The Cybersecurity Talent Problem Nobody Wants to Name, and How Networking Quietly Solves It

By Christina Shannon, CIO at Kik

You have heard the line a hundred times. There is a cybersecurity talent shortage. Millions of unfilled jobs. The industry is desperate for people.

And then you apply to fifty entry-level roles, hear back from two, get ghosted by both, and start to wonder if the whole thing is a lie.

It’s not a lie. But it’s not the whole truth either. And if you are trying to break into this field, or trying to grow once you’re in it, you deserve someone to tell you the full version, not the one recruiters put on conference slides.

So let’s do that. And then let’s talk about the thing that solves the problem, which almost nobody teaches on purpose.

The Shortage Is Real. It’s Just Not Where You Think.

The “cybersecurity talent gap” is real, but it’s concentrated in very specific places, and entry-level isn’t one of them.

Entry-level is flooded. Bootcamps, career-switchers, new graduates, IT pros pivoting in, military folks transitioning out. Every SOC analyst posting gets hundreds of applicants. Every “junior” role somehow wants three years of experience. If you’re trying to break in, it does not feel like a shortage. It feels like a wall.

The actual shortage is in the middle. People with three to seven years of real experience who can do more than one thing. People who can bridge the SOC and the boardroom, translate between engineering and compliance, run an incident and brief an executive, think about cloud security without freezing up, understand the business well enough to make smart tradeoffs. Those people are hard to find. Organizations will pay significant premiums for them and still struggle to hire them.

The shortage at the senior level (CISOs, security architects, GRC leaders who actually understand risk) is also real, and probably worse.

So when the industry says “talent shortage,” what it actually means is: we don’t have enough people with the right combination of experience, range, and judgment. That is a quite different problem than “we don’t have enough people.”

Why This Matters If You’re Just Starting Out

Here is the uncomfortable part: the way most people try to break in is almost perfectly designed to keep them stuck.

They stack certifications. They grind practice labs. They rewrite their resume for the thousandth time. They apply to hundreds of roles online. And most of them plateau because that path is trying to solve the wrong problem.

Certifications do not get you in. They get you considered, maybe, if someone already noticed you. Resumes do not get you in. They confirm a decision that’s already been leaning your way. Online applications do not get you in. They go into a pile with four hundred other resumes and get filtered by a keyword match.

None of that is how people actually get hired in security. Not at the entry level, not in the middle, not at the top. It’s especially not how people get hired for the good roles. The ones that do not appear publicly. The ones passed through trusted channels. The ones where someone says, “I know a person” and the hiring manager says, “send them to me.”

The shortage is not the problem you need to solve. Visibility is.

The Part Nobody Teaches: Networking Is the Answer

I will say this plainly, because I wish someone had said it to me years ago: your network will do more for your career in security than your resume ever will.

That’s not a LinkedIn influencer take. It’s just how the industry works. Security is a small world. Smaller than you think. The same names show up at the same conferences, in the same Slacks, on the same podcasts, in the same conversations. Reputations travel fast. Vouches matter. “I worked with them, they’re solid” is worth more than a CISSP.

Most of the real opportunities (the interesting projects, the roles that aren’t posted, the promotions that happen because someone advocated for you in a room you weren’t in) move through conversations. Not applications. Not algorithms. Conversations.

You don’t get into that flow by applying to jobs. You get into it by being known.

What “Being Known” Actually Means

Networking has a marketing problem. It sounds slimy. It calls up images of awkward handshakes at rooftop events, people collecting business cards they’ll never use, someone DMing you on LinkedIn asking for a favor five minutes after connecting.

That is not networking. That is just bad networking.

Real networking, the kind that compounds, looks almost nothing like that. It looks like being a useful, visible, generous person in your field, consistently, over time. That’s it. The “tactics” are all downstream of that idea.

Here is what works, in rough order of how uncomfortable it feels at first:

Show up consistently in one community. One local meetup, one Discord, one Slack group, one conference you go to every year. Don’t spread thin across twenty. Be a regular somewhere. Familiarity is the foundation of everything else. People help people they recognize.

Help before you ask. Answer a question in a Slack thread. Share notes from a training. Review someone’s resume. Offer to pair on a problem. The currency of a network is generosity, and it compounds faster than anything else. People remember who was helpful before there was anything in it for them.

Write one thing publicly every month. A LinkedIn post, a short blog, a breakdown of something you learned, a teardown of a vulnerability you read about. It doesn’t have to be brilliant. It has to exist and have your name on it. Over a year, that’s twelve pieces of evidence that you think, care, and show up. You would be amazed how few of your peers are doing this.

Ask to talk to people whose jobs you want. Most senior folks will say yes to a 15-minute coffee chat. Not all, but more than you would expect. Do not ask for a job. Ask how they got to where they are, what they would do differently, what they see coming in the field. That’s a conversation people enjoy. Jobs come from those relationships later, almost never in the first conversation.

Stay connected with people you used to work with. Five years from now, the people you sat next to in your first SOC job are going to be managers and directors. Some will be CISOs. The best time to stay in touch is before you need anything. A quick message every few months, something like “saw you moved to X, congrats,” keeps the line warm.

Go to the things. Conferences, meetups, BSides, ISSA chapters, vendor events. Even the ones that seem like they are not for you. You don’t have to work the room. Just be there, talk to a few people, follow up with one or two of them afterward. Showing up is 80% of it.

How Networking Actually Solves the Talent Gap

Here is the thing that ties it all together. The talent gap, at its core, isn’t really a shortage of people. It is a matching problem. Organizations cannot find the right people, and people can’t find the right opportunities, because they are not in the same flow of information.

Networking is how you get into the flow.

When you are known in your community, your name comes up when someone is hiring. When you have written things, hiring managers can look at how you think before they ever interview you. When you have helped people without expecting anything back, some of those people become advocates you did not even know you had. When you stay in touch with old coworkers, you find out about roles before they are ever posted. When you show up at events, you have warm connections at companies you would otherwise be cold-applying into.

None of this is magic. It is just time and consistency pointed in a deliberate direction.

And here’s the real unlock: this works whether you are trying to break in, trying to get unstuck in the middle, or trying to move into leadership. The mechanics are the same. Be useful. Be visible. Be generous. Stay in touch. Show up.

If You Do One Thing After Reading This

Pick one person whose career looks like something you would want, and send them a short, specific message. Not “can you help me break into cyber?” Something more like: “I saw your talk on incident response last month and the part about communication during an incident really landed for me. If you are ever open to a 15-minute chat, I’d love to ask how you built that skill.” Specific. Short. Respectful of their time.

Some will say no. Some will not reply. One or two will say yes. And one of those conversations, six months, or two years from now, will turn into something you could not have predicted.

That is how careers in this field move. Not through the job board. Through the network.

The shortage is real. The wall is real. But the door is not where most people are looking for it. It is in the community you have not joined yet, the post you have not written yet, the message you have not sent yet.

Start there. That is the whole game.

Written by Christina Shannon, CIO at Kik

https://www.linkedin.com/in/christina-shannon-fl/