Poaching frenzy in cybersecurity: Curbs on foreign hiring triggers scramble

Singapore

POACHING has come to the fore as a stopgap hiring measure for tech players here during the pandemic, especially in the cybersecurity field.

Recruiters flagged border closures and tighter hiring rules for foreigners as mounting challenges for the industry, where personnel can readily reap salary benefits by jumping ship.

Tammie Tham, chief executive of homegrown Ensign InfoSecurity, told The Business Times that "there's a lot of poaching activities" in the industry: "Everyone is essentially fishing from a very small pond, which I thought is super unhealthy."

The practice is fair game in any industry with a talent crunch. But the squeeze is especially tight in new fields like cybersecurity, which have a shorter runway to build manpower.

The Ministry of Manpower (MOM) in April named cybersecurity professionals among the top 10 emerging workforce roles. There were 4,300 vacancies for infocomm technology professionals, managers, executives and technicians in 2020, which includes cybersecurity professionals, it noted.

But poaching is not just due to the slow trickle of graduates coming on stream. There is also a shrinking talent pool as the expat supply is choked off.

"Due to the market being so competitive at the moment, particularly when trying to find strong Singaporean talent, the intensity of poaching... can be seen to be very high," added Brett Lockett, principal consultant for cybersecurity at specialist recruitment firm Robert Walters Singapore.

The minimum salary for new Employment Pass holders was raised last September to S$4,500, from S$3,900 before - the second increase in a year - in a move to support local employment amid the Covid-19 downturn.

In May this year, the MOM also stopped accepting new applications to enter Singapore for work pass holders coming from higher-risk countries or regions - a decision that limits arrivals from most of the world.

Said Mr Lockett: "The challenges in relocating overseas candidates due to Covid, and the drill-down on employment passes in Singapore, have resulted in many organisations rethinking their hiring strategies."

Indeed, more than 80 per cent of the Singapore cybersecurity workforce at French electrical systems group Thales are already locals, according to Jeannie Wong, its human resources director.

To woo staff, spokespeople for the CSA and Government Technology Agency (GovTech) both described remuneration and salary packages as "competitive" when asked by BT.

Data from Randstad showed that experienced cybersecurity professionals can command a monthly base pay of up to S$15,000.

Already, cybersecurity professionals fetch a base pay that is 9 per cent to 13 per cent higher than in peer industries, said Ravi Nippani, associate partner of human capital solutions at professional services firm Aon.

Meanwhile, recruitment firm Randstad found that the average pay bump for tech talent who are changing jobs is 8 per cent to 12 per cent - well above the 2 per cent to 5 per cent average for the workforce as a whole.

Even at the entry level, more than 95 per cent of Singapore Institute of Technology information security programme graduates nabbed full-time employment in six months. That beat the hiring rate for its wider information and communications technology cohort, which was under 90 per cent.

Poaching aside, industry players stressed a focus on reskilling as a longer-term solution to the shortage.

Goh Eng Choon, who heads the cyber business at ST Engineering, told BT that the group is focusing on talent retention in a competitive market, such as by "grooming our employees, giving them exposure and supporting their career development".

And, besides hiring mid-career switchers, Ms Tham pointed to a joint laboratory agreement that Ensign and cybersecurity firm RSA set up with Republic Polytechnic in 2019.

Other schemes in place in Singapore include the Cyber Security Associates and Technologies programme, which features company-led training but is backed by the Infocomm Media Development Authority and Cyber Security Agency of Singapore (CSA).

The CSA also unveiled the Cybersecurity Development Programme last year, which trains participants alongside partners from the private sector and public education institutions.

But training takes time to deliver results. For instance, Ngee Ann Polytechnic's cybersecurity diploma programme has produced about 200 graduates since its launch, including 57 in May this year. But the first batch graduated only in 2018 - so it's still too early to report employment outcomes, a spokesperson told BT.

Until then, it's a sellers' market for cybersecurity professionals - who can take their pick of positions on offer, as niche and high-level talent is wooed through their pocketbooks.

Randstad noted in a report that tech professionals can get a pay bump of 20 per cent to 30 per cent when switching jobs, thanks to "scarcity and strong demand for tech talent".

And the voluntary attrition rate for professionals with information technology (IT) skills rose from 13 per cent in 2019 to 15 per cent last year, according to Aon's data on Singapore salary increases and turnover.

While these figures cover all IT technical skills, Mr Nippani noted, that clients reported "similar attrition within the cybersecurity talent".

The field is getting even more crowded, as cybersecurity roles are popping up well beyond security solutions providers like Ensign, which Ms Tham said is "on track" to meet its target of adding 200 workers this year.

Said Thales' Ms Wong: "We compete not only against established consulting companies. With cybersecurity cutting across all industries, we also face competition with other multinational corporations and startups."

That's even as demand for cybersecurity services rises on bad actors.

Singapore organisations saw an average of 3.3 cyber breaches a year, above the global average of 2.4 breaches, according to a VMware poll.

Similarly, a recent survey from global law firm Baker McKenzie found that 58 per cent of legal executives in Singapore cited cybersecurity issues as a top litigation risk - ahead of the global average of 45 percent.

Amid a hunger for skilled staff, the cybersecurity workforce in Singapore is growing by about 10 per cent to 30 per cent a year, according to industry estimates cited by Steven Wong, former president of the Association of Information Security Professionals.

GovTech reported an even bigger pace of expansion: Its Cyber Security Group has grown by more than 70 per cent in the last three years, to about 250 cybersecurity specialists now.

To be sure, it is impossible for the industry to rely on poaching in the long run. Ms Tham called it a "very unhealthy habit", while Dr Wong added that the practice "just plugs one hole by unplugging another".

But, as the CSA spokesperson noted: "Admittedly, the pool of cybersecurity professionals is already small to begin with. Given that the demand for these professionals is increasing... cybersecurity talents are undoubtedly spoilt for choice."