Keywords

1 Introduction

Today’s digital work environments require that organizations increase their cyber resilience [1, 2], which calls for organizational solutions to find skilled cybersecurity professionals [3]. As there is a high need for Information Technology (IT) professionals [4], and efficient solutions and procedures that secure digital technologies [5].

Some recent studies have worked to deepen the understanding of cybersecurity skills by e.g., building skills frameworks, taxonomies and certification systems that support the design of trainings that are based on work-life needs [6,7,8,9].

There have been one of several research, development, and innovation (RDI) initiatives on cybersecurity on the European level, such as the European Commission funded project ECHO (European Network of Cybersecurity Centres for Innovation and Operations) that has, as part of its total effort, developed an E-skills and Training Toolkit. Project ECHO that consists of 30 partners from different sectors (e.g., health, transport, telecom, energy, space, healthcare, defense, civil protection, manufacturing, ICT, education, and research) promotes a European-wide network with methods, and assets that promote information sharing among network partners, with regards to regulatory requirements, [10, 11].

This study serves as part of the prior background research that has made public in academic papers published in relation to ECHO research activities that brings academia, industry, cybersecurity practitioners and end-users together [12]. The skills that have been identified in this study were used as base skills to develop the E-skills and Training Toolkit, where these base skills can be used to identify relevant e-skills and to measure related training and recruitment needs and gaps that may be used to increase organisational cybersecurity.

This paper serves as a potential case study of European recruitment advertisements to deepen understanding of skills acquisition and training in relation to the societal impacts of project ECHO. The skills from the recruitment advertisements analysed in this study were used to create long lists of technical, situation awareness and problem-solving skills that serve as basis in the ECHO E-skills and Training Toolkit.

The research questions of this study are:

  • What Technical skills are asked for in European recruitment advertisements?

  • What Situation awareness skills are asked for in European recruitment advertisements?

  • What Problem-solving skills are asked for in European recruitment advertisements?

2 Literature

Cybersecurity is seen as a multi-disciplinary domain, as it joins elements from mathematics, psychology, engineering, law and computer science, business continuity and other disciplines [3]. Cyberattacks may have varying and serious consequences, and this calls for new techniques to improve organizational resilience in the cyber domain [1, 2], as emerging new technologies radically change the relationships between human and cyber dimensions in many organizations [13].

2.1 Organizational Learning

Knowledge generation and information processing can promote productivity and competitiveness, where ICT acts as a catalyst to increase organizational learning [14], and as ICT has brought new opportunities even for companies with limited resources, to develop skills that enable absorbing state-of-the-art knowledge from external sources [15]. ICT-infrastructures support knowledge sharing in organizations [16], though lack of competences and skills to use ICT can hinder learning to use organizational ICT-tools [17].

Modern participative of ICT and mobile technologies promote the creation of new learning experiences in learning organizations [18]. ICT offers opportunities for strategic learning [19], where even the survival of businesses may depend on its capabilities to implement new ICT solutions and take advantage of the opportunities that they can offer [20].

The perception of ease of usage, and other social factors, influence the acceptance of ICT and mobile technologies in organizations, which directly influences the usage of mobile learning, where mobile devices with graphics and visual applications make them more accessible, which helps learn and renew learning [21]. ICT makes it easier to store and share organizational knowledge [16], and blended learning can improve organizational training and learning performances, and trainee satisfaction [22]. Knowing how to use ICT tools and Knowledge Management (KM) technologies can promote knowledge sharing and transfer within and outside the organization [23].

The level of organizational ICT support influences how motivated organization members are to share knowledge. ICT support eliminates hindrances and provides channels to obtain information [24], and organizations should consider KM when selecting and implementing ICT solutions [25].

2.2 Skills Acquisition

The field of cybersecurity has been under rapid development, and this has challenged the understanding what skills make good cyber experts, and where and how these professionals can become recruited by organizations [3]. Investments in ICT-support and training develop higher competencies in ICT-tools usage [26]. To achieve preparedness and resilience, acquiring cybersecurity skills needs continuous advancement with learning processes that address complex demands of building individual and organizational level capacities with relevant trainings and exercises [27].

Modern ITC tools make it relatively easy to the master the needed technical skills, so the main trait for modern cybersecurity specialists now is flexibility [28], so a promising new source to recruit future cybersecurity experts are people with an aptitude to acquire the new skills that make them likely to succeed in a cybersecurity career [29]. Cybersecurity experts may be recruited from today’s IT professionals who can learn the skills needed to solve different cybersecurity issues and have capabilities for continuous learning and skills improvement [30]. Cybersecurity professionals could be recruited from occupations such as electrical, electronics, telecommunications and equipment installers and repairers, geographers, purchasing, sociologists or financial and budget analysts [29].

2.3 Cybersecurity Skills

The cybersecurity domain emphasizes technical and engineering skills [31], though social and organizational aspects are very much needed to successfully perform in everyday digital work-life settings [3].

Besides knowledge and skills of using computer systems, cyber professionals need to be able to use analytical tools, vulnerability analysis, and network scanning [3], but they also need strong skills for situational awareness with continuous risk assessment [32] to successfully maintain security. Problem-solving, communication and collaboration are important non-technical knowledge skills and abilities (KSA) in cybersecurity [33].

Organisational learning can be promoted with ICT technologies, which in turn can have significant impacts in building innovative culture that helps establish competitive advantages [34]. Though ICT does not automatically enhance learning, it can be a means to facilitate skills acquisition, learning and teaching [35], and organizations have to integrate ITC into all of its functions organizational innovation culture, learning, strategy and policies, to have the potential to influence its organizational performance and competitiveness [36].

3 Method

Quantitative research seeks to demonstrate cause-and-effect relationships numerically, most often using statistical methods. Quantitative research describes and interprets phenomena according to the general logic of science [37, 38]. In a quantitative study, such as this study, classification is often used due to the large amount of source material [39] and quantitative findings can be collected for case studies [40, 41]. The basic concepts of quantitative research are the statistical unit and the sample, and the accumulated data are described using scales.

In this case study of the Finnish labour market analysis the most desired e-skills that employers want from their future employees were conducted. To identify relevant skills that are required on the Finnish job market, recruitment advertisements from the web service Monster were collected during the summer of 2021. The sample covered advertisements from the energy, healthcare, and maritime transport sectors, while noting its technology level as cybersecurity, IT professional or information intensive work. The total number of ads analysed were 178. The data collected were stored in a data extraction table (DET) from which more detailed tables were created on separate spreadsheets for each skill category. The DET was specifically designed for this study. It was used to first store data from job postings, and to then to further analyse the collected data by identifying relevant skills and then classifying them into four categories of e-skills: technical, problem-solving, sector-specific, and situational awareness skills.

The columns, presented in Tables 1 and 2, of the DET note the advertisement, its job posting, company, technical level, and sector, which are maritime, healthcare, and energy. Job advertisements that were not clearly in any of the above mentioned three sectors were classified as Other.

Table 1. Data extraction table columns.
Full size table

The Technical level column identified if the company was looking for a cybersecurity specialist, IT professional or a person for information intensive work that is based on constant usage of IT solutions. The three sector columns were further divided in sub-columns that are shown in the table below.

Table 2. Data extraction table sub-columns.
Full size table

Each sector specific advertisement, maritime, healthcare and energy were further divided in sub-categories as Manager and Specialist. A manager-level person has subordinates and works on a strategic level. Specialists have expert positions where they work in on a tactical level without subordinates.

4 Results

The results of this study are based on a sample (n = 178) of Finnish job advertisements collected in the summer of 2021. This section looks at the job advertisements both by sector and level of expertise. And then discusses the relevant skills categories of Technical, Situation awareness, Problem-solving, and Sector specific e-skills.

4.1 Job Ads by Sector and Level of Expertise

Of the total sample 123 job advertisements were on the level of Specialist. Figure 1 below shows the distribution of results in relation to Manager or Specialist on each sector. Of the sample of job advertisements, the largest sectors were Energy (n = 55) and Healthcare (n = 38), while there were significantly few on the Maritime sector (n = 9). However, the Other sector had 76 advertisements, and most of these (n = 66) were on the Specialist level. This is over half of all Specialist level jobs advertised.

Fig. 1.
figure 1

Results in relation to sector and Manager or Specialist.

Full size image

The categories of Manager and Specialist level jobs were examined against the technical expertise (Cybersecurity, IT Sector, Information intensive). Figure 2 shows, how in the sample, IT sector professionals (n = 96) were the most sought-after workforce, and the advertisements were quite evenly distributed between Specialist (n = 54) and Manager (n = 42). Cybersecurity positions (n = 70) were mostly on the Specialist (n = 59) level. There were relatively few advertisements (n = 12) for information intensive positions in this sample.

Fig. 2.
figure 2

Manager and Specialist examined against technical level. (Color figure online)

Full size image

Figure 2 also shows how the technical expertise of Cybersecurity on a Tactical/Specialist level on the Other sector were most sought after (n = 51) in the sample. The sectors that are relevant to project ECHO are seen in blue (Maritime), orange (Healthcare), and grey (Energy). The Energy sector was looking for both Specialists (n = 21) and Managers (n = 24) with IT sector technical expertise. The Healthcare sector was also mainly looking IT sector technical expertise on a Specialist (n = 14) and Manager (n = 18) level. The Maritime sector focused on Expert level IT sector technical expertise.

4.2 Technical E-Skills

Technical skills were listed in the sample job advertisements. The sample yielded a long list of 199 technical skills, abilities, or experience that the job market was asking for. In this context they are referred to as Technical e-skills. To make better sense of these and to enable practical choices, they were classified into 18 categories (Fig. 3).

Fig. 3.
figure 3

Technical e-skills.

Full size image

As seen in Fig. 3, the largest categories of Technical e-skills were programming (n = 40), information solutions (n = 24), security issues (n = 25), and software (SW) (n = 18). Also, security, cloud, network, and automation related skills were well sought-after. The fewest mentions were of usability (n = 1) and development (n = 1), while solutions, hardware, databases, configuration, methods, architecture, and legal were each mentioned under five times.

4.3 Situation Awareness E-Skill

Situational awareness skills, abilities and knowledge were visible in 26 of the sample of job applications. In this context they are referred to as Situation awareness e-skills. Situation awareness e-skills were consolidated into seven categories (Fig. 4). Though there was quite an even distribution between the categories there were only 10 mentions of them, four of which were only mentioned once. Work under pressure, Security framework and tools, and Critical configurations had two mentions each.

Fig. 4.
figure 4

Situation awareness skills.

Full size image

As seen in Fig. 4, experience in cybersecurity seems to be seen as being the single most important Situation awareness e-skill. However, it is noteworthy that the relatively low number of mentions (n = 10) of Situation awareness e-skills would indicate that these are not sought-after. Recruiting organizations may not themselves be aware of the importance of building situation awareness, or they see that an adequate level of technical e-skills (n = 199) be enough to also cover this aspect.

4.4 Problem-Solving E-Skills

The sample of advertisements yielded 107 problem solving related skills, abilities, or knowledge that the Finnish job market required. In this context they are referred to as Problem solving e-skills. These were first unified into 24 categories of Problem solving, which were then re-worked into the 15 categories of e-skills that are listed in Fig. 5.

Fig. 5.
figure 5

Problem-solving skills.

Full size image

As seen in Fig. 5, Communication (n = 21), Networking and Interaction (n = 17), Collaboration (n = 15), and Teamwork (n = 10) come to the forefront. It seems that recruiting organizations see these communication and collaboration related skills as being core to problem-solving. The term ‘Problem-solving’ was directly mentioned in seven advertisements. There were 8 categories of Problem-solving e-skills that were mentioned only between one and three times This could connote that problem-solving related are recognized as being important but, besides communication and collaboration related skills, they are less generalized.

4.5 Business Administration E-Skills

The relevant skills, abilities, or knowledge that were not deemed as Technical, Situation awareness or Problem-solving e-skills were classified as being Sector specific. These became classified in 12 categories. After this categorization the decision was made to re-name these as Business administration e-skills (Fig. 6).

Fig. 6.
figure 6

Sector specific/Business administration skills.

Full size image

Of the Business administration e-skills Customer oriented (n = 24) and management (n = 20) were the most common skills in the sample of job postings. Project management (n = 13) and business orientated (n = 12) were also common skills that were sought-after in this sample of Finnish job advertisements. Interestingly planning was only mentioned once. Data protection and privacy (n = 2) and organizational skills (n = 3) also had relatively few mentions.

5 Conclusions

Since the sample only included one summer period, further research is recommended to better understand what e-skills are valuable for the recruiting organizations. Also, this study is only limited to one job market (Finland). It is recommended that similar data be gathered also from other EU and relevant non-EU countries. This research should be periodically duplicated, if not done in real-time by using Big Data, AI and other modern possibilities. Organizations in this sample were most actively looking for Technical e-skills and Problem-solving e-skills.

The most sought after Technical e-skills were programming, software (SW) and information technology (IT). This could indicate that not only recruitment, but also education and training should put strong foci on these e-skills. Overall, it seemed to be quite to the recruiting organizations what Technical e-skills they are after. Periodically duplicated studies on different markets could contribute to theory by adding to the overall body of knowledge. On a practical level it could help focus organizations recruitment and training efforts and provide education and training providers with an on-time understanding of what is needed on the modern job markets across Europe.

Although, situational awareness (SA) is particularly important according to literature, there were surprisingly few job advertisements that indicate this. Apparently, Situation awareness e-skills are something that the recruiting organizations are not focusing on. Situation awareness e-skills were surprisingly evenly distributed across the categories and many of them were only mentioned once. Further study can add to our understanding of this issue and indicate if more active focus should be put on identifying what e-skills promote better situation awareness. It would seem that situation awareness is needed to first detect cyber problems and then help make informed decisions when problem solving possible cyber-attacks or events.

According to the results, the most important Problem-solving e-skills are communication, interaction, and collaboration related. Being able to collaborate with other people seems to be most important in relation to solving problems. The importance of problem solving is recognized as important but, besides communication and collaboration related skills, they seem are less generalizable. More study is recommended to better understand what Problem-solving e-skills are important and how they may relate to both Technical and Situation awareness e-skills.

Business administration e-skills seemed to be less driven by the selected ECHO-sectors of energy, healthcare and maritime than expected. Business administration e-skills seem more general in nature, with focus on business and customer orientation and both management and project management and seem to be common for jobs in any specific sector.

Organizations use many terms to describe some of the same e-skills (skills, knowledge, and abilities), or they use the same terminology to describe the same e-skills. Consolidating these into categories is not an easy task, and this will need further work and study. Further work is recommended to build relevant measures for Technical, Situation awareness and Problem-solving e-skills. Such measures could provide very practical contribution for organizations in recruitment, education and training, as well as organizational leaning and development. These measures could contribute to science if used to cumulate larger sets of data that can be analyzed to deepen our understanding of e-skills and the changes in e-skills needs.