What
Skills
Do
Cyber
Security
Professionals
Need?
Faheem
Ullah
1
,
Xiaohan
Ye
2
,
Uswa
Fatima
3
,
Zahid
Akhtar
4
,
Yuxi
Wu
2
,
and
Hussain
Ahmad
2
1
Zayed
University,
United
Arab
Emirates
2
The
University
of
Adelaide,
Australia
3
National
University
of
Science
and
Technology,
Pakistan
4
State
University
of
New
York
Polytechnic
Institute,
USA
Abstract
Purpose
-
The
increasing
number
of
cyber-attacks
has
elevated
the
importance
of
cy-
bersecurity
for
organizations.
This
has
also
increased
the
demand
for
professionals
with
the
necessary
skills
to
protect
these
organizations.
As
a
result,
many
individuals
are
looking
to
enter
the
field
of
cybersecurity.
However,
there
is
a
lack
of
clear
understanding
of
the
skills
required
for
a
successful
career
in
this
field.
In
this
paper,
we
identify
the
skills
required
for
cybersecurity
professionals.
We
also
determine
how
the
demand
for
cyber
skills
relates
to
various
cyber
roles
such
as
security
analyst
and
security
architect.
Furthermore,
we
identify
the
programming
languages
that
are
important
for
cybersecurity
professionals.
Design/Methodology
-
For
this
study,
we
have
collected
and
analyzed
data
from
12,161
job
ads
and
49,002
Stack
Overflow
posts.
By
examining
this,
we
identified
patterns
and
trends
related
to
skill
requirements,
role-specific
demands,
and
programming
languages
in
cybersecurity.
Findings
- Our results reveal that (i) communication skills and project management skills
are the most important soft skills, (ii) as compared to soft skills, the demand for technical skills
varies more across various cyber roles,
and (iii) Java is the most commonly used programming
language.
Originality
-
Our
findings
serve
as
a
guideline
for
individuals
aiming
to
get
into
the
field
of cybersecurity.
Moreover,
our findings are useful in terms of informing educational institutes
to
teach
the
correct
set
of
skills
to
students
doing
degrees
in
cybersecurity.
Keywords:
Cybersecurity;
Security
Workforce;
Data
Analysis;
Stack
Overflow;
SoC;
Inci-
dent
Response;
Threat
Detection;
Risk
Management
1
Introduction
1.1
Background
and
Motivation
The
cybersecurity
landscape
is
evolving
rapidly,
driven
by
the
growing
sophistication
of
cyber
threats
and
the
continuous
advancement
of
technology.
This
dynamic
environment
demands
that
cybersecurity
professionals
adapt
and
expand
their
skills
to
address
increasingly
complex
chal-
lenges.
Central to this evolution are modern software paradigms such as microservice architectures
[28,
2,
5,
6],
Large
Language
Models
(LLMs)
[9,
23],
and
Large
Concept
Models
(LCMs)
[4],
the
cybersecurity
landscape
has
entered
a
new
era
of
both
opportunity
and
challenge.
As
technology
continues
to
advance
and
the
threat
of
cybercrime
grows
more
sophisticated
[20,
18,
17],
organi-
zations
are
in
greater
need
of
a
highly
skilled
workforce
to
help
defend
against
these
threats
[16].
Cybercrime
is
estimated
to
cost
around
$
9.22
trillion
in
2024
and
is
expected
to
escalate
to
$
17.9
trillion
by
2030,
nearly
doubling
during
this
period
[24].
Despite
this,
there
remains
a
significant
shortage
of
skilled
cybersecurity
professionals,
a
trend
that
is
expected
to
persist
in
the
coming
years.
Samantha
cites
the
current
cybersecurity
talent
crunch
as
a
lack
of
adequate
cyber
skills
understanding
[39,
26].
In
its
2022
Cybersecurity
Workforce
Study,
((ISC)
²
)
proposes
that
the
global
cybersecurity
workforce
will
grow
by
11.1%
in
2022
compared
to
2019
[25].
The
survey
re-
vealed
that
nearly
70%
of
security
professionals
in
multiple
areas
do
not
believe
their
organization
has
enough
staff
to
be
effective
[25].
While
the
global
shortage
of
cybersecurity
professionals
is
increasing,
so
is
the
threat
and
sophistication
of
cybercrime
[35].
From
2020
to
2025,
Cybersecurity
Ventures
predicts
that
global
1
arXiv:2502.13658v2 [cs.CR] 20 Feb 2025
losses
caused
by
cybercrime
will
grow
at
an
annual
rate
of
15%
resulting
in
$
10.5
trillion
losses
by
2025
[34].
With
cybercrime
on
the
rise,
businesses,
and
governments
need
a
skilled
cybersecurity
workforce
to
build
cyberspace
protection
[22].
With
this
in
mind,
it
is
essential
that
individuals
looking
to
enter
the
field
of
cybersecurity
understand
the
skills
and
competencies
that
are
in
demand.
Knowing
which
cybersecurity
skills
are
in
high
demand
is
important
for
a
number
of
reasons.
Firstly,
it
helps
individuals
who
are
looking
to
enter
the
field
of
cybersecurity
to
focus
their
efforts
and
resources
on
the
most
in-demand
skills
[31].
Secondly,
it
helps
educational
institutes
to
better
align
their
curriculum
with
the
needs
of
the
industry.
By
offering
courses
that
focus
on
the
most
in-demand
skills,
they
can
help
their
students
to
better
prepare
for
the
job
market
[42].
Thirdly,
for
businesses
and
organizations,
knowing
which
skills
are
in
high
demand
can
help
them
to
find
the right talent for their cybersecurity needs [13].
Finally, knowing which skills are in high demand
can
also
help
governments
to
develop
policies
and
programs
that
better
support
the
growth
and
development
of
the
cybersecurity
workforce
[11].
While
it
is
important
to
identify
the
skills
required
for
cybersecurity
professionals,
developing
a
comprehensive
list
of
the
skills
required
for
cybersecurity
professionals
is
difficult
for
several
reasons.
First,
the
field
of
cybersecurity
is
constantly
evolving
[15].
With
the
advancement
of
technology
and
the
emergence
of
new
threats
[3],
the
skills
required
for
cybersecurity
professionals
are
continually
changing.
Second,
different
organizations
have
different
requirements
for
cyberse-
curity
professionals
[36,
38].
For
example,
a
large
financial
institution
may
require
more
expertise
in network security, while a small startup may focus more on data privacy and protection.
Thirdly,
the
cybersecurity
field
is
not
well
regulated,
which
means
there
are
no
standardized
training
pro-
grams
or
certifications
that
guarantee
a
certain
level
of
proficiency
[41].
This
further
complicates
the
task
of
developing
a
comprehensive
list
of
skills
required
for
cybersecurity
professionals.
Given
the
need
to
understand
key
cyber
skills,
we
answer
multiple
Research
Questions
(RQ)
in
this
paper
to
identify
the
key
cyber
skills,
the
relation
of
those
skills
with
various
cyber
roles,
and
the
associated
programming
languages.
Our
study
is
based
on
the
collection
and
analysis
of
12,161
job
ads
and
49,002
Stack
Overflow
posts.
These
job
ads
were
collected
from
various
job
portals
that
cover
the
global
cybersecurity
market.
1.2
Research
Questions
In
this
study,
we
conducted
a
large-scale
study
of
Stack
Overflow
and
job
advertisements
to
un-
derstand
skills
that
security
professionals
need
to
learn
and
practice
by
answering
the
following
research
questions.
RQ1:
What
skills
do
security
professionals
need?
Answering
this
question
will
help
individuals
and
organizations
to
build
a
strong
and
effective
cybersecurity
workforce
to
protect
against
the
growing
threat
of
cybercrime.
Understanding
the
expertise
needed
also
guides
educa-
tional
institutes
in
teaching
the
right
skills
to
future
cybersecurity
professionals.
RQ2:
Whether
the
demand
for
skills
vary
across
different
cybersecurity
roles?
The
cybersecurity
industry
has
different
roles
such
as
security
analyst,
security
architect,
and
consultant,
etc.
Some
roles
are
more
technical
compared
to
others.
We
explore
the
relationship
between
the
required
skills
and
cyber
roles.
RQ3:
What
programming
languages
do
security
professionals
need
to
use?
Several
cyber roles require a thorough understanding and practice of programming languages in their daily
jobs.
Understanding the programming languages in demand can help security professionals in skill
development
and
career
advancement
within
the
cybersecurity
field.
1.3
Contributions
To
summarize,
we
make
the
following
contributions
in
this
paper:
•
We
have
performed
a
thorough
analysis
of
12,161
cybersecurity
job
ads
and
49,002
security-
related
posts
on
Stack
Overflow.
•
We
have
identified
6
soft
skills,
20
hard
skills,
and
13
professional
certifications
that
are
important
for
cybersecurity
professionals.
•
We
have
identified
7
programming
languages,
along
with
their
respective
importance,
for
cybersecurity
professionals.
2
•
Finally,
we
have
studied
the
relationship
between
various
skills
and
cybersecurity
roles
to
determine
whether
or
not
various
cyber
roles
require
specific
skills.
The
structure
of
this
paper
is
as
follows:
Section
2
positions
the
novelty
of
our
work
with
respect
to
the
related
works.
Section
3
describes
the
research
methodology
followed
to
collect
and
analyze
data
from
job
ads
and
Stack
Overflow
to
answer
the
RQs.
Section
4
presents
our
findings
with respect to the three RQs.
Section 5 reports the implications and threats to the validity of our
findings.
Finally,
Section
6
concludes
the
paper.
2
Related
Work
Several
studies
have
been
conducted
on
the
identification
of
skills
that
are
critical
for
various
domains
such
as
cybersecurity
(e.g.,
[7,
14,
30,
36,
38,
40,
10,
8,
29,
37,
27]),
software
engineering
(e.g., [32, 12, 33, 19, 21]), and signal processing [1].
In the context of cybersecurity, Ben-Asher and
Gonzalez
[7]
analyzed
data
collected
from
a
case
study
with
55
participants
in
the
US
to
examine
how
individuals
with
and
without
security
knowledge
detect
malicious
events.
Unlike
this
study,
our
study
is
based
on
global
data
collected
from
job
ads
and
Stack
Overflow.
Also,
our
research
questions are different.
In [14], the authors conducted a review of the literature to identify the gaps
in
cybersecurity
expertise.
Then,
this
paper
emphasizes
the
contribution
of
social
fit
in
a
highly
complex
and
heterogeneous
cyber
workforce.
Although
this
paper’s
aim
is
similar
to
our
first
RQ,
our
work
differs
from
it
in
terms
of
the
data
source,
two
RQs,
and
the
findings.
Parker
and
Brown
et
al.,
[36]
analyzed
data
from
196
job
ads
in
South
Africa
to
determine
the
skills
required
for
cybersecurity
professionals.
In
[37],
the
authors
collected
data
from
500
job
ads
to
identify
critical
cyber
skills.
Similar
to
our
study,
[36]
and
[37]
collected
data
from
job
ads.
However,
these
papers
collected
data
only
from
150
-
500
job
ads
in
one
country.
In
comparison,
we
have
collected
data
from
12,
161
jobs
from
around
the
world
and
49,
002
Stack
Overflow
posts.
Potter
and
Vickers
et
al.
[38]
collected
data
from
interviews
with
security
professionals
to
identify the skill critical for security professionals in the Australian market.
This study differs from
ours in terms of the RQs and data analyzed.
In [40], the authors focussed on skills important for one
particular cyber role - information security analyst.
This study was conducted based on a literature
review in the Malaysian context.
Our study is not limited to one particular cyber role.
Chowdhury
and Gkioulos [10] carried out a literature review of existing studies to identify the skills that security
professionals
need
to
secure
critical
infrastructures.
Unlike
our
study
which
identifies
cyber
skills
for
general
cybersecurity,
Chowdhury
and
Gkioulos
[10]
only
focused
on
the
skills
required
for
one
domain
i.e.,
critical
infrastructures.
Caulkins
et
al.
[8]
conducted
a
survey
with
government
cybersecurity professionals to identify the soft skills required for cybersecurity professionals.
Unlike
[8], our study focuses not only on soft skills but also hard skills and certifications.
Jerman et al, [29]
conducted interviews with students, teachers, and parents to understand what cybersecurity topics
should
be
taught
to
the
students
and
how
best
they
can
be
taught.
Jones
et
al.,
[30]
conducted
44
interviews
with
cybersecurity
professionals
to
identify
cyber
topics
that
students
should
learn
in
school.
Unlike
[30]
and
[29]
which
focus
on
cyber
topics,
our
study
focuses
on
cyber
skills.
In
summary,
our
work
differs
from
the
existing
works
in
terms
of
RQs,
data
source,
and
findings.
3
Methodology
The
methodology
used
for
conducting
this
study
is
illustrated
in
Figure
1.
As
shown,
data
was
collected
from
Stack
Overflow
and
Job
Ads.
Figure
1:
Research
methodology
used
for
conducting
this
study
3
3.1
Stack
Overflow
Stack
Overflow
1
is
a
highly
regarded
platform
for
those
in
the
computing
industry,
providing
a
space for academic exchange and solutions to daily problems faced by programmers.
The platform
is
widely
used
by
developers
and
security
professionals
as
a
means
of
learning
and
understanding
complex expertise.
To understand recent developments and trends in cybersecurity skills, the query
function
in
Stack
Overflow’s
Stack
Exchange
Data
Explorer
was
(SEDE)
2
utilized
by
writing
SQL
code.
Our
data
collection
period
for
security
skills
spanned
the
past
five
years,
starting
on
June
22
and
ending
on
July
27,
2022.
Data
Collection
and
Pre-processing:
The
metadata
for
this
study
was
collected
from
various
sources,
including
web
searches,
CyberSeek
3
,
and
relevant
literature
[7,
14,
30,
36,
38,
40,
10,
8,
29,
37].
A
comprehensive
set
of
search
terms
was
compiled,
which
are
listed
in
Figure
2.
We
used
these
search
terms
to
collect
data
from
Stack
Overflow.
Data
Pre-processing:
After
the
data
was
collected,
data
pre-processing
was
performed
by
retaining
only
the
‘search
terms’
and
‘score’
portions
of
the
data
to
ensure
the
accuracy
and
efficiency
of
data
analysis.
This
was
done
using
a
Python
script
in
Jupyter
Notebook,
with
the
help
of
the
NLTK
4
library,
which
was
used
to
remove
stop
words
and
distinguish
different
tags.
Data
Analysis
and
Visualization:
We
utilized
open-source
exploratory
data
analysis
tools
from
GitHub
to
analyze
the
data
obtained
from
Stack
Overflow repositories.
To make the results more understandable, the data was manually integrated
and
visualized
using
Excel.
Figure
2:
Terms
used
for
searching
Stack
Overflow
posts.
Figure
3:
Search
terms
for
cyber
roles
and
certifications
3.2
Job
Ads
To
determine
how
cybersecurity-related
skills
and
tools
are
used
in
practice,
we
collected
and
analyzed data based on job advertisements from job portals,
including Dice
5
,
SA Job Search
6
,
and
Seek
7
.
Keyword-based
data
acquisition.
Jupyter
Notebook
and
a
Python
script
were
utilized
to
perform
the
initial
filtering
of
job
advertisements
based
on
relevant
keywords
and
positions.
The
keywords and positions used for the filtering process were sourced from CyberSeek.
These keywords
are
presented
in
Figure
3.
The
script
then
extracted
the
job
title,
recruitment
link,
recruiter,
and
job
description
of
each
filtered
advertisement.
The
critical
information
was
then
organized
into
a
CSV
file.
This
data
was
collected
from
June
29
to
July
10,
2022,
resulting
in
a
total
of
12,161
job
advertisement
data
points.
The
results
are
presented
in
Table
I.
Data
pre-processing
To streamline the data analysis process and improve its efficiency, it was
necessary
to
clean
up
the
data
and
eliminate
any
redundant
information.
The
data
pre-processing
1
https://stackoverflow.com/
2
https://data.stackexchange.com/stackoverflow/query/new
3
https://www.cyberseek.org/index.html
4
https://www.nltk.org/
5
https://www.dice.com/
6
https://jobsearch.gov.au/
7
https://www.seek.com.au/
4
Table
I:
The
number
of
job
ads
collected
from
different
sources
and
the
number
of
posts
collected
from
Stack
Overflow.
Data
Source
Number
of
Job
Ads/posts
Seek
4643
DICE
3700
Jora
1552
SA
Job
Search
2266
Total
Job
Ads
12161
Total
Stack
Overflow
Posts
49002
process involved using a Python script that utilizes the NLTK library to retain the job descriptions,
eliminate
stop
words
and
remove
any
punctuation.
The
cleaned
data
was
then
analyzed
using
the
advertools
8
library
to
calculate
keyword
frequency
and
produce
a
new,
organized
CSV
file.
To
further
simplify
the
data,
we
utilized
the
advertools
library
to
rank
the
keywords
by
frequency,
with
a
minimum
phrase
length
of
2.
Some
non-technical
terms
were
still
present
in
the
analyzed
keywords,
so
we
organized
the
technical
terms
into
Excel
to
merge
and
sort
the
data
from
the
three
recruitment
websites
by
position,
and
visualized
the
results.
The
formula
for
calculating
the
keyword
frequency
is
shown
in
Equation
1,
where
k
i
(i
=
1,
2,
3,
4)
represents
the
corresponding
number
of
keywords
for
different
recruitment
websites.
KeywordFrequency
=
n
X
i
=1
k
i
(1)
Manual
classification
To
ensure
a
thorough
analysis
of
the
technical
terms,
the
relevant
keywords
were
organized
into
an
Excel
spreadsheet.
This
allowed
us
to
integrate
and
sort
the
data
from
the
three
recruitment
websites
by
position
and
visually
represent
the
findings.
As
the
study
utilized
two
data
sources,
only
the
data
from
Stack
Overflow
allowed
to
freely
choose
the
time
frame.
On
the
other
hand,
job
advertisement
data
was
updated
on
an
annual
basis
and
any
job
postings
that
successfully
recruited
the
required
personnel
would
be
deleted.
The
choice
to
collect
data
from
Stack
Overflow
over
a
five-year
period
was
made
to
strike
a
balance
between
the
relevance
and
persuasiveness
of
the
data.
If
the
time
frame
was
too
long,
the
risk
of
including
irrelevant
or
outdated
information
increased.
Conversely,
if
the
time
frame
was
too
short,
the
data
would
only
reflect
the
current
skill
needs
of
the
cybersecurity
industry
and
lack
long-term
perspectives.
The
process
is
illustrated
in
Figure
1.
4
Results
In
this
section,
we
report
our
findings
with
respect
to
the
three
research
questions
presented
in
Section
1.
4.1
RQ1:
Security
skills
required
We
analyzed
the
identified
skills
from
three
different
perspectives
-
soft
skills,
hard
skills,
and
professional certifications.
skill is considered as a soft skill if it is hard to quantify and is important
for
working
effectively
with
others.
On
the
other
hand,
skill
is
considered
as
a
hard
skill
if
it
is
easy
to
quantify
and
is
crucial
for
executing
technical
tasks.
Professional
certifications
are
often
a
requirement
for
a
job
as
is
mentioned
in
the
job
ad.
These
certifications
are
issued
by
well-known
entities
such
as
CISCO.
Table
II
presents
the
most
crucial
soft
skills
for
cybersecurity
professionals.
According
to
our
results,
communication
and
project
management
are
the
two
most
important
soft
skills
for
security professionals.
Strong communication skills are critical for multiple reasons.
First, security
professionals
often
work
in
teams
to
tackle
complex
security
threats.
Second,
clear
and
concise
communication
skills
help
security
professionals
to
coordinate
an
effective
response
and
minimize
damage
in
case
of
an
attack.
Third,
security
professionals
need
to
communicate
with
a
wide
range
of stakeholders including executives, IT teams, and end-users.
Similarly, project management skills
are
crucial
for
security
professionals
because
they
help
to
effectively
plan,
manage,
and
execute
complex security projects.
Project management skill also helps to effectively adapt to the changing
cyberspace
and
adjust
project
plans
as
needed.
8
https://github.com/eliasdabbas/advertools
5
Table
II:
Identified
soft
skills
for
cybersecurity
professionals.
The
numbers
in
the
table
denote
the
number
of
job
ads/posts
mentioning
the
particular
skill.
Rank
Skill
Dice
SA
Job
Search
Seek
Stack
Overflow
Total
1
Communication
862
20
157
39
1040
2
Project
management
448
7
38
0
493
3
Access
management
399
2
52
39
492
4
Vulnerability
management
336
3
99
2
440
5
Problem
solving
204
13
28
0
245
Table III presents the identified hard skills for cybersecurity professionals.
Information security
and
information
technology
are
identified
as
the
most
important
hard
skills.
Information
security
mostly encapsulates skills required for ensuring the confidentiality, integrity, and availability of the
data.
Information
technology
is
a
generic
skill
that
expects
security
professionals
to
have
a
good
understanding
of
the
technological
landscape
of
their
respective
organizations.
Interestingly,
our
results
did
not
reveal
cryptography
as
one
of
the
key
hard
skills,
unlike
those
mentioned
in
cyber
forums
such
as
CyberGeek
9
.
Table
III:
Identified
hard
skills
for
cybersecurity
professionals.
’Nums’
denote
the
number
of
job
ads/posts
mentioning
the
particular
skill.
Rank
Skill
Dice
SA
Job
Search
Seek
Stack
Overflow
Total
1
Information
security
683
13
270
29
995
2
Information
technology
516
5
89
5
615
3
Security
clearance
481
8
72
2
563
4
Network
security
284
8
73
148
513
5
Incident
response
362
9
100
1
472
6
Information
systems
418
3
37
1
459
7
Security
operations
267
8
146
2
423
8
Security
controls
268
2
113
20
403
9
Application
security
180
3
44
138
365
10
Security
services
213
7
102
36
358
11
Cloud
security
241
3
57
46
347
12
Software
development
272
10
18
9
309
13
Security
architecture
212
3
48
29
292
14
Service
delivery
89
1
36
1
127
15
Enterprise
architecture
56
1
10
1
68
16
Internal
audit
37
0
6
1
44
17
Data
architecture
32
0
0
0
32
18
Digital
technology
10
0
0
4
14
19
Risk
compliance
3
0
0
0
3
20
Audit
risk
1
0
0
0
1
Table
IV
shows
the
most
in-demand
certifications
for
security
professionals.
We
found
that
CISSP
10
and CISM
11
are the most mentioned certifications in the job ads.
CISSP costs around
$
749
and
CISM
costs
around
$
760.
We
also
found
that
50.2%
job
ads
expect
some
kind
of
professional
certifications
from
the
job
seeker.
Table IV: Identified certifications for cybersecurity professionals.
’Nums’ denote the number of job
ads
mentioning
the
particular
certification
Rank
Dice
Nums
SA
Job
Search
Num
Seek
Num
Certification
Total
1
CISSP
907
CISSP
13
CISSP
270
CISSP
995
2
CISA
304
ITIL
10
CISM
146
CISM
615
3
CISM
292
CISM
9
ITIL
113
CISA
563
4
CEH
279
GIAC
8
CISA
102
CEH
513
5
CompTIA
219
OSCP
8
CEH
100
CompTIA
472
6
ITIL
175
CompTIA
8
OSCP
89
ITIL
459
7
GIAC
165
CEH
7
GIAC
73
GIAC
423
8
GCIH
124
CISA
5
CompTIA
72
GCIH
403
9
CASP+
103
CIPP
3
GSEC
57
OSCP
365
10
OSCP
94
GSEC
3
SSCP
48
GSEC
358
11
GSEC
86
SSCP
3
GCIH
44
CASP+
347
12
SSCP
64
CASP+
3
CASP+
37
SSCP
309
13
CIPP
13
GCIH
2
CIPP
36
CIPP
292
In
order
to
provide
a
clear
understanding
of
what
the
industry
professionals
understand
by
these
hard
skills,
a
detailed
dictionary
has
been
provided
in
Table
V.
This
information
has
been
9
https://www.cyberseek.org/certifications.html
10
https://www.isc2.org/Certifications/CISSP
11
https://www.isaca.org/credentialing/cism
6
sourced
from
NIST
(National
Institute
of
Standards
and
Technology),
SANS
(SysAdmin,
Audit,
Network, Security), and ISO/IEC standards.
Providing a dictionary for what these skills entail will
be
useful
for
individuals
looking
to
enter
the
field
of
cybersecurity
or
for
educational
institutions
seeking
to
teach
the
necessary
skills
to
their
students.
Key
insights
for
RQ1:
Combining
the
data
in
Stack
Overflow
and
job
advertisements,
communication
skills
and
project
management
are
the
skills
that
are
in
high
demand
in
soft
skills;
information
security,
information technology and
security clearance are in
high demand in
hard/technical
skills.
Regarding
professional
certifications,
CISSP,
CISA
and
CISM
are
in
high
demand.
Table
V:
Hard
Skills
in
Cybersecurity:
A
Dictionary
Skill
Definition
Key
Components
Common
Tools
Primary
Source
Information
Security
Protection
of
information
using
a
risk
management
approach
to
maintain
Confidentiality,
Integrity,
and
Availability.
Risk
Assessment,
Security
Controls
Implementation,
Security
Policy
Develop-
ment,
Security
Awareness
Training.
SIEM
Tools,
DLP
Solutions,
Encryption
Tools
NIST
SP
800-12
Information
Technology
Governance
of
IT
systems
for
efficient
use
of
information
and
technology
Infrastructure
Management,
Systems
Administration,
Network
Management,
Technical
Support.
System
monitoring
tools,
Service
desk
software,
Net-
work
management
systems.
ISO/IEC
38500
Security
Clearance
Authorization
to
classified
information
or
restricted
areas
based
on
background
checks.
Background
Investigation,
Continuous
Monitoring,
Access
Level
Management.
Personnel
Security
Systems,
Security
Management
Plat-
forms.
NIST
SP
800-181
Network
Security
Protection
of
network
infrastructure
and
data
transmitted
through
networks.
Perimeter
Defense,
Network
Monitoring,
Access
Control,
Intrusion
Detection.
Firewalls,
IDS/IPS
Sys-
tems,
VPNs
ISO/IEC
27033
Incident
Response
Organized
approach
to
addressing
and
managing
security
breaches
or
cyberattacks.
Incident
Response
Lifecycle
EDR
platforms,
SOAR
tools,
Digital
Forensics
Tools.
NIST
SP
800-61
Information
Systems
Integrated
set
of
components
for
collecting,
storing,
processing,
and
providing
information.
Systems
Analysis,
Database
Management,
Software
Inte-
gration.
ERP
Systems,
Database
Management
Systems.
ISO/IEC
25010
Security
Operations
Day-to-day
activities
to
monitor,
detect,
and
respond
to
security
events.
Security
Monitoring,
Alert
Management,
Threat
Hunt-
ing.
SIEM
Tools,
Threat
Intelli-
gence
Platforms
SANS
SOC
Guidelines
Security
Controls
Safeguards
or
countermeasures
to
avoid,
detect,
counteract,
or
minimize
security
risks.
Technical
Controls,
Admin-
istrative
Controls.
Access
Control
Systems,
Firewalls.
NIST
SP
800-53
Application
Security
Measures
taken
to
improve
security
of
applications
by
finding,
fixing,
and
preventing
vulnerabilities.
Secure
SDLC,
Vulnerability
Assessment,
Security
Test-
ing.
SAST/DAST
Tools,
WAF,
Code
Analysis
Tools.
SANS
AppSec
Security
Services
Organizational
and
technical
services
that
implement
and
operate
security
controls.
Security
Consulting,
Man-
aged
Security,
Security
As-
sessment.
GRC
Platforms,
Assessment
Tools.
ISO/IEC
27001
Cloud
Security
Protection
of
data,
applications,
and
infrastructure
associated
with
cloud
computing.
Cloud
Configuration,
Iden-
tity
Management,
Data
Pro-
tection.
CASB,
Cloud
Security
Tools.
NIST
SP
800-144
Software
Development
Designing,
programming
and
maintaining
software
Software
Implementation.
Version
Control
Systems,
CI/CD
Tools.
ISO/IEC
12207
Security
Architecture
Design
of
an
organization’s
security
infrastructure
and
policies.
Security
Framework
Design,
Risk
Assessment,
Control
Selection.
Architecture
Tools,
Security
Design
Tools.
NIST
SP
800-160
Service
Delivery
Management
and
delivery
of
IT
services
to
meet
business
requirements.
Service
Level
Management,
Capacity
Management,
Availability
Management.
Service
Desk
Software,
ITSM
Platforms.
ISO/IEC
20000
Enterprise
Architecture
Strategic
approach
to
linking
business
structure
and
processes
with
IT
infrastructure.
Business
Architecture,
Information
Architecture,
Technology
Architecture.
EA
Modeling
Tools,
Process
Mapping
Tools.
NIST
EA
Framework
Internal
Audit
Independent
evaluation
of
organization’s
operations,
controls,
and
compliance.
Risk
Assessment,
Control
Testing,
Compliance
Re-
view.
Audit
Management
Soft-
ware,
Data
Analytics
Tools.
ISO
19011
Data
Architecture
Designing
systems
for
collecting,
storing,
and
delivering
data.
Data
Modeling,
Database
Design,
Data
Governance.
Data
Modeling
Tools,
Database
Systems.
NIST
SP
800-122
Digital
Technology
Using
electronic
tools
to
process
and
store
data.
Digital
Infrastructure,
Digi-
tal
Platforms,
Digital
Solu-
tions.
Digital
Platform
Tools,
Dig-
ital
Analytics
Tools.
ISO/IEC
2382
Risk
Compliance
Adherence
to
laws,
standards,
policies
and
procedures
Compliance
Monitoring,
Risk
Assessment,
Control
Implementation.
GRC
Platforms,
Risk
As-
sessment
Tools.
NIST
RMF
Audit
Risk
Auditing
for
errors
or
irregularities
Inherent
Risk,
Control
Risk,
Detection
Risk.
Audit
Software,
Risk
Anal-
ysis
Tools.
ISO
19011
7
4.2
RQ2:
Skills
and
type
of
security
positions
Table
VI,
Table
VII,
and
Table
VIII
respectively
show
the
top
soft
skills,
hard
skills,
and
certifi-
cations
with
respect
to
various
cybersecurity
roles.
In
these
tables,
%
specifies
the
percentage
of
job
ads
for
a
specific
role
that
requires
the
respective
skill.
For
example,
140/182
(77%)
job
ads
for
a
tester
role
mention
communication
as
an
important
skill.
We
can
observe
that
the
required
skills vary
across
roles.
For
instance,
project management
is considered an important skill
for con-
sultants
but
not
for
testers.
Communication
is
considered
an
important
skill
for
almost
all
cyber
roles.
Table
VI:
Identified
soft
skills
for
various
cybersecurity
roles
(job
ads
data)
Soft
Skills
Analyst
Architect
Auditor
Consultant
Engineer
Manager
Tester
Specialist
Communication
skills
321(68%)
123(64%)
394(42%)
419(61%)
382(16%)
322(49%)
140(77%)
230(42%)
Problem-solving
skills
71(15%)
0
0
0
0
0
0
0
Project
management
0
0
107(2%)
93(13%)
149(28%)
128(19%)
0
89(6%)
Management
skills
0
0
89(10%)
0
0
0
0
0
Vulnerability
management
0
0
0
0
0
0
42(23%)
63(12%)
The
same
is
true
for
hard
skills,
where
a
particular
skill
might
be
considered
important
for
one
role but not for another.
As an example, enterprise architecture is an important skill for architects
but not so much important for an analyst.
Information Security emerges as the most essential skill
across multiple roles including for security analysts, consultants , engineers , managers , testers and
specialists.
This
is
because
foundational
knowledge
of
information
security
is
essential
to
protect
systems,
advise
people
on
secure
practices,
develop
robust
infrastructures,
manage
organizational
security strategies, and identify vulnerabilities.
Security Architecture is the the most essential skill
for
architects
since
their
job
revolves
around
designing
secure
systems
that
are
both
scalable
and
resilient.
Digital
Technology
is
most
important
for
auditors.
This
is
in
line
with
their
focus
on
evaluating
digital
systems,
ensuring
compliance
with
standards,
and
identifying
gaps
in
an
organi-
zation’s
digital
framework.
Knowledge
of
security
operations
plays
an
important
role
for
security
engineers,
testers,
and
specialists,
highlighting
the
importance
of
implementing
and
maintaining
effective
security
measures
within
systems.
Knowledge
of
internal
audit
procedures
is
mostly
re-
quired
for
auditors
helping
them
assess
internal
processes
and
controls
to
ensure
everything
stays
secure.
Table
VII:
Identified
hard
skills
for
various
cybersecurity
roles
(job
ads
data)
Technical
Skills
Analyst
Architect
Auditor
Consultant
Engineer
Manager
Tester
Specialist
Information
security
458(42%)
204(26%)
217(18%)
551(39%)
480(31%)
549(44%)
553(31%)
346(42%)
Information
technology
123(11%)
0
255(22%)
0
185(12%)
165(13%)
0
106(13%)
Incident
response
115(10%)
0
0
0
143(9%)
88(7%)
290(17%)
89(11%)
Information
systems
0
0
109(9%)
0
0
0
0
0
Cloud
security
0
48(6%)
0
0
0
0
0
0
Security
operations
80(7%)
0
0
140(10%)
162(10%)
131(10%)
187(11%)
145(17%)
Application
security
0
0
0
0
0
0
163(19%)
0
Security
controls
122(11%)
40(5%)
0
96(17%)
146(9%)
0
143(9%)
64(8%)
Security
architecture
119(11%)
171(22%)
0
0
0
0
0
0
Network
security
89(8%)
46(6%)
0
0
172(11%)
0
0
0
Enterprise
architecture
0
174(23%)
0
0
0
0
0
0
Software
development
0
51(7%)
0
0
0
0
0
0
Digital
technology
0
40(5%)
0
0
0
0
0
0
Internal
audit
0
0
423(36%)
0
0
0
0
0
Risk
compliance
0
0
89(8%)
0
0
91(7%)
0
0
Audit
risk
0
0
83(7%)
0
0
0
0
0
Data
architecture
0
0
0
196(14%)
0
0
0
0
Teaching
programs
0
0
0
196(14%)
0
0
0
0
Security
service
0
0
0
118(8%)
0
107(9%)
0
79(8%)
Diversity
inclusion
0
0
0
98(7%)
0
0
0
0
Security
clearance
0
0
0
0
109(7%)
0
0
0
Service
delivery
0
0
0
0
0
126(10%)
0
0
Penetration
testing
0
0
0
0
0
0
220(13%)
0
Technical
security
0
0
0
0
0
0
120(7%)
0
Security
testing
0
0
0
0
0
0
80(5%)
0
Security
systems
0
0
0
0
175(11%)
0
0
0
With
respect
to
certifications,
we
found
that
certifications
are
also
common
among
various
roles.
This means that the majority of these certifications, especially CISSP, CISA, and CISM, are
generic
and
helpful
for
acquiring
various
several
roles.
Key
insights
for
RQ2:
The
required
skills
vary
across
various
cybersecurity
roles.
Except
for
communication
skills,
no
other
skill
is
pervasively
applicable
to
all
roles.
4.3
RQ3:
Programming
languages
required
We answer this question based on the data collected from Stack Overflow data.
As shown in Figure
4,
we
found
that
programming
languages,
including
C,
C++,
C#,
HTML,
Java,
JavaScript,
PHP,
and Python, are essential skills for security professionals.
Java is the most mentioned programming
8
Table
VIII:
Identified
certifications
for
various
cybersecurity
roles
(job
ads
data)
Certification
Analyst
Architect
Auditor
Consultant
Engineer
Manager
Tester
Specialist
CISSP
87(26%)
39(31%)
32(17%)
109(30%)
147(30%)
91(24%)
136(25%)
68(26%)
CISA
21(6%)
8(6%)
55(30%)
45(12%)
43(9%)
52(14%)
48(9%)
39(15%)
CISM
34(10%)
18(15%)
38(21%)
70(19%)
54(11%)
78(21%)
86(15%)
52(20%)
GIAC
24(7%)
11(9%)
0
23(6%)
31(6%)
20(5%)
33(6%)
13(5%)
CompTIA
42(13%)
6(5%)
2(1%)
6(2%)
21(4%)
13(3%)
28(5%)
9(3%)
ITIL
22(7%)
16(13%)
46(25%)
61(17%)
63(13%)
74(20%)
55(10%)
45(17%)
CEH
38(12%)
8(6%)
9(5%)
19(5%)
57(11%)
21(6%)
42(8%)
20(7%)
GCIH
12(4%)
3(2%)
0
4(1%)
13(2%)
2(1%)
8(1%)
4(1%)
CASP+
2(1%)
1(1%)
0
0
5(1%)
0
2(0%)
2(1%)
OSCP
13(4%)
7(6%)
1(1%)
11(3%)
29(6%)
8(2%)
81(15%)
9(3%)
GSEC
17(5%)
6(5%)
0
10(3%)
18(4%)
7(2%)
24(4%)
2(1%)
SSCP
16(5%)
1(1%)
1(1%)
4(1%)
13(3%)
5(1%)
11(2%)
2(1%)
CIPP
1(0%)
0
0
2(1%)
2(0%)
2(1%)
1(0%)
1(0%)
language.
Since
each
question
from
Stack
Overflow
contains
multiple
tags,
a
tag
may
appear
in
different
questions.
Therefore,
we
calculate
the
average
score
of
each
tag.
As
shown
in
Figure
5,
the
average
score
of
Java
is
the
highest.
Java
is
popular
in
the
cybersecurity
community
due
to
its
cross-platform
compatibility,
large
community
support,
and
robust
libraries.
In
contrast,
it
intuitively shows which programming languages have higher scores and are more suitable for use in
the
cybersecurity
industry.
For
example,
the
highest
number
of
questions
in
security-related
posts
on
Stack
Overflow
were
about
Java.
Hence,
Java
has
a
higher
score
as
shown
in
Figure
5.
C++,
on
the
other
hand,
has
less
number
of
questions
and
consequently
scored
significantly
lower.
Key
insights
for
RQ3:
Security
professionals
need
several
programming
languages.
However,
Java
is
the
most
commonly
used
programming
language
in
cyber
projects.
Figure
4:
Number
of
cybersecurity
posts
for
programming
languages
on
Stack
Overflow
5
Discussion
In
this
section,
we
compare
the
findings
from
job
ads
and
Stack
Overflow.
We
also
discuss
the
implications
of
our
findings
and
the
threats
to
the
validity
of
our
findings.
5.1
Comparing
cyber
skills
in
Job
Ads
and
Stack
Overflow
We compared the skills identified from the two sources - job ads and Stack Overflow.
We found that
Stack
Overflow
posts
related
to
cybersecurity
contain
more
technical
terms
such
as
frameworks,
tools,
and
programming
languages.
These
details
are
often
missing
in
job
ads.
On
the
other
hand,
we
observed
that
Stack
Overflow
data
contains
very
little
information
related
to
soft
skills
such
as
communication
and
project
management.
In
contrast,
job
ads
contain
plenty
of
requirements
related
to
soft
skills.
We
also
compared
the
skills
mentioned
in
job
ads
to
the
ones
highlighted
as
important by CyberSeek
12
.
We found that the majority of the technical skills mentioned in job ads
are
the
same
as
those
deemed
important
by
CyberSeek.
Furthermore,
we
found
that
CyberSeek
emphasizes
the
importance
of
certifications
for
certain
roles
such
as
architects
and
consultants.
However,
job
ads
mention
these
certifications
irrespective
of
the
advertised
role
in
the
majority
of
the
cases.
5.2
Implications
of
our
findings
Cybersecurity
personnel.
Our
findings
are
useful
for
individuals
aiming
to
enter
the
cybersecurity
industry.
Such
individuals
can
learn
what
roles
exist
in
cybersecurity
and
what
are
soft
and
12
https://www.cyberseek.org/index.html
9
Figure
5:
Programming
languages
scores
of
cybersecurity-related
posts
on
Stack
Overflow.
technical
skills
expected
for
effectively
performing
in
such
roles.
Further,
individuals
can
learn
about
the
most
popular
certifications.
Cybersecurity
ad
design
Our
findings
can
serve
as
a
guide
for
companies
to
design
better
job
ads/descriptions.
Companies
can
include
the
skills
identified
in
our
study.
Moreover,
our
findings
can
help
companies
to
accurately
understand
the
needs
of
internal
personnel,
reduce
additional
training,
and
improve
the
efficiency
of
employees.
Education
and
Research.
In addition to industry, our findings are also useful for educational institutes.
Given
that
there
is
an
exponential
surge
in
cybersecurity
degree
offerings,
institutes
can
learn
about
the
in-demand
cyber
skills
in
the
industry.
Accordingly,
they
can
design
their
curriculum
to
teach
the
most
in-demand
cyber
skills.
5.3
Threats
to
Validity
Identifying
and
extracting
relevant
questions
and
answers
from
Stack
Overflow
through
cyberse-
curity
labels
alone
threatens
the
completeness
of
our
data.
To
reduce
this
threat,
we
used
sets
of
job
titles,
skills,
and
certification
tags
based
on
job
breakdown
and
skill
requirements
provided
in
CyberSeek.
Not
all
jobs
are
advertised
through
recruitment
portals.
For
example,
appoint-
ments
for
senior
positions
are
often
based
on
a
professional
network.
Similarly,
fresh
graduates
are
hired
via
internships
and
campus
recruitment
too.
To
mitigate
this
threat,
unlike
previous
studies [7, 14, 30, 36, 38, 40, 10, 8, 29, 37], we collected 12,161 job ads from three different sources.
In
addition,
the
timeliness
of
job
advertisements
also
poses
a
specific
threat.
This
is
because
the
irregular
posting
and
closing
of
job
advertisements
have
prevented
us
from
studying
the
evolu-
tion
of
recruitment
demand
in
recent
years.Although
we
collected
a
large
number
of
job
ads
and
Stack
Overflow
posts,
we
still
cannot
claim
the
generalizability
of
our
findings.
To
mitigate
this
threat,
we
first
studied
1000
job
ads.
We
observed
that
adding
more
ads
changes
the
frequency
distributions
but
does
not
change
the
skill
set
significantly.
While this study provides insights based on job advertisements and Stack Overflow data, future
research could focus on the direct involvement of active professionals in the field.
A survey targeting
cybersecurity
practitioners
should
be
conducted
to
validate
and
complement
the
findings
of
this
study.
Such
a
survey
could
include
questions
aimed
at
understanding
the
most
essential
technical
skills,
the
certifications
considered
most
beneficial,
the
programming
languages
frequently
used
in
practice,
and
the
soft
skills
critical
for
daily
responsibilities.
Additionally,
the
survey
could
also
cover emerging trends or overlooked competencies that may not be prominent in job advertisements
or
online
forums.
This
would
help
bridge
the
gap
between
theoretical
and
practical
workplace
requirements
and
enhance
the
overall
relevance
and
utility
of
our
findings.
6
Conclusion
In this study, we analyzed data from 12,161 cybersecurity job ads and 49,002 Stack Overflow posts
on cybersecurity to determine the most in-demand skills, the relation between cyber skills and cyber
10
roles,
and
the
programming
languages
critical
for
security
professionals.
The
results
of
the
study
show
that
communication
skills
and
project
management
skills
are
in
high
demand
for
soft
skills,
while
information
security,
information
technology,
and
security
clearance
are
in
high
demand
for
technical
skills.
Except
for
communication
skills,
the
demand
for
cyber
skills
varies
across
various
cyber
roles.
The
study
also
found
that
Java
is
the
most
commonly
used
programming
language.
In
terms
of
future
work,
the
study
provides
a
foundation
for
further
research
on
the
changing
demands
for
cybersecurity
skills.
For
example,
it
would
be
interesting
to
see
how
the
demand
for
specific
skills
changes
over
time
and
how
the
skills
in
high
demand
vary
across
different
industries
and
regions.
Additionally,
mapping
certifications
to
career
tracks
could
bridge
the
gap
between
qualifications
and
industry
needs.
Future
studies
could
also
explore
the
relationship
between
specific
skills
and
job
performance,
as
well
as
the
return
on
investment
for
acquiring
specific
skills.
References
[1]
Farwa
Abbas
and
Hussain
Ahmad.
Robust
partial
least
squares
using
low
rank
and
sparse
decomposition.
arXiv
preprint
arXiv:2407.06936
,
2024.
[2]
Majid
Abdulsatar,
Hussain
Ahmad,
Diksha
Goel,
and
Faheem
Ullah.
Towards
deep
learn-
ing
enabled
cybersecurity
risk
assessment
for
microservice
architectures.
arXiv
preprint
arXiv:2403.15169
,
2024.
[3]
Hussain
Ahmad,
Isuru
Dharmadasa,
Faheem
Ullah,
and
Muhammad
Ali
Babar.
A
review
on
c3i
systems’
security:
Vulnerabilities,
attacks,
and
countermeasures.
ACM
Computing
Surveys
,
55(9):1–38,
2023.
[4]
Hussain
Ahmad
and
Diksha
Goel.
The
future
of
ai:
Exploring
the
potential
of
large
concept
models.
arXiv
preprint
arXiv:2501.05487
,
2025.
[5]
Hussain
Ahmad,
Christoph
Treude,
Markus
Wagner,
and
Claudia
Szabo.
Smart
hpa:
A
resource-efficient
horizontal
pod
auto-scaler
for
microservice
architectures.
arXiv
preprint
arXiv:2403.07909
,
2024.
[6]
Hussain
Ahmad,
Christoph
Treude,
Markus
Wagner,
and
Claudia
Szabo.
Towards
resource-
efficient
reactive
and
proactive
auto-scaling
for
microservice
architectures.
Available
at
SSRN
4918202
,
2024.
[7]
Noam
Ben-Asher
and
Cleotilde
Gonzalez.
Effects
of
cyber
security
knowledge
on
attack
detection.
Computers
in
Human
Behavior
,
48:51–61,
2015.
[8]
Bruce Caulkins, Tiffani Marlowe, and Ashley Reardon.
Cybersecurity skills to address today’s
threats.
In
Human
Factors
in
Cybersecurity
,
2019.
[9]
Shivansh
Chopra,
Hussain
Ahmad,
Diksha
Goel,
and
Claudia
Szabo.
Chatnvd:
Advanc-
ing
cybersecurity
vulnerability
assessment
with
large
language
models.
arXiv
preprint
arXiv:2412.04756
,
2024.
[10]
Nabin
et
al.
Chowdhury.
Key
competencies
for
critical
infrastructure
cyber-security:
a
sys-
tematic
literature
review.
Information
&
Computer
Security
,
2021.
[11]
Stephen
Cobb.
Mind
this
gap:
Criminal
hacking
and
the
global
cybersecurity
skills
shortage,
a
critical
analysis.
In
Virus
Bulletin
Conference
,
pages
1–8,
2016.
[12]
Maya et al. Daneva.
Understanding the most in-demand soft skills in requirements engineering
practice:
Insights
from
two
focus
groups.
In
EASE
.
2019.
[13]
Clinton
Daniel,
Matthew
Mullarkey,
and
Manish
Agrawal.
RQ
Labs:
A
Cybersecurity
Work-
force
Skills
Development
Framework.
Information
Systems
Frontiers
,
2022.
[14]
Jessica
Dawson
and
Robert
Thomson.
The
future
cybersecurity
workforce:
Going
beyond
technical
skills
for
successful
cyber
performance.
Frontiers
in
Psychology
,
2018.
[15]
Furstenau
et
al.
20
years
of
scientific
evolution
of
cyber
security:
A
science
mapping.
In
International
Conference
on
Industrial
Engineering
and
Operations
,
2020.
[16]
Steven
Furnell.
The
cybersecurity
workforce
and
skills.
Computers
&
Security
,
100:102080,
2021.
11
[17]
Diksha
Goel.
Enhancing
network
resilience
through
machine
learning-powered
graph
combi-
natorial optimization:
Applications in cyber defense and information diffusion.
arXiv
preprint
arXiv:2310.10667
,
2023.
[18]
Diksha
Goel,
Hussain
Ahmad,
Ankit
Kumar
Jain,
and
Nikhil
Kumar
Goel.
Machine
learning
driven
smishing
detection
framework
for
mobile
security.
arXiv
preprint
arXiv:2412.09641
,
2024.
[19]
Diksha
Goel
and
Ankit
Kumar
Jain.
Overview
of
smartphone
security:
Attack
and
defense
techniques.
In
Computer
and
Cyber
Security
,
pages
249–279.
Auerbach
Publications,
2018.
[20]
Diksha
Goel,
Kristen
Moore,
Mingyu
Guo,
Derui
Wang,
Minjune
Kim,
and
Seyit
Camtepe.
Optimizing
cyber
defense
in
dynamic
active
directories
through
reinforcement
learning.
In
European
Symposium
on
Research
in
Computer
Security
,
pages
332–352.
Springer,
2024.
[21]
Diksha Goel, Hong Shen, Hui Tian, and Mingyu Guo.
Maintenance of structural hole spanners
in
dynamic
networks.
In
2021
IEEE
46th
Conference
on
Local
Computer
Networks
(LCN)
,
pages
339–342.
IEEE,
2021.
[22]
Julie
Haney
and
Wayne
Lutters.
Skills
and
Characteristics
of
Successful
Cybersecurity
Advo-
cates.
Santa
Clara,
CA,
July
2017.
USENIX
Association.
[23]
Mubin
Ul
Haque,
Isuru
Dharmadasa,
Zarrin
Tasnim
Sworna,
Roshan
Namal
Rajapakse,
and
Hussain
Ahmad.
”
i
think
this
is
the
most
disruptive
technology”:
Exploring
sentiments
of
chatgpt
early
adopters
using
twitter
data.
arXiv
preprint
arXiv:2212.05856
,
2022.
[24]
Jafri
Rehan
Hussain
Ahmad,
Faheem
Ullah.
A
survey
on
immersive
cyber
situational
aware-
ness
systems.
arXiv
preprint
arXiv:2408.07456
,
2024.
[25]
(ISC)2.
CYBERSECURITY
WORKFORCE
STUDY.
Technical
report,
(ISC)2,
2022.
[26]
Andrew
Ishmael
and
Dr
Leila
Halawi.
Retention
of
Qualified
Cybersecurity
Professionals:
A
Qualitative
Study.
Journal
of
Computer
Information
Systems
,
0,
2022.
[27]
Ankit
Kumar
Jain,
Hariom
Shukla,
and
Diksha
Goel.
A
comprehensive
survey
on
ddos
de-
tection,
mitigation,
and
defense
strategies
in
software-defined
networks.
Cluster
Computing
,
pages
1–36,
2024.
[28]
Raveen
Kanishka
Jayalath,
Hussain
Ahmad,
Diksha
Goel,
Muhammad
Shuja
Syed,
and
Fa-
heem
Ullah.
Microservice
vulnerability
analysis:
A
literature
review
with
empirical
insights.
IEEE
Access
,
2024.
[29]
Borka
Jerman
Blaˇziˇc
and
Andrej
Jerman
Blaˇziˇc.
Cybersecurity
skills
among
european
high-
school
students:
A
new
approach
in
the
design
of
sustainable
educational
development
in
cybersecurity.
Sustainability
,
14(8):4763,
2022.
[30]
Keith
S.
Jones,
Akbar
Siami
Namin,
and
Miriam
E.
Armstrong.
The
core
cyber-defense
knowledge,
skills,
and
abilities
that
cybersecurity
students
should
learn
in
school:
Results
from
interviews
with
cybersecurity
professionals.
Trans.
Comput.
Educ.
,
2018.
[31]
Hwee-Joo Kam, Dustion K. Ormond, Philip Menard, and Robert E. Crossler.
That’s interest-
ing:
An
examination
of
interest
theory
and
self-determination
in
organisational
cybersecurity
training.
Information
System
Journal
,
2021.
[32]
Imane
Khaouja,
Ismail
Kassou,
and
Mounir
Ghogho.
A
survey
on
skill
identification
from
online
job
ads.
IEEE
Access
,
9:118134–118153,
2021.
[33]
Gerardo
Matturro,
Florencia
Raschetti,
and
Carina
Font´an.
A
systematic
mapping
study
on
soft
skills
in
software
engineering.
J.
Univers.
Comput.
Sci.
,
2019.
[34]
Steve
Morgan.
Cybercrime
To
Cost
The
World
$
10.5
Trillion
Annually
By
2025.
Technical
report,
Cybercrime
Magazine,
November
2020.
[35]
Gale
General
Onefile.
Trellix
Research
Finds
Workforce
Shortage
Impacts
85%
of
Organiza-
tions’
Cybersecurity
Posture.
Internet
Business
News
,
June
2022.
[36]
Amaanullah
Parker
and
Irwin
Brown.
Skills
requirements
for
cyber
security
professionals:
A
content
analysis
of
job
descriptions
in
south
africa.
In
Information
Security
.
12
[37]
Alan
Peslak
and
D
Scott
Hunsinger.
What
is
cybersecurity
and
what
cybersecurity
skills
are
employers
seeking?
Issues
in
Information
Systems
,
20(2),
2019.
[38]
Leigh
Ellen
Potter
and
Gregory
Vickers.
What
skills
do
you
need
to
work
in
cyber
security?
a
look
at
the
australian
market.
In
Proceedings
of
the
2015
ACM
SIGMIS
Conference
on
Computers
and
People
Research
.
[39]
Samantha
Schwartz.
Cybersecurity
workforce
is
growing,
but
staff
shortages
still
put
busi-
nesses
at
risk.
Cybersecurity
Dive
,
October
2021.
[40]
Fatin
Hamizah
Sohime,
Ramona
Ramli,
Fiza
Abdul
Rahim,
and
Asmidar
Abu
Bakar.
Ex-
ploration
study
of
skillsets
needed
in
cyber
security
field.
In
International
Conference
on
Information
Technology
and
Multimedia
(ICIMU)
.
[41]
Jangirala
Srinivas,
Ashok
Kumar
Das,
and
Neeraj
Kumar.
Government
regulations
in
cyber
security:
Framework,
standards
and
recommendations.
Future
generation
computer
systems
,
92:178–188,
2019.
[42]
Tiffany
Roosa
Wm
Arthur
Conklin,
Raymond
Cline.
Re-engineering
cybersecurity
education
in
the
us:
an
analysis
of
the
critical
factors.
In
2014
47th
Hawaii
international
conference
on
system
sciences
,
pages
2006–2014.
IEEE,
2014.
13