The Cyber Skills Equality and Diversity Gap: training in employment and employer engagement programme

The key finding of the pilot stage is that there is no shortage of candidates. We cannot know if they will complete successfully or not but we know that for a modest outlay, and use of existing networks, we can recruit generate 300 candidate applications for 24 places. This was also delivered in a very short period of time. Once the expanded programme has been delivered and the recruitment network solidified and extended, we believe that the cost of promotion and recruitment, because of the network we have created, can be absorbed as a cost of sale going forward and is therefore sustainable in this model without further funding beyond this bid.

The other stakeholder group that was meant to be created did not develop in the same way. This is because we only engaged with one employment agency rather than many. We will continue to work with Hawker Chase, the agency partners for the pilot, but we will focus time and resources on creating an employer network that will mirror the recruitment network. The additional spend will be pushed into these areas primarily. We will aim to deliver four overlapping cohorts of 25 candidates. Which means we need employers to take 100 people, aiming for 75% women. The focus of the additional resources from government in this programme will be on creating a sustainable employer eco system with agencies, larger companies, SMEs and trade associations. If we can build that architecture, then the programme becomes sustainable and can be rolled out to other training providers by government and in other formats such as the Cyber Cadets model.

The programme is based on a fast track to employment methodology:

1)         Identification of stakeholder network from which to source possible candidates.

2)         Recruitment of employers who needed capacity.

3)         Promotion of the programme through this network to generate applications.

4)         Online diagnostic process gauging the suitability of candidates for Cyber Security careers.

5)         Further Assessment and Interview leading to offer of employment by the partner companies as individuals ready for a career in Cyber Security.

6)         Followed by completion of a ten-week training programme and subsequent deployment as Information Security Specialists/Officers in Governance, Regulation and Compliance, SOC analysts and Penetration Testers.

The fast track methodology creates cohorts employed as Cyber Security professionals to be trained – funded by the employers – in the skills needed to perform key roles required. This has demonstrated that the perceived high barriers to entry in the industry are artificial.

Outputs

1)         Expansion of stakeholder network of organisations who can identify candidates and help recruit them

2)         Extension and expansion of the Employers stakeholder network with substantial marketing and the employment of an expert to manage and develop this group

3)         Marketing, PR and recruitment process

4)         Employment and training programme

5)         Research report on the process building on the White Paper to create something like a Green Paper of specific proposals

Outcomes and Impacts

1)            A 75% female cohort of employed and accepted into a career as Cyber Professionals

2)            Two sustainable networks working closely together to extend and expand the number of cyber Security Professionals

3)            A step change in the delivery of professionals and a change in the terms of the debate on how the Cyber Gap should be filled

Please leave blank if not applicable

The initiative has engaged with employers through various means; notably a client briefing day that was well attended by 15 delegates representing multiple stakeholders. This briefing has helped trigger further client meetings whereby one client has committed to employing a near full cohort of between 16 and 20 candidates, and another three, possibly four clients, committing to employing 10 candidates between them. There will be a further marketing push to specific PGI and Hawker Chase customers to see if any further interest in employing another 10 candidates we can make available for the second cohort, should 40 candidates progress from the Assessment Centre. The further meetings have prompted both individual programme designs for employer skills and profile business needs, and also collaboration with the employers seeking to recruit on the second cohort to agree on a programme design that suits all needs. Presentations have been delivered providing intricate detail on the model and experience drawn from the previous ex-Forces’ programme in relation to environmental and learning needs or preferences.

Building on this work, government funding will allow us to develop the employers network to the same point at which the recruitment network currently functions. This will involve engaging:

1)    A wider range of employment agencies and head hunters in the process

2)    Targeting of 30 larger companies to explain the concept and engage them for these cohorts, building on the engagement with 15 companies already completed

3)    Engage through trade associations with SMEs to develop a cohort of single individuals earmarked for specific SMEs

There will be four cohorts delivered, with 25 candidates on each. 75% of the candidates will be women and the recruitment phase will extend and adapt to target people from neuro-diverse and BAME backgrounds with the aim of including 25% of the candidates from these groups.

Provide clear evidence that initiatives are likely to identify, train and place candidates who have not been previously employed as cyber security professionals into cyber security employment that reflects the training and knowledge acquired through the initiative, within 12 months of initial funding.

(Evidence can include certifications awarded to candidates at end of training, organisation engagement with employers, work readiness of candidates).

All candidates are employed at the beginning of training and deployed if they complete the training by the company that hired them.

Demonstrate a realistic prospect of becoming self sustainable within 12 months of initial funding. As and when government funding ceases, confidence would be needed to assure DCMS that the removal of funding from this initiative would not affect the continued viability of the applicant organisation.

The assessment process will give additional weighting to initiatives that focus on helping more women candidates. If applicable to initiative, provide a detailed plan for, and a commitment to, placing women (making up at least 50% of initiative cohort) into cyber security roles.

The lack of effective entry points to the profession has inhibited the numbers of women applying but the image and culture of the industry has not helped. Employers tend to be sceptical about the value of university cyber security qualifications and look instead for practical experience and flexibility, but they need leading towards candidates from non-traditional backgrounds. There are many courses to help existing professionals fill skills gaps, but few effective new entrant courses and the response to the pilot programmes has demonstrated the extent to which this course is filling an important gap.

Building on the pilot, this programme will allocate 25% of the places this time to Neuro-diverse and BAME candidates. The research will map learning from the Women’s cohorts onto the experience of these cohorts.

The project has the following deliverable elements:

1)    Stakeholder Network engagement

2)    Marketing/PR for recruitment and employer engagement

3)    Recruitment Process/Skills Assessment – online

4)    Skills Assessment – in person and interview

5)    Employment

6)    Training for Cohorts 1-3

7)    Deployment

8)    Research and Analysis

9)    Publication

If available, attach a one page project plan (e.g. Gantt chart or timeline plan on a page). This will be considered in the assessment phase.

– your organisation has previous experience in delivering initiatives of a similar scope and / or scale within cyber security;

– specialist expertise is in place, or will be recruited, to run and manage initiative activities and if applicable, indicate any certifications or qualifications held by your industry experts.

PGI Cyber Academy was established to deliver Cyber Security training and services. It has delivered across all levels of Cyber Security training and has an extensive team of trainers and practitioners. The methodology for this project has been tested in two demographics and proved successful. The project team have run multiple complex government funded projects in the past. In addition to the women’s and veteran’s programmes already described, PGI was commissioned by HMG to retrain a number of individuals from a non-Cyber background, working for a foreign government. A detailed case study of this project can be supplied on request.

The expanded delivery of this programme will extend the benefits of this model to 75 more women and 25 people from neuro diverse and BAME backgrounds. Some of this group might also, of course, be women as well. Therefore, the benefits of delivering cyber security professionals will be magnified and the research will extend to exploring the applicability of this model to these groups.

The next stage of the research and the publications that will stem from it, will move from a white paper approach of mapping out the general areas and identifying the key problems, to providing a model of the way in which this approach can be taken to scale nationally across different target groups and across the Cyber Security industry generally.

This programme will deliver individuals who will be ready on completion to enter the UK economy as competent cyber security professionals with qualifications and a useful balance of theory, practical experience and technical skills. Five of the modules within this programme provide validation of awareness and application skills aligned to the Institute of Information Security Practitioners (IISP) skills framework, which is recognised as part of the Government’s investment in cyber security –  the IISP consortium has been appointed by the National Cyber Security Centre (NCSC), a part of GCHQ, to provide certification for UK Government Information Assurance (IA) professionals. Within PGI’s GCHQ Certified Training, the Knowledge Areas (KA) that exist within Cyber Security Body of Knowledge (CyBOK) process are introduced, described, discussed and in most cases extended into practical, hands-on exercises that re-enforces the learning in the relevant topic.

The breakdown of the training programme is as follows:

In terms of the Cybok, the main elements are covered in the following modules above:

Cryptography – Sec+, QSTM, ATM

Privacy & Online Rights  – Sec+

Human Factors – Sec+

Law and Regulation  – QSTM

Risk Management & Governance – CISMP

Network Security – Sec+

Distributed Systems Security – Sec+

Operating Systems & Virtualisation Security -Sec+

Web & Mobile security – QSTM

Hardware Security – this can be added in if employer need is identified

Authentication, Authorisation & Accountability (AAA) -Sec+

Malware and Attack Technologies -Sec+ (basic level)

Adversarial Behaviours Security -ATM, Sec+

Operations & Incident Management – ODF, CISMP

Forensics ODF

Cyber-physical Systems Security – Sec+ (at very basic level)

The following can be added in if necessary:

Software Security

Secure Software Design & Development

Physical Layer & Telecommunications Security

Explain what inputs, data and records you will collect to evidence initiative outcomes. How will you make sure that you can attribute skills and employment outcomes directly to the CSIIF?

1)    The fast track employment model

a.    As a generic model for cyber security training

b.    As a mechanism for addressing equality and diversity

2)    Creation of stakeholder network of women’s organisations

a.    Interviews and focus groups with organisations on blockers and enablers in the industry and the applicability of this model

3)    Employers stakeholder network to explain and build buy-in to the project

a.    Interviews and focus groups with organisations on blockers and enablers in the industry and the applicability of this model

b.    Surveys at the point of employment and at the end of the year after several months deployment

c.     Detailed engagement with individual employers to enhance the network

4)    Marketing and recruitment process

a.    Description and modelling of this process into a tool kit for use by others

5)    Skills assessment

a.    Assessment of the need for a generic online tool and system that can be taken to scale

b.    Consultations with stakeholder groups and employers’ forums on scalability of the fast track process

6)    Training

a.    Feedback and assessment with candidates on the training programme

7)    Summative meeting of key stakeholders to present findings and discuss proposals for scaling the project nationally

impact is reduced