From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Eoin Higgins

itbrew.com

IT workers laid off from big tech firms have a new suitor—the auto industry

‘The demand for technology workers is still outpacing the supply, even though more supply is being pumped into the system,’ says one expert.

Billy Hurley

Tech CEOs have brighter outlook than pessimistic peers

Despite global uncertainties, some tech CEOs know they’re so money.

Speed up software upgrades—with a slow build of momentum

A key to upgrading outdated software: Get the conversation going.

a large, dimly lit office with all empty desks except one with a male worker sitting in his chair looking at his computer screen

Work

Brianna Monsanto

Woosah! That’s something cyber mindfulness proponents think cybersecurity professionals should do more of to combat stress on the job and thwart social-engineering attack attempts.

cybersecurity professionals sure aren’t

 found that 66% of surveyed cybersecurity professionals felt their roles were more stressful compared to five years prior.

Sumona Banerji, founder and director of industry thinktank MindShield, told IT Brew that stress often comes from the unknowns of the future.

“To me, stress comes from the feeling of something that’s imminent, that’s coming or headed towards you that essentially people see as a threat,” Banerji said. For cybersecurity professionals, she said this could look like worrying about job security after a breach or the impact a large incident can have on their company.

Banerji said frazzled cybersecurity professionals can benefit from practicing mindfulness, which she described as the ability to remain present in a given moment in their day-to-day life. Practicing mindfulness can help professionals combat anxiety and stress and allow them to respond to things with a better sense of clarity and in a “far more regulated way,” she said.

“When we are extremely present, we are able to switch off all the conversations and chattering in the mind that happens about the past or the future,” Banerji said.

Anna Collard, SVP of content strategy and evangelist at KnowBe4 Africa, added that mindfulness during interactions with technology and the digital world—often referred to as digital mindfulness—can help professionals better defend against social engineering attacks and similar threats.

Mindfulness in the wild can look like a number of things, according to Collard. She said intention setting is one example of mindfulness that could help professionals “subconsciously” focus on tasks ahead.

“On a Monday, I would sit down with a nice cup of coffee and then I make my intentions for the year,” Collard said, adding that she also jots down goals for the week and month.

She added that breathwork can also be used when professionals get “emotionally roused” to prevent them from responding impulsively to an emotional trigger. She named box breathing—a four step breathwork exercise that involves breathing in and out for four-second intervals with brief pauses in between each breath—as one technique professionals could try to incorporate when they encounter a stressful email or phone call.

“There’s so many breathwork techniques that one can use to give ourselves a few seconds before we react,” Collard said. “That’s powerful.”

 Michael Swinarski, deputy CISO at the CorVel Corporation, told IT Brew that he has been more deliberate with shaping the culture at his organization with mindfulness and employee well-being in mind. After the pandemic, he said he began to check in frequently with his staff, speak openly about his own meditation habits, and remind his team to take care of themselves.

“I often have to remind folks: ‘Listen, even in comic book superheroes, they need to take the time to regenerate. You can’t save the world if you’re not taking care of yourself,’” Swinarski said.

Swinarski said conversations and actions around stress and mindfulness within the industry are still a “work in progress.” He suggested security leaders advance these conversations by exhibiting healthy behaviors at the leadership level and leading by example.

“I like to tell folks as a leader, it’s your job to set the volume, rather than rise to it.”

Shot of a young Black businesswoman looking stressed at her desk in a modern office.

Why cybersecurity professionals should practice mindfulness

More than half of cybersecurity professionals felt their roles were more stressful in 2024 compared to five years ago.

Handing over the keys to the new driver in the family? Daunting. Handing over the keys to cloud instances at your company to a new hire? Perhaps just as daunting.

A new employee’s first day is a big deal for everyone, and especially for the IT department, which is responsible for setting up the appropriate permissions and access controls for all of the organization’s cloud-based applications. It’s a massive responsibility, given the 

 if those same permissions are not properly supervised. A 

 found that 23% of cloud identities, both human and non-human, have “critical” or “high severity” excessive permissions.

Jay Martin, CISO at IT solutions and services provider Blue Mantis, told IT Brew that the industry is in a “fairly immature state” when it comes to handling cloud permissions and that having a standardized process around it is critical.

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” Martin said. “So, there’s practices that need to be set up in advance.”

 Neeraj Methi, VP of cybersecurity solutions at Myriad360, told IT Brew that organizations should avoid just letting anybody have the ability to create and renege on cloud-related permissions and implement a formalized process instead.

“Define a process, open tickets, and have a trail behind everything which is being requested and denied, so that you have an idea where all these access are,” Methi said.

Kurt Seifried, chief innovation officer at the Cloud Security Alliance, added that organizations should remember that vendors are constantly adding capabilities that could shake up how things are done.

“Your cloud vendor, especially somebody like Amazon, Microsoft, Google, or Zoom even, [is] constantly adding features and security,” Seifried said. “You gotta keep up with that.”

Once an employee is successfully provisioned, the fun doesn’t stop there. Seifried told IT Brew that there are many mistakes that can be made around access permissions once set. For example, for employees who are no longer with the company, Seifried’s “lockout procedure” for Google accounts used to mean suspending the account, changing the password, and un-suspending it to hand over access to managers. That changed after he realized former employees could potentially still access the account through credentials saved on Google’s account recovery feature.

“Lessons were learned,” Seifried said.

Martin added that organizations should be mindful of appropriately adjusting cloud instance access when employees switch roles in their company, an area he said customers tend to do poorly in.

 Some companies have begun to automate the process around cloud provisioning. Methi told IT Brew that it could help bolster productivity as users are able to access cloud credentials faster and eliminate room for human error.

“If you’re doing it manually, how effective could [you] be [at] keeping track of it?” Methi said, adding that the task could become a “nightmare” for some organizations.

Karthik Ranganathan, co-founder and co-CEO of Yugabyte, an open-source distributed SQL database company, told IT Brew that the cloud provisioning process at his company is mostly automated. Ranganathan said that Yugabyte is able to constantly update its processes around onboarding and has made it a significantly shorter experience for new hires.

“Now we’re talking hours,” Ranganathan said. “So, employee starts on Monday. By Monday afternoon, we’re sending them email. They have Slack. They have everything.”

Regardless if a company chooses to partly or fully automate the cloud provisioning process, Martin said it is always important to have a formal process in place.

“You can automate as much of this as you want with technology, but the first step really is to make sure that that process is vetted, that process is documented, that you have the proper workflow,” Martin said.

What to consider when handing new employees the keys to the cloud

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” one CISO tells IT Brew.

 keep making headlines, simply holding down a stable gig may feel like a privilege. However, that shouldn’t stifle a desire for change, according to Alan Stein, founder and CEO of career accelerator company Kadima Careers.

Stein told IT Brew that there are several reasons why a professional may not be advancing within their company.

“It could be budget problems [and] that they’re not promoting anybody,” Stein said. “It could be that you’re frankly not that good in the eyes of the manager, and you’re not going to move up. It could be that you haven’t been there as long as some other people.”

Beyond a lack of career growth opportunities at a company, some professionals may feel stuck in a rut at work because they want more out of their jobs. Jason Rader, VP and CISO at Insight Enterprises, recounted a time when he was head of security consulting at his organization and felt ready to tackle a new challenge of some sort.

“I’m not saying I didn’t like what I was doing, but it was just kind of been there, done that,” Rader said. “I think a lot of people reach that point.”

Whatever the reasoning, Stein said it’s up to the professional themselves to do something about it.

“Pretty much no one is going to care more about your career than you,” Stein said. “So, if you don’t proactively take ownership of it, then you’re at the whim of what other people decide.”

Kelly Doyle, managing director at Heller Search Associates, told IT Brew that professionals who feel stagnant in their roles can start by investing in themselves and their career.

“I interviewed a number of people who are taking an AI course or a cyber course,” Doyle said. “So, I think those are great ways to upskill and enhance someone’s current performance, but also just round out your skill set for now or for later.”

She added that staffers may also find it useful to join professional organizations, attend industry conferences, and engage in other networking activities.

Stein said professionals can try to find a mentor within their workplace and build connections with peers to find value in their organizations.

“Just talk to them. Seek advice. Build relationships,” Stein said. “It’s going to help you internally within the company and it’s going to help give you advice and guidance on your career.”

If moving on up is the goal, Stein said professionals can just start a dialogue with leadership at their organizations to pinpoint how they can grow their career at the organization.

“I would say, ‘I’m really ambitious. I’d like to grow my career here. I would love to get promoted, and I’d love your feedback on what I can do to get there,’ and see what they say,” Stein said.

Even if a promotion isn’t an immediate goal, conversations with higher-ups can still be useful for employees who are seeking more out of their role. When Rader was ready for a change of pace in his career, he had a chat with Insight’s new CIO at the time about his concerns around the company’s security posture, which ultimately granted him the opportunity to serve as the organization’s virtual CISO for a year.

“A lot of people would never think that they should propose something that wasn’t proposed to them to somebody who’s at an executive level [in] the organization,” Rader said. “I think people should.”

Doyle told IT Brew that professionals in a rut should take a second to understand why they feel that way as it can provide some clarity on what they may ultimately need to do to feel better.

“Have you outgrown your position? Have you accomplished everything you can in that environment?...Maybe it is time to explore a new technology position elsewhere,” Doyle said.

Repeating tired emoticon stickers on a calendar. 

What to do when you feel stuck in your stable job

One recruitment expert tells IT Brew that professionals who feel stagnant in their career can add value by investing in their career and professional development.

When you’re the only IT person at your organization, it may feel like you are wearing a bunch of different hats.

“Enterprise applications, infrastructure and operations, [and] security usually falls to you…in addition to running all of IT,” Heller Search Associates Managing Director Kelly Doyle, who has about 20 years of executive recruitment experience, told IT Brew.

Now it may be time to add one more cap to your collection: the negotiation hat.

No team members in your department? No problem. But how do you make the case for a raise for all your efforts when there’s nothing to compare your performance to? IT Brew caught up with two career experts to discuss how IT professionals who are their department’s sole contributor can navigate negotiation talks.

 Cristina Magro, founder of a career coaching firm for cybersecurity professionals, told IT Brew that IT professionals seeking a pay raise should be prepared to show the value they bring to their organization to back up their request.

“You need to spend some time gathering this evidence and documenting it, so keeping a file with all your accomplishments,” Magro said. “Be very specific.”

Magro said that professionals should establish a best alternative to a negotiated agreement, or BATNA, which is a minimum pay range they are willing to walk away with from the negotiation table.

 Leveraging external market data can be useful when negotiating a pay raise, according to Doyle. The average base salary for a help desk technician is close to $46,000, for example, whereas a systems administrator is close to $90,000, according to market data from Indeed.

“If you’re the only person in IT, your company may not know how competitive the tech market is,” Doyle said. “So, you can find industry-specific salary surveys.”

She added that professionals should consider the timing of when they choose to broach the subject.

“You want to have these conversations when the company is doing well or you’ve just completed a major project, or something like that,” she said.

 Sometimes a pay raise may not be attainable on the first go. If at first you don’t succeed, Magro said to dust yourself off and try again.

“If the conversation ends up in a place that is not ideal…make sure that you set another time for another negotiation to happen,” she said.

Doyle advised professionals whose companies aren’t able to meet their salary expectations to see if they can receive other benefits in the meantime.

“Maybe they can give you more PTO,” Doyle said. “Maybe you can get more of a hybrid work [arrangement].”

Being the sole IT professional at an organization has its perks. Magro said the position can be leveraged as a selling point by professionals who choose to embark on a job search following subpar negotiation discussions.

“The exposure that you get is really great and it’s possibly not common in other organizations where you are part of a wider team,” Magro said.

Patterned photo collage of hats with an upside down baseball cap with $100 bills. 

How to negotiate a salary when you’re the only IT pro at the company

One career coach tells IT Brew that being the sole contributor in an organization can be leveraged as a selling point when looking for a new role.

Tom McKay

Quite a lot, actually. Large language models (LLMs) might have an impressive (and/or alarming) ability to mimic human art and writing, but if they’re fed garbage, they’ll dump garbage..

One of the first new jobs to emerge from the LLM frenzy is prompt engineer—professionals who refine prompts entered into artificial intelligence/machine learning (AI/ML) tools to improve the quality of responses. Some coverage touted prompt engineering as a hot job that can 

—the staggering number of variables in their data sets means it can be difficult even for their designers to debug the models when they act unpredictably.

Hence, the demand for methods to make LLMs do what their users think they’re telling them to do (and cut down on 

). Victor Sanh, lead machine learning scientist at Hugging Face, told IT Brew that research to make deep learning models 

 remains “very, very experimental” and “not super actionable right now.”

Enter: the prompt engineer, a title that can also be vague, as the roles can have 

, from general prompt debugging, to domain-specific analysis, to actually integrating AI technology into software.

 jobs in prompt engineering: Indeed.com has around 200 job listings for the search term “prompt engineer” within 100 miles of San Francisco as of Oct. 24, 2023, while ZipRecruiter has around 30. What’s more, many of those results mention prompt engineering as complementary to other desired skills, such as designing distributed systems or developing AI/ML algorithms.

Ben Stokes is the founder of PromptBase, a “prompt marketplace” for LLMs like OpenAI’s ChatGPT or Midjourney. PromptBase markets itself as helping users “save on time and API costs.”

“For most people, it’s an act of discovery, where it’s a lot of trial and error, where you’re just continually prodding the LLM, tweaking little parts of the sentence to see how that changes the output,” Stokes told IT Brew.

“I think at the extreme level, you’re tracking every single word change and how that changes the output from the prompt,” he added.

One of the key challenges facing would-be prompt engineers is that their data often loses relevance when AI/ML developers update their models. Stokes said PromptBase has mechanisms to flag or hide prompts that no longer work, but outdated prompts are as much of a general issue for LLMs as outdated training data.

“Understanding the query requires knowledge that is super recent,” Sanh said. For example, if an LLM with an older data set makes up responses about current events, “There’s no way to tell them all the ways it’s wrong.”

Sanh said many prompt engineering jobs currently have low technical barriers to entry. That’s because most LLM tooling, including integrations and UI, are still being built in-house and sold by the companies that make the models in the first place.

 prompt engineering may cease to exist in its current form, he also told IT Brew that UI for LLMs could look very different as little as a year from now.

“What’s clear to me is that in the long run, a lot of the companies who are going to rely solely on APIs—doing almost close to no technical work and building internal knowledge and technical expertise—are just going to be dependent on whatever cloud providers and the system providers do,” Sanh said.

Stokes said he doesn’t like the term “prompt engineer,” which he thinks can be offensive to those who view it as appropriating the titles of prestigious careers like software or mechanical engineering. “Then you have prompt engineering, and it’s like you’re just writing English into a chatbot,” Stokes said.

However, Stokes thinks prompts are likely to become more, not less, complex as the use cases for LLMs become even more complicated.

Sanh predicted LLMs will largely become multimodal by default and “natively integrated in a lot of products in our life.” He predicted prompt engineering will eventually become a prerequisite skill in many fields, rather than a discrete profession.

However, that decline may be offset by other types of jobs debugging LLMs, like security, Sanh said. 

“We see that with red teaming efforts, [it] also adversarially attack[s] the model to see the limits of safety in the systems,” Sanh added.

Is prompt engineering here to stay or a fleeting fad?

Prompt engineers are in part necessary because the inner workings of large language models remain mysterious.

Unemployment in the tech sector increased slightly in August, but overall numbers remain strong in the industry.

That’s according to the latest numbers from CompTIA. The nonprofit trade association’s assessment of the tech labor market over the last month—using Bureau of Labor Statistics numbers—found that 189,000 tech jobs were cut in August.

For people out of work, it wasn’t all bad news. Employers were still seeking to fill 208,000 tech positions, an increase of 12,643 from July’s 204,400.

Nonetheless, unemployment in the sector increased to 2.1% from July’s 1.8%; the latter, as 

, was the lowest tech unemployment number since January. The increase mirrored the broader economic news, as national unemployment bumped up slightly to 3.8% overall.

Employers are looking for information security analysts; postings for those positions grew 19% from July to August. According to CompTIA’s analysis, employers are also still looking to hire “software developers, tech support specialists, computer systems analysts, and data scientists.”

The tech sector is healthy and expects to continue to see added investment through the end of the year, according to an August 31 analysis from Wedbush Securities. In the report, analysts cite the increase in overall investment in AI technology as a driver in the industry’s growth. The report notes that AI giant Nvidia’s late August guidance and earnings offer a path forward that “speaks to a tidal wave of AI driven spending on the horizon for the tech sector over the coming years.”

AI is one factor behind an increase in job postings in emerging technologies, which made up 23% of the total August tech positions available. CompTIA’s analysis found that California, Massachusetts, New York, Texas, and Virginia led the pack in 

. In cities, tech job postings were highest in Denver, Washington, Phoenix, Tampa, Philadelphia, and Baltimore.

A woman sits at a desk in front of a computer monitor, taking a video call.

As economy dips, tech jobs stutter—but market is strong overall

Unemployment rose from a six-month low to 2.1%, but the market remains good for workers.

Not ideal—that’s the takeaway from recent research about CISO candidates and their fitness for the boardroom.

A June report from IANS Research, Artico Search, and The Cap Group says only 14% of CISOs have four out of five traits considered by many to be important for the boardroom: infosec tenure, broad experience, scale, advanced education, and diversity.

A high percentage of the not-really-ready-for-the-shareholder-suite security officers presents a challenge for organizations as the Securities and Exchange Commission proposes rule changes that require boards to designate cybersecurity expertise.

“Boards are probably going to scramble to figure out how [to] make an existing member check the box, whether it’s someone who’s been the CIO or that is overseeing technology, but it’d be great over time if we see opportunities for true security professionals to step in and truly serve in the capacity, because they have the experience and the knowledge,” Erica Wilson, VP, global cybersecurity and privacy risk management at Reinsurance Group of America, told a crowd 

In March 2022, the SEC proposed mandating a 

disclosure of “cybersecurity expertise”

 on the board. According to the IANS data, some CISOs are more prepared than others.

The IANS and co. review of CISOs from companies listed on the Russell 1000 Index, pulled from publicly available sources and self-reported info, found:

meeting three out of the five board traits and nearly all having served as CISO for at least five years. The group, however, has “notably lower percentages for diversity and cross-functional experience than the pool of ideal candidates.”

only holding one or two of the desired characteristics—frequently infosec tenure and scale.

For those in need of board traits, the report recommended brushing up on the “

,” including engaging with the C-suite and board quarterly and understanding their challenges and priorities. Other report recommendations included investing in additional education like an MBA  and trusted certifications from orgs like the National Association of Corporate Directors and major universities.

“Our data shows there is a large portion of the population of CISOs who could emerge as board-ready in the next several years. Both boards and CISOs would benefit from aligning on expectations for a board-ready cyber expert, preparing this CISO community aggressively to help meet long-term board needs,” said Steve Martano, a partner and executive recruiter in Artico Search’s cyber practice, in the report.

A row of chairs lined up next to a table in an empty board room