How the US DHS develops hard-to-find cybersecurity skills

Cybersecurity skills are in short supply, and specialized cybersecurity skills are even harder to find. Take, for example, identity and access management skills, for which employers are paying an average 17% premium over base pay, according to the most recent statistics from the Foote Partners IT skills and pay index.

Fortunately, for the US Department of Homeland Security (DHS), Amanda Conley is not one to shy away from resourcing rare and specialized skills. In her first staffing role after college, she found and staffed skills to support the design, manufacture and service of aircraft engines and auxiliary power units. “That’s when I realized that having the right skills is a competitive advantage for my organization,” she explains. After that, she worked for the public sector, recruiting, hiring and developing skills for a variety of agencies.

Now, as human capital branch chief for the Office of Biometric Identity Management (OBIM) at DHS, she runs a nine-person department responsible for hiring, development and retention of talent, much of which involves focused, specialized IT skills. In June, she won the SIA’s 2022 Women in Biometrics Award, which is a testimony to how staffing is integral to the advanced technology directives under DHS.

OBIM provides DHS and its mission partners with biometric identity services that enable national security and public safety decision making. This includes operation and maintenance of the Automated Biometric Identification System (IDENT), which is the central DHS repository through which its mission partners match, store, share and analyze biometric and associated biographic information. OBIM’s Biometric Support Center also involves human examiners and additional biometric expertise.

OBIM, with 280-million unique identities and growing, supports the second largest biometrics repository in the world and the largest in the US. Based on its mission, OBIM is a heavily IT focused agency: Of the 191 authorized positions at OBIM, 60 are IT-related, and of those, 95% are dedicated to OBIM’s core mission of supporting the biometric systems used for including identifying deceased individuals, terrorists and criminals, and tourists through the safe travel programs. Through IDENT, OBIM also manages a variety of biometric types, including fingerprint, iris and facial recognition, as well as other identifiers such as images of scars, marks, tattoos and palm prints.

Creativity, upleveling skills help build cybersecurity talent

Because government agencies can’t keep up with private sector pay scales, Conley is creative, organized and forward-thinking. Her main approach is to nurture people and help uplevel their skills. This, she says, is essential to attracting, hiring and retaining the right talent. “Not to mention, it’s the right thing to do,” she adds. As an example, she shares how her program director, Shonnie Lyon, spent most of the pandemic reminding all OBIM workers that their health and safety was his number one priority.

A large part of a people-first environment is focusing on professional growth. According to a Reuters report, professional growth, along with learning new things and solving new challenges, are top incentives identified by IT professionals.

Learning opportunities are big at OBIM. For example, four of the ten specialists in the Human Capital Branch at OBIM focus on developing learning solutions for the IT, development and engineering workforces. “One way that we retain IT employees is by providing internal and external training opportunities for employees to grow in their professional development,” she says. “And we continue to improve our internal programs such as our training courses and monthly webinar series.”

Conley’s team usually starts with core skills that are easier to find, including networking, operations, security and privacy skills. Then they work with those employees to expand their skills into specialized roles through education and training programs. For example, her team recently developed a Biometrics 101 e-learning course, which is comprised of five modules. She says that employees praise the course for helping them refresh and broaden their understanding of biometrics and expanding their skills in this cutting-edge field.

While it is difficult for federal agencies to compete with compensation packages available in the private sector, the DHS is leading efforts to be more competitive with compensation for positions that support DHS cybersecurity missions. As such, Conley does have some financial incentives up her sleeve, particularly in the form of retention bonuses. “Professionals in certain designated positions may be eligible to earn an additional percentage of their salary based on the importance of the skills and certifications and their criticality to OBIM’s mission,” she explains.

Partnerships for cybersecurity training and certifications

Her department also has budget for external training and certifications to support critical skills, starting with a breadth of resources available through DHS’s Cybersecurity and Infrastructure Security Agency (CISA). With cybersecurity a core mission at DHS, the CISA is integral to development of the new Cybersecurity Talent Management System (CTMS) to recruit and retain individuals with the qualifications necessary to execute the DHS cybersecurity mission. 

Conley’s unit also partners with academia to train and augment skills, such as with University of Texas at Austin, where employees enroll for the identity leadership certificate program. “This training broadens the understanding of biometrics and identity of our employees all across the organization, and it’s great to have that knowledge on our teams,” she adds.

Her team also pulls skills directly from the private sector through industry groups, including MITRE, RAND, Center for Strategic and International Studies, and Patuxent—particularly for skills that prove impossible to find any other way. Such arrangements then open opportunities for on-the-job training to OBIM staff members who work directly with the contracted experts.

Like most government agencies, hiring at OBIM doesn’t happen overnight. Positions are pre-allocated and encoded into DHS working positions, and IT managers then request skillsets from those pre-allocated positions. It takes two years to request, approve, allocate and budget for new positions, and requests for new positions may not get approved the first time. For current allocated positions, hirers still wait at least 80 days to finalize a hire.

Critical to the mission’s success, then, is the partnership between the hiring team and IT leaders needing to hire specialized skills, Conley says, adding, “HR resources and talent development professionals can be powerful enablers by translating your business needs into positions, skill sets, competencies, and learning solutions.”

Conley and her team interface regularly with IT leaders and subject-matter experts in charge of the identity operations and identity technology divisions on recruitment, staffing, workforce planning, and future programs. They also hold annual meetings to project future staffing needs for five to ten years down the road. “It’s about putting down a marker,” she says. “These are the skills we need to perform this new body of work, and get approved additional positions in two years, in five years, and so on.” 

Eye to the future cybersecurity skills

Skillsets are constantly moving in this advanced technology space. Biometrics examiners, in human form, conduct manual matches when a biometrics match is inconclusive, for example. Commonly, inconclusive results happen when identifying unknown deceased. She then points out that OBIM was instrumental in identifying victims in the 2021 Champlain Towers collapse in Surfside Florida.

“OBIM continues to grow its privacy and policy skills to serve as the steward for customer data, ensure biometric and biographic data is being used for its approved purpose, and maintain extensive privacy practices,” she says. Privacy protections are hardcoded into OBIM’s biometric programs and are continuously evaluated and updated. Other skills to monitor and maintain the system are important as well.

To support future biometric programs, the OBIM is currently allocating skills in advanced mathematics, statistics, data science, and operations research, all of which are specialized skills that Conley predicts will be hard to find, and in some cases, hard to develop. “We are regularly projecting what future skills may be needed to support the ever-evolving biometric identity landscape,” she adds. “In some cases, we expect to be able to upskill or reskill the existing workforce, but it isn’t easy to transfer skills between biometric modalities.”