Sweet offers and signing bonuses are not always enough to capture the talent you need.
With the demand for cyber expertise rising and the supply dwindling, Raytheon Technologies is bolstering its bench strength. To help compensate for the shortage of qualified cyber operators, the company is teaching current employees through a training program it calls the Raytheon Technologies Cyber Academy.
We are “in a war for talent, and it’s not something you can buy your way out of,” said Ryan Bagby, Raytheon Technologies Cyber Academy program manager. “We had to find a new way to help fill that gap and that was to create our own talent internally.”
The U.S. is short about 500,000 cyber workers, according to a 2019 (ISC)2 study. That's why the company is creatively working to ensure it has the best talent, and enough of it.
“We have programs asking us to get this done so we can start funneling them people,” Bagby said.
The Cyber Academy curriculum consists of several tiers, increasing in technical complexity. These tiers include foundational training for entry- and intermediate-level analysts. They also offer operational training for role-based practitioners in malware and forensics analysis, security operations center analysis, penetration testing, vulnerability research and computer network operations.
“In the vulnerability research track, we teach students to have a hacker mindset,” said Rex Nelson, a cyber engineer with Raytheon Technologies Cyber Offensives Defensive Experts. “Once the vulnerability researcher has figured out how to manipulate that system, then the computer network operations tradecraft comes in to basically install new capabilities.”
The tracks vary in length, with vulnerability research and computer network operations training taking seven weeks and defensive tracks taking about 14 weeks.
“When a student graduates from one of our programs, they’re ready to do the job on day one,” Bagby said.
The Cyber Academy is offered to governments, organizations and academic institutions to teach students computer network operations and how to defend systems against cyber threats. The academy curriculum is unlike instruction you’d find in traditional college degree programs or even certification training courses. It’s about 60 percent hands-on learning.
“I don’t dismiss certifications, but much of that training is just to pass a test,” Nelson said. “The Cyber Academy puts more emphasis on ‘labs,’ and using tools to solve problems and situations, which get harder and harder, culminating in a capstone exercise.”
Not only are Raytheon Technologies program managers eager to recruit additional cyber operators, employees are also keen to enroll in the academy as they look to develop skills that are never obsolete and jump into a career that is in high demand. Cybersecurity specialists rank among the top 10 emerging jobs, according to a 2020 LinkedIn report.
“After we held the pilot program, word got out on the street about the Cyber Academy,” Nelson said. “We’ve been pinged quite a few times, but we’re looking for people with a particular set of skills.”
In particular, they’re looking for employees with engineering and coding backgrounds.
“There’s a number of specialized tracks that deal with a different operating systems that we’re interested in, like Android, iOS, Windows, Linux, Mac OS and embedded systems like RTOS,” Nelson said. “After that, there’s also specific applications they may need for things like reverse engineering, tools like Ghidra and IDA Pro.”
The curriculum is cloud-based and uses a “cyber range” that simulates a real-world business environment.
“This will allow us to send our subject-matter experts, who are instructors, to where the students are at, which reduces the cost of delivery,” Bagby said. “All they need is a laptop, internet connection and be ready to learn, and we’ll make them cyber smart.”
Classes will consist of about 15 to 20 students a session. The company hasn’t set a goal or quota that it’s trying to meet.
“This problem isn’t shrinking,” Bagby said. “We need to keep pace with our programs, our awards, and account for attrition. It’s really a living program.”