Eliana Willis

With more companies looking towards a digital-first approach to business going forward, demand for digital skills is on a sharp upwards trajectory. Finding developers, cybersecurity professionals and cloud migration experts is top of the agenda for many hiring managers as organisations look towards long-term growth and sustainability, following a period of rapid transformation.

The extent of this demand is reflected in a booming tech jobs market. According to CompTIA’s June 2021 European Tech Hiring Trends report, employers posted just shy of 900,000 ads for new tech roles in Q1 2021, representing a 40% increase compared to the third quarter of 2021. Software developers were listed as the most in-demand occupation category, accounting for almost 250,000 job ads posted in the quarter.Developers wantedThe call for developers has been consistent throughout the pandemic, and is likely to present one of the biggest recruitment challenges for employers over the coming months. This was certainly true for 61% of respondents in a survey of 15,000 developers and HR managers by tech-hiring platform CodinGame, which offered a snapshot of the most in-demand development and programming skills among businesses in 2021.CodinGame’s 2021 Developer Survey, which was conducted between October and December 2020, found that 64% of companies were looking to hire up to 50 developers in 2021. Others had even more ambitious recruitment targets: 14.4% said they planned to hire 50 to 100 developers, while 13.5% hope to recruit over 100 new developers over the course of 2021.SEE: What is a software developer? Everything you need to know about the programmer role and how it is changingGoing hand-in-hand with the increased demand for coders, knowledge of programming languages is also being sought by businesses undergoing digital transformation and launching new apps and digital platforms.The same survey from CodinGame found that JavaScript, Java and Python were the most important programming languages for employers, with close to 60% of respondents citing high demand for JavaScript and Java in particular. This makes sense, given the explosion of mobile and web apps since the start of the pandemic, and also supports CodinGame’s findings surrounding the demand for full-stack and back-end developers – Java remains the most popular language for building web application backends, after all.
Image: CodinGame

Recruiters anticipate DevOps roles being particularly difficult to fill. The switch to remote working brought a sudden increase in demand for DevOps experts capable of managing organization’s cloud infrastructure, and helping companies migrate their services to the cloud.This trend is anticipated to continue throughout the course of the year, CodinGame found: 43% of survey respondents cited DevOps positions as their number one recruiting challenge in 2021, followed by back-end developers (41%), full-stack developers (41%), architects (33%) and software engineers (24%).Software development meets operationsAccording to GitLab’s April 2021 Upskilling Enterprise DevOps Skills Report, DevOps skills are projected to grow 122% over the next five years, making it one of the fastest-growing skills in the workforce. In the US, there were over 300,000 job openings requesting DevOps skills in the past 12 months – and this demand is spreading rapidly across roles, organizations and industries.This demand is also reflected in the UK, where employers have had to contend with a pre-existing digital skills shortage that has been made considerably worse by the combination of Brexit and COVID-19.Research published in June by recruiter Robert Half identified a 319.4% uptick in demand for DevOps skills over the 12 months to June as businesses continue to integrate software development with IT operations.Robert Half’s research, which was gathered between April and May 2021, provided a more generalised overview of the skills needed by organizations in the second half of the year, and the roles hiring managers across various departments are most eager to fill.For chief information officers (CIOs) and chief technology officers (CTOs), the top five priority hires for H2 2021 are cloud engineers, front-end developers, business transformation specialists and database administrators, Robert Half found.
Image: Robert Half
Interestingly, the results varied slightly when CIOs and CTOs were quizzed on their most important interim hires. In this instance, frontend developers topped the list, followed by cloud engineers, system security specialists, business intelligence specialists and network/system managers.Software as a service (SaaS) skills and Python were also highlighted as speciality technical skills of increased importance to employers, with demand for these growing by 143.1% and 136.5% respectively. Once again, developers find themselves in a favourable position in post-COVID jobs market. Phil Boden, senior manager at Robert Half, told ZDNet: “Across the board, we are seeing requests for candidates with demonstratable experience in Python, .NET, C# and PHP, while financial services firms are specifically looking for talent with a strong working knowledge of Java.”A mixed pictureCompTIA’s Hiring Trends Report also reports high demand for Java and PHP, with the programming languages featuring 6th and 10th in the technical skills most cited in tech job postings.
Image: CompTIA
Yet these languages come after more fundamental skills, such as “programming” (2nd), “businesses IT systems” (3rd), “IT system administration” (7th) and “[Microsoft] Office/spreadsheets”, which maintains a near-universal entry requirement for jobs and was the number-one skill required by employers.CompTIA notes that job postings “invariably align with the job roles employers are seeking to fill,” which helps explain variability in the importance placed on various skills within reports. However, it points out that nearly every technology job role shares a number of common skill threads: software, infrastructure, data and business applications are all represented, and employers “frequently expect some level of cybersecurity, data, cloud, project management, and related technical skills.”
Image: CompTIA
The report reads: “At the skills level, summary analysis across all job postings for all tech job roles suggests employers tend to seek well-rounded candidates. This also reflects the ever-expanding nature of innovation, whereby new platforms, new coding languages, new hardware and devices, new data streams and new combinations of technology building blocks (think IoT) are a de facto part of the job for any technology professional.”This also explains why cybersecurity is often not specifically listed in skills reports, despite the fact employers increasingly expect baseline IT security knowledge from workers.Take the UK, for example: according to the 2021 City and Guilds Skills Index published in June, jobs postings for “cybersecurity technician” in the country increased by a massive 19,222% between April 2020 and April 2021, whereas roles for “cybersecurity engineer” grew by 292%. This compares to 312% growth in ads for “full-stack developer” during the same period, and a 184% increase in job postings for “Azure architect”.Cybersecurity above all?Demand for cybersecurity pros is by no means localised to the UK. A report by Harvey Nash and KPMG in September 2020 identified a huge demand for cyber professionals globally, with cybersecurity skills cited as the most in-demand skill by more than a third (35%) of the 4,200 IT professionals surveyed.

This demand has continued into 2021. According to Harvey Nash’s 2021 Tech Salary and Hot Skills report, published June 2021, cybersecurity remains the number one skill for employers in the UK (31%) and the US (36%). “Demand has increased throughout the pandemic as security specialists have been required to play the key role of keeping businesses protected during the unprecedented challenges of moving to mass homeworking,” Harvey Nash CEO Bev White told ZDNet.SEE: Cybersecurity: Why a culture of silence and driving mistakes underground is bad for everyoneDrilling down into the types of roles businesses are hiring for, ethical hackers, information security analysts, chief information security officers (CISOs) and cybersecurity consultants all feature prominently, Harvey Nash found.Alongside IT security, employers also seek cloud and data/analytics expertise, again reflecting the demands of changing business needs as digital transformation accelerates and more businesses make the wholesale shift towards remote working. Among the cloud-specific roles companies are hiring for, Harvey Nash identified strong demand for “cloud architect”, “cloud engineer”, “cloud security specialist”, DevOps engineer and “Amazon Web Services specialist.”Organisations are maturing beyond simply moving software online and becoming more sophisticated in how they deploy and exploit their online assets, for instance through distributed cloud, edge computing and marketplace platforms,” Harvey Nash said.Data everywhereWithin the data and analytics realm, companies are particularly eager to fill roles including “data analyst”, “data scientist”, “data engineer” and “business intelligence analyst,” Harvey Nash found.”The skills driving transformation are the ones that are focused on the customer, as well as those that stitch together the ever-increasing array of technologies and platforms,” said White.”On the customer side we are seeing increasing demand for UX experts, as well as digital experts with strong customer-facing and product development skills. On the technical side we are seeing an increase in demand for architects with a strong focus on cloud platforms.”Demand for more niche skills is also beginning to emerge as businesses digitize, particularly those related to automation and artificial intelligence/machine learning technologies. Gathering the data businesses need to inform the next steps of their transformation journey is one thing; making sense of it and putting it to use is quite another.Organizational change management (27%), enterprise architecture (23%), technical architecture (22%) and advanced analytics (22%) were also identified as skills facing shortages in the company’s 2020 Harvey Nash/KPMG CIO Survey.OutlookThe digital skills deficit is not a new problem for businesses, but it is one that has been made significantly more urgent due to COVID-19.Digitization efforts may have put many companies in a better position to tackle the challenges of an increasingly data-driven economy, but it has also driven further demand for tech workers with the skills needed to see these plans through – as well as keep driving them forward.Employers face a problem here: at the same time as demand for technology workers is on the rise, the pool of available talent is quickly shrinking. Software developers, cloud engineers, DevOps professionals and cybersecurity technicians are all needed to build, maintain and protect businesses as they move towards the next steps of their transformation journeys, which have been accelerated by the global pandemic.In order to meet their increasingly complex technical needs, businesses will need to become experts at both attracting and retaining this talent in an increasingly competitive jobs marketplace, as well as levelling up their existing employees with the skills they need to develop at pace. While this may not completely compensate for the shortage of tech talent, it will go some way to address the issue of a widening skills gap in a time of rapid digital innovation.

Digital transformation More

Nearly half the money the UK is spending on IT goes on supporting legacy IT systems – to the tune of £2.3bn a year.That sum amounts to about half of the £4.7bn the central government spent on on tech in 2019, according to a new report from the Cabinet Office that highlights the cost of maintaining legacy systems or ‘keeping the lights on’.

“A recent analysis by government security indicates that almost 50% of current government IT spend (£2.3b out of a total central Government spend of £4.7bn in 2019) is dedicated to “keeping the lights on” activity on outdated legacy systems, with an estimated £13-22bn risk over the coming five years,” the report notes. SEE: Microsoft: Here’s how to shield your Windows servers against this credential stealing attackAs the report highlights, the technical debt that tax payers are lumbered with includes important operational services that are provided by out-of-date legacy systems often built on obsolete technical platforms or using programming languages that are no longer widely supported.Beyond costs, the report acknowledges increased cybersecurity risks and being unable to introduce new government services because “worthy but dull” is more attractive than risking spend on new IT systems. “Some departmental services fail to meet even the minimum cybersecurity standards, and the inability to extract usable data from these legacy systems,” the study notes. 

It also singles out the Home Office, which has the biggest tech budget, noting has “not been able to retire any of their twelve large operational legacy systems.”The report comes as the National Cyber Security Centre (NCSC) – a part of spy agency GCHQ – has raised alarm bells over ransomware and data breaches. Recently appointed NCSC CEO Lindy Cameron in May called on boards to promote CISOs to the same level of top legal counsel and finance officers following recent software supply chain attacks. The UK is also taking a stab at boosting government online services through the new Government Digital Service (GDS) department, which is looking to improve online tax return services. The UK still hasn’t figured out how to implement something like Sweden’s BankID system, which provides an effective nationwide web- and smartphone-based identity scheme through the nation’s banks that’s used to sign payments for and sign-in to websites of telcos, all government agencies, and even small businesses. SEE: Attacks on critical infrastructure are dangerous. Soon they could turn deadly, warn analystsThe report calls out agencies for not having a systematic way of reviewing operational metrics, such as uptime, the number of attempted cyberattacks, and system efficiency. Surveys with agency digital chiefs also turned up procurement problems and “frustration around the level of duplication” and a lack of information-sharing between departments. And the government’s efforts towards gathering data for better decision-making is basically being wasted. “Our investigations suggest that many government departments are investing significant sums in collecting and storing often very large datasets but making little use of this data to influence action of decision making,” it notes.  More

Across the globe, competition for cybersecurity IT professionals is high and salaries are competitive but demand and cost of living mean that some cities are better than others.An analysis by Techshielder found that Washington D.C. and Singapore offer the best opportunities in terms of job openings, salary, and cost of living. London was ranked number eight because of its high cost of living and relatively low salaries. Berlin ranked number three, gaining points because of a low cost of living and good salaries. Luxembourg pays the highest salaries at $154,000 but it has low job availability. London and Tokyo both pay about the same in salaries, $111,000 but Tokyo scores bottom of the list at number 10 because it has much lower job availability — despite a lower cost of living compared with London. Techshielder identified four key cybersecurity skills that are in high demand. These are: understanding how to protect networks; understanding threat intelligence; being able to apply data security regulations enforced by US and European agencies; and cloud expertise — knowing how to protect cloud-based IT systems.Lasse Walstad, cofounder at Techshielder notes that, “The cities we mentioned aren’t the only places, however, they do represent the best opportunities that await cybersecurity professionals.”More information can be found here. Salaries are in British pounds and I converted the above quoted salaries at $1.35 to one pound sterling. 
More

StarHub says personal data of its customers, including email addresses and mobile numbers, have been found on a dump site. The Singapore telco, however, insists none of its customer database or data systems has been breached. The data breach was discovered during a “proactive online surveillance” on July 6 by its cybersecurity team, StarHub said in a statement late-Friday unveiling the breach.On its website informing customers of the incident, the telco said it needed “time” to investigate the incident and assess the impact before confirming the breach publicly. The relevant authorities, however, were informed of the breach. According to its statement to local media, StarHub said an illegally uploaded file containing the leaked data was found on a third-party data dump website. It added that the information appeared to date back to 2007. 

The file contained mobile numbers, email addresses, and identity card numbers of 57,191 customers who had subscribed to StarHub’s services before 2007, it said. Apart from broadband and mobile, the telco also offers pay TV services in Singapore. All affected customers were from its consumer business, it said.When asked, a StarHub spokesperson would not say which of its customers were impacted or how many of these were existing customers. She also declined to reveal how often it conducted its online surveillance, citing “security considerations”, saying only that the telco conducted such activities “regularly”.She would not provide details when asked if the telco had determined the cause of the breach, saying only that there currently were no indications of compromise on its existing systems. 

According to StarHub, no credit card or bank account details were breached, and there currently were “no indication” the leaked data had been “maliciously misused”.It also noted that none of the company’s “information systems or customer database” was compromised. On its website, it said its investigation into the breach “verified the integrity of our network infrastructure”.The telco said an incident management team was assessing the breach and digital forensic and cybersecurity consultants were investigating the incident.The telco said it had begun “progressively notifying” affected customers via email and was offering six months of complimentary credit monitoring services through Credit Bureau Singapore, to track if any data might be used inappropriately. The service monitors subscribers’ credit report and notifies them of various predetermined activities, including when enquires are made on their credit file and if default records have been updated. StarHub said it expected to take two weeks to notify all affected customers. It also noted that it “attempted” to have the data file removed from the dump site, but did not say if it succeeded in doing so.  StarHub CEO Nikhil Eapen said in the statement: “Data security and customer privacy are serious matters for StarHub, and I apologise for the concern this incident may be causing our affected customers. We will be transparent and will keep our customers updated. “We are actively reviewing current protection measures and controls in order to implement and accelerate long-term security improvements,” Eapen said. StarHub just yesterday announced its second quarter earnings, saying it clocked a 7.3% year-on-year climb in revenue to SG$486.7 million ($360.26 million). RELATED COVERAGE More

BLACK HAT USA: When a company becomes the victim of a cyberattack, executives are faced with a tsunami of challenges: containing a breach, remediation, informing customers and stakeholders, identifying those responsible, and conducting a forensic analysis of the incident — to name but a few.

Black Hat USA

However, it is not just the real-world issues faced, in the now, that businesses have to tackle: the legal ramifications of a security incident have become more important than ever to consider. Speaking to attendees at Black Hat USA in Las Vegas, Nick Merker, partner at Indianapolis-based legal firm Ice Miller LLP said that before becoming a lawyer, he worked as an information security professional — and this experience allowed him to transition into the legal field through a cybersecurity lens. After being involved in the legal side of over 500 security incidents, including everything from the theft of a laptop to major ransomware incidents, Merker said that many of the pitfalls he experienced could have been “easily avoided with a simple conversation.”When attorneys are brought into a cybersecurity incident, they need to consider areas including data protection standards (such as HIPAA or GDPR), insurance coverage, liability, the preservation of evidence, and the potential for lawsuits and class-action claims. Robust IT systems are no longer enough to protect against the financial and reputational harm of cyberattacks, and it is up to legal teams to assist victims in making the right decisions in the aftermath. According to Merker, during a cybersecurity incident, “IT professionals and security folks, people who are not lawyers, [often] find themselves in a weird solution where they need to think like a lawyer or at least have one there.”

One of the main issues that enterprise players need to consider is attorney-client privilege. The purpose of this is to make sure a client who wants to seek advice from an attorney can say what they want and retain confidentiality — and the attorney cannot be compelled to testify against them. However, there are misconceptions surrounding this concept — not everything you say is privileged. It might be privileged communication but that doesn’t mean the subject matter is privileged, such as the disclosure of facts surrounding a data breach or cyberattack. “This does not mean that the underlying factors of a security incident are privileged,” the lawyer said. “This is an important thing to think about.”If you want to retain privilege, then you need to “paper up” and make sure there are defined lines between investigations, reports, and forensic activity. Specifically, if you want investigations to be privileged, they should be done separately and apart from ordinary business investigations.A “100 percent, separate team should be in place” and any reports on an incident should be “only used for litigation preparedness rather than as a business-outcome report,” Merker commented. In addition, it should be noted that corporations can waive privilege, but they cannot necessarily cherry-pick which areas to waive. It may be an “all or nothing” approach in some jurisdictions, and rather than “having your cake and eating it too,” attempts to do so can create further legal challenges. An example given is a document submitted in court with redactions, whereas the full document, without redactions, was provided to regulators. It may be that this attempt to partly utilize privilege could fail. In addition, privileged information should stay within protected walls. The lawyer says that if information is shared, such as through an email or by the watercooler, this could result in deposition and could be considered a waiver of privilege. Another area of legal concern relates to OFAC’s recent warning on potential sanctions when ransomware payments are approved — especially if someone ends up paying as part of a criminal chain that lands in an area with economic restrictions, such as Iran or Cuba. This can create individual or corporate liability and prompt heavy penalties — or even jail time.If you’re in a ransomware event and you need to pay the ransom in order to get back online, Merker says you should have a risk-based compliance program; a robust structure and risk assessments for whether or not you will pay a threat actor, and you should engage law enforcement immediately. This could be a significant factor determining the eventual outcome, the legal expert noted. “[Also] getting in touch with us quickly is what you want to do,” Merker added. Merker emphasised that companies more often “need to actually use an incident response plan in an incident situation,” and said that documentation should be a key focus. Timelines, logs, major decisions, and status summaries should be kept as regulators — or plaintiffs – will be asking questions, and you need to know “what you did, and why you did it.””You need to build up a story of what you actually did as a company,” Merker says. “This will also protect the chain of custody [and] you want to make sure you don’t accidentally waive privilege.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

FireEye, one of the world’s largest security firms, reported a year over year revenue growth of 8% in Q2 as the company adjusts following the sale of a major part of its business.Earnings for the quarter came to .09 cents on revenue of $248 million, an increase of $2 million compared to the first quarter of 2021.Wall Street was expecting earnings of $0.09 per share on revenue of $249.07 million. The report sent FireEye shares down 10.75% in late trading.FireEye sold its FireEye Products business to a consortium led by Symphony Technology Group for $1.2 billion on June 2, dramatically changing the company’s outlook. The all-cash deal is expected to close at the end of the fourth quarter.FireEye said that the deal separates the company’s network, email, endpoint and cloud security products from Mandiant’s software and services. FireEye Products and Mandiant Solutions will continue to be one entity until the transaction closes. Symphony Technology Group and FireEye will maintain reselling and collaboration agreements.CEO Kevin Mandia said in June that the deal was made because FireEye wants to scale its software platforms. But they projected that its products and related subscriptions and support revenue would fall 10% to 11% in 2021 compared to 2020.”The Mandiant Solutions business continued to deliver strong growth in revenue and annualized recurring revenue for the second quarter ended June 30, 2021,” Mandia said.

The earnings report was split into two parts, one that included revenue from discontinued operations and one that did not. The revenue for the continuing operations this quarter was $114 million, with a non-GAAP operating margin of negative 26 percent. There would be a non-GAAP net loss per basic share of $0.14.For the third quarter of fiscal 2021, FireEye expects non-GAAP net income between $0.05 and $0.07. It gave a revenue outlook between $118 million and $122 million. In December, the company disclosed that it was the target of a massive international cyber espionage campaign. 

Tech Earnings More