job market and human behaviour and risk analysis starts to kick in, older workers take longer to get placed, Black workers — particularly Black women — take longer to get placed.”
Women in general don’t face the same challenges, she says, but Black women endure more interviews and wait the longest between interviews and job offers — even though they are offered initial interviews faster than any other demographic.
Tibando says companies are always lamenting a worker shortage, but need to overcome overt and unconscious biases in order to help alleviate the problem.
Getting it right
Those kinds of barriers don’t exist in isolation, and tectonic shifts in workplaces and whole sectors can have a profound effect.
Sure, many are simply interested in acquiring a new skill and moving up in their careers, but for others it can involve surmounting social barriers or facing a new reality where people feel like their industry and their world is moving on.
Reskilling those workers carries political and social challenges, particularly when areas are dominated by one industry that can become ingrained in their identity, and where changes can have far reaching economic shocks.
But it can’t be solved by expecting everyone to be a tech worker.
Take blue collar workers. As Davidson explains, “in Virginia, for coal miners, they tried to take them from being displaced coal miners to becoming programmers, there wasn’t a fit.”
He says programs need to take into account the industries at question, the workers involved, and considerations of place. His organization helped build a program that reskills oil and gas workers in Calgary as that industry contracts, amid uncertainty and efficiencies.
“There’s some real big workforce development challenges that are out there,” he says.
“And you’ve got to be very careful about trying anybody that says that they can solve it immediately. There’s probably misleading people. Let’s put it that way.”
Why is there such a massive cybersecurity talent gap in Canada?
Canada is short 25,000 cybersecurity professionals and that number could grow in the future. What’s the problem and what can be done about it?
This is a story about the acute talent gap in Canada’s cybersecurity industry, which threatens the productivity of Canadian companies, and could soon create major national security issues.
But it starts with a lesson from the world of football.
“In June 2018, FIFA announced that the 2026 World Cup would be held in North America. Canada, the US, and Mexico’s successful joint bid put more pressure on each host country to qualify for the tournament and perform in front of its home fans,” says Hasham.
Of course, it would be disastrous for any of these countries to start nurturing 2026 World Cup talent in 2025. Building a talent pipeline takes years and years. Today’s 15-year-old phenom is tomorrow’s national team star. You have to get ahead of it.
And therein lies the lesson.
Canada’s cybersecurity industry is currently lagging behind demand, with an estimated 25,000-person shortage. In fact, one out of every six cybersecurity openings in Canada goes unfilled.
To extend the metaphor: Canada is effectively playing the World Cup every day but we’re not able to field a full team. You don’t win a lot of matches that way.
So, what created this talent gap?
“It’s partly demand that’s driving the gap, especially as organizations put more budget behind cybersecurity,” says Hasham. “But there is also high mobility in the cybersecurity profession because the demand for talent is so high. People tend to move and create vacancies in the places they leave.”
As organizations struggle to find talent, Rogers Cybersecure Catalyst is on the frontlines of the struggle to change the dynamics in the Canadian cybersecurity industry. The group empowers individuals and organizations to seize the opportunities and tackle the challenges of cybersecurity. They do this through training and certification programs, in an accelerator for cybersecurity startups, as part of public education programs, and in policy development.
The training element is key.
Many cybersecurity professionals — both at entry level and as part of ongoing career upskilling efforts — covet ‘gold standard’ training for the skills it provides and the career doors it opens.
“It’s also delivered by industry leaders. The trainers are Chief Information Security Officers for leading organizations. The program content is updated every 3-6 months, so it always reflects the current needs of the industry. The resulting certifications that participants get are coveted by organizations around the world.”
But while programs like those at Rogers Cybersecure Catalyst turn out highly appealing professional candidates, the national talent gap is a systemic one.
And it might not get better anytime soon.
How the cybersecurity talent gap in Canada could actually get worse in the future
In her role, Hasham has a comprehensive view of Canada’s cybersecurity talent challenges and the pressures on the sector that could make things harder in the future.
Digital transformation: The all-industry trend towards digital transformation is creating more digital properties all over Canada in need of cybersecurity protection. This has fundamentally created more potential points-of-attack for cybercriminals and hackers — right as the country is facing this critical shortage of talent. And of course, we’re only going to become a more digital nation in the future.
A changing Industry: Cybersecurity is a rapidly changing industry where skills and requirements for practitioners change regularly and make the talent gap more acute, especially with respect to priority areas within the industry.
Stress and turnover: The reality is that cybersecurity is a frequently high stress environment for those already in the profession. This leads to turnover, especially considering that many professionals are overworked given the roles that go unfilled. This stress also serves a deterrent for new people to enter the industry, particularly in an age of employee empowerment. As a result of all of this, organizations are now prioritizing mental wellness.
The ‘brain drain’ potential: There’s a growing concern that U.S. and European companies will trigger a Canadian cybersecurity brain drain by offering higher salaries, appealing remote working arrangements, and training and other perks that many Canadian firms can’t match. In a global war for cybersecurity talent, Canadian firms need to be ready to compete and win.
How to address Canada’s cybersecurity talent gap
Okay, so things are bad. And they might get worse.
How do we change it?
Like with the housing crisis, the cybersecurity talent issues Canada faces involve multiple stakeholders and will require coordinated efforts to address. There is no silver bullet. But one of the most important avenues to pursue is rethinking how we look at people across the Canadian workforce, even if they’re not already skilled as cybersecurity professionals.
This ‘latent talent pool’ needs to be more fully tapped.
“Individuals are coming to cybersecurity training with previous skills from previous career roles. says Hasham:
“For example, we had someone in our program who was a professional chef who pivoted to cybersecurity. When you think of the skills that she developed as a chef — working under pressure, working within a team, knowing how to communicate, knowing when to take the lead, knowing when to follow — these skills are transferable. They are valued by employers. The key is for people to combine these skills with the cybersecurity knowledge and hands-on cybersecurity experience they get in programs like ours. That can create a deeper talent pool for companies.”
Hasham also suggests that recruiting itself needs to change.
“We need to explore alternative ways of recruiting — within the veteran community, within the pool of new Canadians and with women (who are underrepresented in cybersecurity at about only 25% of professionals globally). How do we bridge people from these groups into cybersecurity and what challenges and needs will come with that? How do we profile unusual paths into the industry to show it can be done?”
The barriers to entry into cybersecurity also remain stubbornly high in Canada — often in ways that create issues for talent and employers alike.
“Some new cybersecurity positions require two-to-three years of experience, as noted in a job posting,” says Hasham. “But in reality the role doesn’t actually require that. But someone who might come out of a training program, that has work experience that would make them highly effective in a role gets filtered out. They may not apply. Or if they do, they may not be considered.”
Inevitably, solutions will unfold at the macro level over the long-term as the industry looks at its overall workforce requirements and approach to talent development.
But the issue is now unavoidable.
Canada’s leading cybersecurity agency recently warned that cybercrime “will very likely pose a threat to Canada’s national security and economic prosperity over the next two years.”
Hasham: “This risk aversion in Canada on how and who we hire creates barriers — and that means that roles go unfilled. We need to address that.”
DX Journal covers the impact of digital transformation (DX) initiatives worldwide across multiple industries.
Events4 months ago
Where will AI go next?
Technology5 months ago
Generative AI? “Use the thing…the only way out is through,” says expert
Business6 months ago
How to build and maintain a company culture among a remote workforce
Business5 months ago
Report: Quantum computing investment will improve business and fight cybercrime
Events5 months ago
Global innovation comes to Collision