Why it is difficult to hire privacy experts: Finding a highly skilled privacy professional can feel like chasing a unicorn, Kazi describes. “Yes, privacy is important, but they want somebody who’s a lawyer, an expert in technology, knowledgeable about user interface and user experience, and ideally, they know a lot about ethics and are an AI expert as well. And yet, the position does not pay very much. That’s a serious challenge,” she says.Adding to the problem, 43% of organizations report their privacy budget is underfunded, and 48% expect budget cuts in 2025. A key issue is that many organizations conflate privacy with security, assuming that funding one automatically covers the other. Kazi warns against this misconception, especially when cybersecurity professionals are just as if not more burned out and understaffed.”Some organizations think, ‘Well, we’re funding security, and privacy is basically the same thing, right?’ And I think that’s really one of my big concerns,” she says.This blending of responsibilities is reflected in training practices, according to Kazi, who notes how many organizations combine security and privacy training, which isn’t inherently problematic, but it carries risks. “One of the questions we ask in our survey is, ‘Do you combine security training and privacy training?’ Some organizations say they do not necessarily see it as a bad thing, but you can “¦ be doing security, but you’re not doing privacy. And so that’s what’s highly concerning is that you can’t have privacy without security, but you could potentially do security well without considering privacy.”As Trovato emphasizes, “cybersecurity people tend to be from Mars and privacy people from Venus”, yet he also observes how privacy and cybersecurity professionals are often grouped together, adding to the confusion about what skills are truly needed. “The people having the discussion about privacy tend to be over here in the security space and so they just make confidentiality equal privacy, but of course that’s not privacy,” he says.”Privacy includes how are we using data, how are you collecting it, who are you sharing it with, how are you storing it, all of these are more subtle component pieces, and are you meeting the requirements of the customer, of the regulator, so it’s a much more outward business focus activity day-to-day versus we’ve got to secure everything and make sure it’s all protected.”
What CISOs need to know about hiring privacy talent: Even when companies find qualified privacy professionals, retaining them is another challenge. The ISACA report found that 63% of privacy professionals say their role is more stressful now than five years ago. Rapid technological evolution (63%), compliance challenges (61%), and resource shortages (59%) were cited as key stressors.Given these challenges, how can organizations successfully hire privacy professionals? Kazi suggests that companies need to take a more strategic approach.”What organizations need to do is figure out their biggest need with this privacy role. Do we need somebody who knows our applications really well? If that’s the case, there might be someone at your organization who has helped develop or acquire those, and perhaps you can provide them with on-the-job training and encourage them to obtain some privacy-related certifications,” she says. “That way, they have the technical expertise you’re looking for, and you can teach them the privacy aspect. This way, you’re not posting a job and potentially spending a long time trying to find the right person. I think looking internally can be really helpful.”Greater internal collaboration is also crucial, not just for improving privacy operations but for attracting and retaining talent. ISACA’s report found that only one-third of privacy professionals regularly work with product and business development teams.”Make sure that you are facilitating privacy by design as soon as possible,” advises Kazi. “If you’re embarking on a new initiative, invite someone from the privacy team to the kick-off meeting so they’re included. Ultimately, this ensures that privacy is better embedded into projects, and the privacy team’s work becomes much easier because they’re not coming in at the last minute saying, ‘We can’t do this’ or ‘We need to revise this’. Instead, their work is more integrated and aligned with other business objectives.”Trovato agrees, pointing out that there is an opportunity for privacy professionals to help build out what he dubs as the “operational aspects of privacy”. He says that privacy professionals should not just be seen as compliance enforcers but should be going beyond policies and frameworks to influence leadership, culture, and organizational resilience, and ensure privacy is integrated in both business processes and broader security efforts.
First seen on csoonline.com
Jump to article: www.csoonline.com/article/3839461/hiring-privacy-experts-is-tough-heres-why.html
