IA job prospects bright

No one reading this column needs general references to news about the economic difficulties we are living through in the United States and elsewhere. He's looking for a permanent job. Just the other day, I spoke with a long-time friend and colleagues from the information security field who used to earn a decent living as a much sought-after consultant; last week he canceled his business telephone line to save money.

High-tech talent set to take off Another colleague of ours hasn't had a consulting contract in months – despite having had trouble in the past keeping up with demand for his services. The situation makes me think more positively about having moved from the business world to academic in 2001 – despite dropping my nominal salaried income by 57.5% at that time and now earning about one-third of what I'd be making as a senior IA executive in industry today. I think that security consultants may be suffering from a side-effect of the economic downturn: clients who don't already have or want permanent information assurance (IA) personnel may simply have decided to continue taking risks and hoping that nothing bad will happen to them. At least I have tenure, which means that I'm not going to be fired unless I appear in class out of uniform (Vermont Militia = US Army Class A greens), show up drunk (I never drink alcohol), treat a student rudely (no way) or recite Monty Python skits in class… uh wait a minute, I do recite Monty Python skits in class – but very briefly. Only little bits of them.

Really. Honest. Perhaps organizations who have enough savvy to employ permanent IA staff also understand the value of hiring good people for these critically important functions. But more seriously, there is good news for IA students and professionals: according to an extensive survey published by Foote Partners, LLC in Florida, job prospects are good for information assurance (IA) specialists. Upasana Gupta of BankInfoSecurity reviews the "2009 IT Skills Trends Report Update" which is available free in return for buying any other report from Foote or simply for registering with them. Interestingly, the skills most frequently sought-after by employers include (quoting Gupta directly): • Forensic Analysis• Incident Handling & Analysis• Security Architecture• Ethical Hacking• Network Security• Security Management Professor Gene Spafford said in his acceptance address for the National Computer System Security Award in 2000 that we were "eating our seed corn" by paying IA professors less than our IA graduates earn on their first job.

Gupta quotes the company as describing a number of factors (described in more detail in her excellent article) increasing demand for IA professionals: • IA is increasing recognized as strategically significant to all aspects of business.• Customers are demanding better security to protect their own information.• Laws and regulations are pressuring organizations into compliance with better security.• Liability costs for non-compliance are rising.• Virtualization is increasingly making technologists aware of security issues. The Foote report shows average salaries for various IA positions ranging from $70,000 to $170,000. How we are to attract professionals and recent graduates to our field of teaching and research in universities is a mystery to me. Universities will usually be willing to provide publicity for donors, so it's not a one-way donation devoid of short-term value for the donors, either. Some years ago I begged industry to think ahead and start funding supplements to professors' salaries so university IA departments can compete with industry in attracting field-experienced, professionally certified experts with advanced degrees to our faculty. Anyone interested in raising my salary – oops, our salaries – at Norwich University is welcome to contact me directly and I'll put you in touch with our Chair of Computing to make the arrangements. We even teach courses for free and do work on courses during the summers, when we are not paid for our time!

In the long run, without support from industry to raise salaries, the only people who are going to be willing to work long hours in universities for pathetic salaries are nut-cases like my colleagues and me who work on courses and research because we are addicted to teaching. WE ARE ADDICTS. But I can stop any time. Really.