From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Eoin Higgins

itbrew.com

IT workers laid off from big tech firms have a new suitor—the auto industry

‘The demand for technology workers is still outpacing the supply, even though more supply is being pumped into the system,’ says one expert.

Billy Hurley

Tech CEOs have brighter outlook than pessimistic peers

Despite global uncertainties, some tech CEOs know they’re so money.

Speed up software upgrades—with a slow build of momentum

A key to upgrading outdated software: Get the conversation going.

a large, dimly lit office with all empty desks except one with a male worker sitting in his chair looking at his computer screen

Work

Brianna Monsanto

The war for AI talent has turned the tech industry into a real-life game of 

, and let’s just say most companies aren’t making it to the Showcase Showdown.

High salary expectations are the biggest challenge companies of all sizes face when hiring AI talent, with small to mid-size companies feeling the brunt of the sticker shock.

 querying 500 US software engineers, senior managers, and other higher ups at companies with between 250 and 10,000 employees earlier this year. Other challenges the survey referenced include a 

, a too-lengthy hiring process, and unclear role requirements.

Aaron Sines, director of AI recruiting at tech recruitment agency Edison & Black, told IT Brew that he has seen salary expectation problems time and time again, largely because of a salary expectations “mismatch” between companies and candidates.

“Companies think they can hire AI talent like they can hire software engineers, and it’s like trying to hire Elon Musk with a Toyota salary,” Sines said. CloudZero estimates that most AI professionals earn more than $100,000 with more than one-fourth (26%) earning between $150,000 and $200,000.

Sines explained that the industry is currently undergoing what he calls the “1,000 people problem.” Currently, there are about 1,000 people with the “deep theoretical knowledge” needed to build and train advanced AI models known as frontier models. (Sines noted it’s likely about 2,000 people, but 1,000 sounds catchier). The problem is every company wants to grab the cream of the crop, especially those with experience at top AI companies, leaving many regular tech companies unable to compete.

“A lot of times we’re kind of giving them the hard news that, ‘Hey, you’re way off, way off. So, unless you’re willing to adjust your expectations, we’re not going to be able to deliver on this,’” Sines said.

Eric Fehr, chief revenue officer at Search Solution Group, recalled once working with a mid-size SaaS company that was seeking an inaugural in-house machine learning engineer with an initial budget in the range of $160,000 to $165,000. Fehr said candidates with the appropriate level of experience for the role were expecting upward of $200,000.

“That’s a pretty significant gap,” Fehr said. “That caused some friction and kind of caused progress to stall for a couple weeks.”

 For companies that may not be able to afford top AI talent, Sines suggests upskilling current talent or hiring and refining entry-level candidates.

“A lot of more sophisticated engineers who’ve been working on machine learning, or something peripheral of machine learning, can definitely be upskilled,” Sines said. “And a lot of them, I think, are really eager to be.”

Digital dollar sign floating above a hand

Companies and AI talent not on same page when it comes to salary expectations

One AI recruiter tells IT Brew that he is constantly needing to do a salary reality check with tech companies seeking AI talent. 

Things you may be judged for in a professional setting: the firmness of your handshake, the amount of eye contact you make, your ability to engage in small talk near the watercooler…and the way you keep your organization secure?

 a leg up in crafting their next cyber threat, making sure employees are practicing good security hygiene and integrating secure practices in their work is more important than ever. That’s why many companies are getting creative to ensure they stay one step ahead with cybersecurity issues.

Microsoft is one company that has taken a stab at making cybersecurity more top of mind for its employees. Since last December, security has been designated as a “core priority” for every Microsoft employee. That means security is a component of biannual employee performance reviews and “considered in every employee’s annual bonus and compensation.”

Some have taken a fancy to the new approach.

Deb Arnold, who runs an eponymous boutique consulting firm, said making cybersecurity a topic of discussion during employee reviews may be a good practice for security-focused companies because employees are more likely to pay attention to things they are incentivized to do.

“If leaders want cybersecurity taken seriously, they need to embed that into performance reviews,” Arnold said. “Otherwise, it’s the classic rewarding A, while hoping for B.”

However, Arnold said incentives to encourage security-focused behaviors must be paired with a broader cultural change to be fully effective.

David Murray, CEO of the people platform company Confirm, said he sees the value of considering security as part of performance at work in the current threat landscape.

“When you look at where the world is going, it’s helpful to remind people that we all contribute to safety and security in each of our respective organizations,” Murray said. “So, I am actually supportive of the idea of introducing the concepts to folks that each one of them contributes to security and that a company’s security is only as secure as its weakest link.”

“The employees have to have the knowledge and skills so they know how to act securely,” Arnold said. “They need the right systems and tools so that secure choices are the easy choices.”

David Rice, senior editor at People Managing People, said security is more of a “compliance issue.” While security would be an appropriate topic of discussion for an IT and cybersecurity-focused employee’s performance review, he said integrating it as a norm for other employees may unintentionally leave an employee’s security habits open to interpretation.

“When we think about, ‘How do I perform at my job?’, people will have different ideas about how that gets done, and I don’t know if you want to open that door in security,” Rice said.

Rice added that incentivizing security may result in an “inconsistency” in employee behavior.

“If it’s an expectation and you’ve got to meet it or you’re going to be having a discussion with your boss that’s not so pleasant, that’s different,” Rice said, suggesting that employees are likely to adhere to proper cybersecurity practices if this is expected of them.

Companies that want to incorporate security into their performance reviews need to do so the right way, according to JLEE & Associates founder and CEO Jimmie Lee. He said employees shouldn’t be evaluated on “ambiguous” security goals and that these targets should be tailored to their specific role.

“Security looks different from every employee, so you have to have a system that’s flexible,” Lee said.

various clip images signifying a performance reviews, including five stars, speech bubbles, an abstract checklist, and bar graph

Should security be considered in an employee’s performance review?

“If leaders want cybersecurity taken seriously, they need to embed that into performance reviews,” one expert says. 

Woosah! That’s something cyber mindfulness proponents think cybersecurity professionals should do more of to combat stress on the job and thwart social-engineering attack attempts.

cybersecurity professionals sure aren’t

 found that 66% of surveyed cybersecurity professionals felt their roles were more stressful compared to five years prior.

Sumona Banerji, founder and director of industry thinktank MindShield, told IT Brew that stress often comes from the unknowns of the future.

“To me, stress comes from the feeling of something that’s imminent, that’s coming or headed towards you that essentially people see as a threat,” Banerji said. For cybersecurity professionals, she said this could look like worrying about job security after a breach or the impact a large incident can have on their company.

Banerji said frazzled cybersecurity professionals can benefit from practicing mindfulness, which she described as the ability to remain present in a given moment in their day-to-day life. Practicing mindfulness can help professionals combat anxiety and stress and allow them to respond to things with a better sense of clarity and in a “far more regulated way,” she said.

“When we are extremely present, we are able to switch off all the conversations and chattering in the mind that happens about the past or the future,” Banerji said.

Anna Collard, SVP of content strategy and evangelist at KnowBe4 Africa, added that mindfulness during interactions with technology and the digital world—often referred to as digital mindfulness—can help professionals better defend against social engineering attacks and similar threats.

Mindfulness in the wild can look like a number of things, according to Collard. She said intention setting is one example of mindfulness that could help professionals “subconsciously” focus on tasks ahead.

“On a Monday, I would sit down with a nice cup of coffee and then I make my intentions for the year,” Collard said, adding that she also jots down goals for the week and month.

She added that breathwork can also be used when professionals get “emotionally roused” to prevent them from responding impulsively to an emotional trigger. She named box breathing—a four step breathwork exercise that involves breathing in and out for four-second intervals with brief pauses in between each breath—as one technique professionals could try to incorporate when they encounter a stressful email or phone call.

“There’s so many breathwork techniques that one can use to give ourselves a few seconds before we react,” Collard said. “That’s powerful.”

 Michael Swinarski, deputy CISO at the CorVel Corporation, told IT Brew that he has been more deliberate with shaping the culture at his organization with mindfulness and employee well-being in mind. After the pandemic, he said he began to check in frequently with his staff, speak openly about his own meditation habits, and remind his team to take care of themselves.

“I often have to remind folks: ‘Listen, even in comic book superheroes, they need to take the time to regenerate. You can’t save the world if you’re not taking care of yourself,’” Swinarski said.

Swinarski said conversations and actions around stress and mindfulness within the industry are still a “work in progress.” He suggested security leaders advance these conversations by exhibiting healthy behaviors at the leadership level and leading by example.

“I like to tell folks as a leader, it’s your job to set the volume, rather than rise to it.”

Shot of a young Black businesswoman looking stressed at her desk in a modern office.

Why cybersecurity professionals should practice mindfulness

More than half of cybersecurity professionals felt their roles were more stressful in 2024 compared to five years ago.

Handing over the keys to the new driver in the family? Daunting. Handing over the keys to cloud instances at your company to a new hire? Perhaps just as daunting.

A new employee’s first day is a big deal for everyone, and especially for the IT department, which is responsible for setting up the appropriate permissions and access controls for all of the organization’s cloud-based applications. It’s a massive responsibility, given the 

 if those same permissions are not properly supervised. A 

 found that 23% of cloud identities, both human and non-human, have “critical” or “high severity” excessive permissions.

Jay Martin, CISO at IT solutions and services provider Blue Mantis, told IT Brew that the industry is in a “fairly immature state” when it comes to handling cloud permissions and that having a standardized process around it is critical.

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” Martin said. “So, there’s practices that need to be set up in advance.”

 Neeraj Methi, VP of cybersecurity solutions at Myriad360, told IT Brew that organizations should avoid just letting anybody have the ability to create and renege on cloud-related permissions and implement a formalized process instead.

“Define a process, open tickets, and have a trail behind everything which is being requested and denied, so that you have an idea where all these access are,” Methi said.

Kurt Seifried, chief innovation officer at the Cloud Security Alliance, added that organizations should remember that vendors are constantly adding capabilities that could shake up how things are done.

“Your cloud vendor, especially somebody like Amazon, Microsoft, Google, or Zoom even, [is] constantly adding features and security,” Seifried said. “You gotta keep up with that.”

Once an employee is successfully provisioned, the fun doesn’t stop there. Seifried told IT Brew that there are many mistakes that can be made around access permissions once set. For example, for employees who are no longer with the company, Seifried’s “lockout procedure” for Google accounts used to mean suspending the account, changing the password, and un-suspending it to hand over access to managers. That changed after he realized former employees could potentially still access the account through credentials saved on Google’s account recovery feature.

“Lessons were learned,” Seifried said.

Martin added that organizations should be mindful of appropriately adjusting cloud instance access when employees switch roles in their company, an area he said customers tend to do poorly in.

 Some companies have begun to automate the process around cloud provisioning. Methi told IT Brew that it could help bolster productivity as users are able to access cloud credentials faster and eliminate room for human error.

“If you’re doing it manually, how effective could [you] be [at] keeping track of it?” Methi said, adding that the task could become a “nightmare” for some organizations.

Karthik Ranganathan, co-founder and co-CEO of Yugabyte, an open-source distributed SQL database company, told IT Brew that the cloud provisioning process at his company is mostly automated. Ranganathan said that Yugabyte is able to constantly update its processes around onboarding and has made it a significantly shorter experience for new hires.

“Now we’re talking hours,” Ranganathan said. “So, employee starts on Monday. By Monday afternoon, we’re sending them email. They have Slack. They have everything.”

Regardless if a company chooses to partly or fully automate the cloud provisioning process, Martin said it is always important to have a formal process in place.

“You can automate as much of this as you want with technology, but the first step really is to make sure that that process is vetted, that process is documented, that you have the proper workflow,” Martin said.

What to consider when handing new employees the keys to the cloud

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” one CISO tells IT Brew.

 keep making headlines, simply holding down a stable gig may feel like a privilege. However, that shouldn’t stifle a desire for change, according to Alan Stein, founder and CEO of career accelerator company Kadima Careers.

Stein told IT Brew that there are several reasons why a professional may not be advancing within their company.

“It could be budget problems [and] that they’re not promoting anybody,” Stein said. “It could be that you’re frankly not that good in the eyes of the manager, and you’re not going to move up. It could be that you haven’t been there as long as some other people.”

Beyond a lack of career growth opportunities at a company, some professionals may feel stuck in a rut at work because they want more out of their jobs. Jason Rader, VP and CISO at Insight Enterprises, recounted a time when he was head of security consulting at his organization and felt ready to tackle a new challenge of some sort.

“I’m not saying I didn’t like what I was doing, but it was just kind of been there, done that,” Rader said. “I think a lot of people reach that point.”

Whatever the reasoning, Stein said it’s up to the professional themselves to do something about it.

“Pretty much no one is going to care more about your career than you,” Stein said. “So, if you don’t proactively take ownership of it, then you’re at the whim of what other people decide.”

Kelly Doyle, managing director at Heller Search Associates, told IT Brew that professionals who feel stagnant in their roles can start by investing in themselves and their career.

“I interviewed a number of people who are taking an AI course or a cyber course,” Doyle said. “So, I think those are great ways to upskill and enhance someone’s current performance, but also just round out your skill set for now or for later.”

She added that staffers may also find it useful to join professional organizations, attend industry conferences, and engage in other networking activities.

Stein said professionals can try to find a mentor within their workplace and build connections with peers to find value in their organizations.

“Just talk to them. Seek advice. Build relationships,” Stein said. “It’s going to help you internally within the company and it’s going to help give you advice and guidance on your career.”

If moving on up is the goal, Stein said professionals can just start a dialogue with leadership at their organizations to pinpoint how they can grow their career at the organization.

“I would say, ‘I’m really ambitious. I’d like to grow my career here. I would love to get promoted, and I’d love your feedback on what I can do to get there,’ and see what they say,” Stein said.

Even if a promotion isn’t an immediate goal, conversations with higher-ups can still be useful for employees who are seeking more out of their role. When Rader was ready for a change of pace in his career, he had a chat with Insight’s new CIO at the time about his concerns around the company’s security posture, which ultimately granted him the opportunity to serve as the organization’s virtual CISO for a year.

“A lot of people would never think that they should propose something that wasn’t proposed to them to somebody who’s at an executive level [in] the organization,” Rader said. “I think people should.”

Doyle told IT Brew that professionals in a rut should take a second to understand why they feel that way as it can provide some clarity on what they may ultimately need to do to feel better.

“Have you outgrown your position? Have you accomplished everything you can in that environment?...Maybe it is time to explore a new technology position elsewhere,” Doyle said.

Repeating tired emoticon stickers on a calendar. 

What to do when you feel stuck in your stable job

One recruitment expert tells IT Brew that professionals who feel stagnant in their career can add value by investing in their career and professional development.

When you’re the only IT person at your organization, it may feel like you are wearing a bunch of different hats.

“Enterprise applications, infrastructure and operations, [and] security usually falls to you…in addition to running all of IT,” Heller Search Associates Managing Director Kelly Doyle, who has about 20 years of executive recruitment experience, told IT Brew.

Now it may be time to add one more cap to your collection: the negotiation hat.

No team members in your department? No problem. But how do you make the case for a raise for all your efforts when there’s nothing to compare your performance to? IT Brew caught up with two career experts to discuss how IT professionals who are their department’s sole contributor can navigate negotiation talks.

 Cristina Magro, founder of a career coaching firm for cybersecurity professionals, told IT Brew that IT professionals seeking a pay raise should be prepared to show the value they bring to their organization to back up their request.

“You need to spend some time gathering this evidence and documenting it, so keeping a file with all your accomplishments,” Magro said. “Be very specific.”

Magro said that professionals should establish a best alternative to a negotiated agreement, or BATNA, which is a minimum pay range they are willing to walk away with from the negotiation table.

 Leveraging external market data can be useful when negotiating a pay raise, according to Doyle. The average base salary for a help desk technician is close to $46,000, for example, whereas a systems administrator is close to $90,000, according to market data from Indeed.

“If you’re the only person in IT, your company may not know how competitive the tech market is,” Doyle said. “So, you can find industry-specific salary surveys.”

She added that professionals should consider the timing of when they choose to broach the subject.

“You want to have these conversations when the company is doing well or you’ve just completed a major project, or something like that,” she said.

 Sometimes a pay raise may not be attainable on the first go. If at first you don’t succeed, Magro said to dust yourself off and try again.

“If the conversation ends up in a place that is not ideal…make sure that you set another time for another negotiation to happen,” she said.

Doyle advised professionals whose companies aren’t able to meet their salary expectations to see if they can receive other benefits in the meantime.

“Maybe they can give you more PTO,” Doyle said. “Maybe you can get more of a hybrid work [arrangement].”

Being the sole IT professional at an organization has its perks. Magro said the position can be leveraged as a selling point by professionals who choose to embark on a job search following subpar negotiation discussions.

“The exposure that you get is really great and it’s possibly not common in other organizations where you are part of a wider team,” Magro said.

Patterned photo collage of hats with an upside down baseball cap with $100 bills. 

How to negotiate a salary when you’re the only IT pro at the company

One career coach tells IT Brew that being the sole contributor in an organization can be leveraged as a selling point when looking for a new role.

Tom McKay

Quite a lot, actually. Large language models (LLMs) might have an impressive (and/or alarming) ability to mimic human art and writing, but if they’re fed garbage, they’ll dump garbage..

One of the first new jobs to emerge from the LLM frenzy is prompt engineer—professionals who refine prompts entered into artificial intelligence/machine learning (AI/ML) tools to improve the quality of responses. Some coverage touted prompt engineering as a hot job that can 

—the staggering number of variables in their data sets means it can be difficult even for their designers to debug the models when they act unpredictably.

Hence, the demand for methods to make LLMs do what their users think they’re telling them to do (and cut down on 

). Victor Sanh, lead machine learning scientist at Hugging Face, told IT Brew that research to make deep learning models 

 remains “very, very experimental” and “not super actionable right now.”

Enter: the prompt engineer, a title that can also be vague, as the roles can have 

, from general prompt debugging, to domain-specific analysis, to actually integrating AI technology into software.

 jobs in prompt engineering: Indeed.com has around 200 job listings for the search term “prompt engineer” within 100 miles of San Francisco as of Oct. 24, 2023, while ZipRecruiter has around 30. What’s more, many of those results mention prompt engineering as complementary to other desired skills, such as designing distributed systems or developing AI/ML algorithms.

Ben Stokes is the founder of PromptBase, a “prompt marketplace” for LLMs like OpenAI’s ChatGPT or Midjourney. PromptBase markets itself as helping users “save on time and API costs.”

“For most people, it’s an act of discovery, where it’s a lot of trial and error, where you’re just continually prodding the LLM, tweaking little parts of the sentence to see how that changes the output,” Stokes told IT Brew.

“I think at the extreme level, you’re tracking every single word change and how that changes the output from the prompt,” he added.

One of the key challenges facing would-be prompt engineers is that their data often loses relevance when AI/ML developers update their models. Stokes said PromptBase has mechanisms to flag or hide prompts that no longer work, but outdated prompts are as much of a general issue for LLMs as outdated training data.

“Understanding the query requires knowledge that is super recent,” Sanh said. For example, if an LLM with an older data set makes up responses about current events, “There’s no way to tell them all the ways it’s wrong.”

Sanh said many prompt engineering jobs currently have low technical barriers to entry. That’s because most LLM tooling, including integrations and UI, are still being built in-house and sold by the companies that make the models in the first place.

 prompt engineering may cease to exist in its current form, he also told IT Brew that UI for LLMs could look very different as little as a year from now.

“What’s clear to me is that in the long run, a lot of the companies who are going to rely solely on APIs—doing almost close to no technical work and building internal knowledge and technical expertise—are just going to be dependent on whatever cloud providers and the system providers do,” Sanh said.

Stokes said he doesn’t like the term “prompt engineer,” which he thinks can be offensive to those who view it as appropriating the titles of prestigious careers like software or mechanical engineering. “Then you have prompt engineering, and it’s like you’re just writing English into a chatbot,” Stokes said.

However, Stokes thinks prompts are likely to become more, not less, complex as the use cases for LLMs become even more complicated.

Sanh predicted LLMs will largely become multimodal by default and “natively integrated in a lot of products in our life.” He predicted prompt engineering will eventually become a prerequisite skill in many fields, rather than a discrete profession.

However, that decline may be offset by other types of jobs debugging LLMs, like security, Sanh said. 

“We see that with red teaming efforts, [it] also adversarially attack[s] the model to see the limits of safety in the systems,” Sanh added.