Turning Interns into Cyber Warriors

State and local governments are desperate for skilled cybersecurity workers to help them secure critical systems and sensitive data.

Many chief information security officers rely on small staffs of eight to 10 workers and modest budgets that amount to roughly 1 percent of their states’ overall budget, according to Erik Avakian, CISO for the commonwealth of Pennsylvania.

Given those circumstances, competing with federal agencies and the private sector for talent can be a daunting task — but not impossible.

Maryland’s Montgomery County is exploring how it can groom recent college graduates into cybersecurity professionals who eventually could fill desirable positions, such as security project manger and security analyst, said Security Official Keith Young.

The county recently launched two paid internships for college graduates in its Department of Technology Services. Interns will work 40 hours per week alongside seasoned IT professionals and get experience handling technical operations, incident response, risk analysis and policy development. Graduates could earn up to $45,914 a year, according to a posting on the county's website.

Young oversees a $1.2 million budget and has a full-time staff of four people who handle core cybersecurity functions for the county. He expects the paid internships to nearly double his staff at a time when companies and agencies are struggling to attract cyber talent. Young wants to work with the county’s Department of Economic Development to create a long-term, formal program.

“I’d much rather bring in a team of interns that we can train, knowing that in a couple of years, we’ll either be able to offer them jobs,” Young said, “or that we’ll essentially kick them out of the nest, and they’ll go and double their salary and work at one of the large consulting firms or for another government entity.”

The internships are permanent, but Young anticipates graduates will gain at least two years of experience before finding higher-paying jobs that require more experience.

Competing for Cybersecurity Experts

The county estimates that local companies with a major focus on cybersecurity provide about 3,500 core cybersecurity jobs. Finding and attracting employees to work for the county is challenging because public- and private-sector demands for cybersecurity skills are growing. College graduates are also in a bind, because they usually don’t have adequate hands-on experience upon graduation. The county’s intern program could help to fill that gap.

“One of the challenges that they’ve said is that people graduating with cybersecurity degrees … need to have experience in order to get a job, but they can’t get a job unless they have experience,” Young said. “This is a great way to take someone that has the education but no experience and help them get trained, help them gain experience.”

Pennsylvania is considering how it could use internships to attract cybersecurity workers, Avakian said. Private-sector firms such as AT&T and LexisNexis are also using internships to develop the workforce, according to Government Technology.

Standardizing the Job Market

But the immaturity of the cybersecurity job market makes the hiring process harder for government and industry.

For example, the job requirements for a network administrator often vary among agencies and companies, said Benjamin Scribner, director of the Department of Homeland Security’s National Cybersecurity Professionalization & Workforce Development Program. Scribner highlighted the National Cybersecurity Workforce Framework as a means for companies, agencies, and colleges and universities to have a common taxonomy and lexicon to classify and categorize workers.

“It’s important to those universities to be able to say, ‘If you get my degree, it will get you these jobs,’” Scribner said at a CyberMontgomery conference in May. “It’s directly translatable into those jobs.”

“Instead, we have people getting generalist training, certification [and] education to give us a baseline of knowledge and skill that doesn’t really translate specifically into the jobs that are in need,” Scribner added. “It’s hard for colleges to do that.”