When Colin Lobley worked as a general manager of HPE Security Services of EMEA, he could see the pain that companies were having in hiring and retaining talent in IT security, and it is for this reason, that after a stint at managed security services company DXC Technology, he was drawn to Cyber Security Challenge UK (CSC UK).
The Challenge is a series of national events designed to encourage talented professionals to join the UK IT security industry in the middle of what is deemed by many to be a cyber security skills crisis. The government backs the challenge, while private sector companies sponsor it.
“The reason I moved to the organisation is to address the cyber skills gap – we do that through the competitions and by raising awareness of the industry and of career paths in cyber, encouraging people to take part in the right education and career paths,” says Lobley, who joined CSC UK as CEO in January.
While Lobley says that the organisation tracks people through the competitions it hosts, and has been successful at getting people into cyber, the CSC UK has struggled to prove its performance over the years.
Back in 2014, professional services firm KPMG said it had scaled down its sponsorship of the challenge because of a lack of credible talent for the firm to recruit. At the time, Stephen Bonner, a partner in the information protection side of KPMG told Computing that one of the issues with the challenge is that it doesn’t reflect what a role in cyber security entails. He said a real role wouldn’t be about a time-limited challenge with no conferring, but would be about dealing with problems over a longer period of time.
But Lobley suggests that after being on the industry side himself, there are time-limited pressures every day, and adds that the challenges have included team-based tests for many years.
However, he admits that CSC UK has to get better at tracking its progress.
“We need to get a lot better at tracking those who we engage with; I don’t think we’ve been very good at tracking and engaging all those people we speak to. However, instinctively you can tell what we’re doing is working through anecdotal evidence. The social media outreach is positive and we know we’re having an impact – we just haven’t been good at tracking the data, we need to do more,” he says.
This is part of the reason Lobley has been hired; he believes his commercial background will stand in good stead as he understands how performance metrics can drive both the organisation and the people who are funding the organisation forward.
“I bring that element of commercial discipline to the organisation, whereas previous CEOs were ex-civil servants or military and I’m a new breed of CEO to the Challenge. We need to get a lot smarter about articulating the things we’re doing,” Lobley says.
This is important because as CSC UK is given a government grant, the organisation needs to be able demonstrate that it is helping to close the skills gap but also that it is building an organisation that is sustainable without the grant.
This is where both sponsors and clients come into the equation.
Companies decide to sponsor the Challenge for several reasons, according to Lobley. Mainly because they want to get traction to their own company through websites or links to the company, or because they want to be seen as supporting the idea of closing the skills gap – a PR exercise – or finally, some are in it purely for recruitment purposes.
“They want to have a chat with people about internships and the first steps of a career path,” Lobley explains.
On the client side, Lobley could not reveal exactly who the organisation counts as a client. However, one of the clients is government, for its Cyber Discovery programme which is still a pilot at the moment. It’s a government-funded programme to target 14 to 17 year-olds.
Other clients use CSC UK as a competition and event running business and supplier; helping to make the organisation meet its aim of becoming self-sufficient.
Time to make a change
As well as better tracking participants of CSC UK’s challenges and other programmes, Lobley plans to evolve the challenges themselves. He wants to incorporate non-technical career paths such as legal cyber security roles or risk management into the CSC UK’s awareness campaigns. He also wants to help change the perception that someone involved in cyber security is a hoody-wearing person that belongs in the basement.
In addition, he has loftier ambitions of ensuring that CSC UK is a one-stop shop for people interested in cyber to get all of the information they need.
“It could be about owning individual journeys – not every step along the way – but that’s where I want to take the Challenge,” he says.
Finally, Lobley wants to target some of the groups which are underrepresented – and he believes CSC UK has the agility to help these groups that others can’t.
“We did our first all girls summer camp, and we’ve got the agility to move into other areas and focused demographics. We want to stimulate the market,” he says.