— Cybersecurity professionals are in short supply.

Even in cyber-rich San Diego — where the U.S. Navy has its information technology command — there are challenges to filling jobs, local executives said.

The region has about 7,500 cybersecurity jobs, and half are with the Navy command called SPAWAR, said Ken Slaght, co-chair and president of the Cyber Center of Excellence, a San Diego industry group.

San Diego tends to play “second fiddle” to regions such as the Bay Area and greater Washington, D.C., the home of the National Security Agency, Slaght said.

“We do find that many candidates don’t have the cybersecurity background that we prefer, but it doesn’t mean some skills can’t be learned,” said Anna Keeve, a spokeswoman for ESET. The international company, which offers IT security software and services, has its North American headquarters downtown.

High Learning Curve

Cybersecurity is a highly technical industry with high learning curve, Keeve said, adding that the topic of a cybersecurity “skills gap” always makes its way into conversations during industry conferences.

There are 4,200 cybersecurity jobs available in San Diego County and 31,700 available in California as a whole, according to the Cyberseek.org website. The Washington, D.C., metro area beats out all of California, with 41,700 jobs available. The Cyberseek site, which features maps showing the greatest need for cybersecurity professionals, is a combined project of the U.S. government and the private sector.

Frost & Sullivan reported in June that globally, there will be shortage of 1.8 million cyber workers by 2020.

A worker with a CISSP certificate (that’s certified information systems security professional) coupled with some real-world experience has some real value in the market, said Jason Galetti, president of Sentek Global, whose primary client is the military.

A mid-level CISSP certificate-holder can command $90,000 a year or up, the Sentek representative said. Cybersecurity is very certificate driven, said Sarah Burns, director of research and evaluation at the San Diego Workforce Partnership.

Sentek has about 100 employees in San Diego (including 80 at SPAWAR’s Old Town campus), and about 180 in total. Obviously seeing potential in the federal market, Sentek opened an office this year in Tysons Corner, Virginia, near Washington, D.C. SPAWAR is short for Space and Naval Warfare Systems Command.

With a very low unemployment rate in San Diego, and even less unemployment among cyber professionals, employers can have a hard time staffing jobs in Southern California, according to Galetti and Scott Handley, who handles recruiting for Sentek.

Texas Vs. California

California can be a tough place to hire, said Galetti, with its cost of living, state income tax and real estate prices. He said that potential employees getting out of the Navy, and perhaps starting a family at the same time, are likely to take offers in lower-cost areas, such as Texas.

Cybersecurity firm Forcepoint employs 175 people in San Diego (its local office was once the headquarters for a publicly traded company called Websense, which was acquired and moved to Texas). Employees at the Sorrento Valley office focus on developing web, email and cloud security products.

Forcepoint has offices in 50 cities and the cost of living in San Diego is really no different from other major metropolitan areas around the world, said Kristin Machacek Leary, the company’s chief human resources officer.

Recruiting Veterans

As an MSSP (or managed security services provider), Carlsbad-based Proficio offers outsourced cybersecurity services to mid-sized and large companies (Fortune 100 firms can afford their own cybersecurity in-house). CEO Brad Taylor said his company has good luck in hiring and training veterans. The business is planning the first of what it hopes are several evening “boot camps”: four-hour sessions to familiarize veterans leaving the service with opportunities in the civilian world.

Veterans have the appropriate mindset for cybersecurity, Taylor said: they want to fight the good fight, look for bad guys, confirm they are indeed the bad guys and call in an airstrike.

Proficio moved from Irvine to Carlsbad to get better access to talent, Taylor said. It recently outgrew its first Carlsbad building.

Webroot Chief Technology Officer Hal Lonas said his company is at 75 employees and has enough room on the floor of its University City high-rise for 100. He estimated the company will fill that space by the end of the year.

Lonas said his company recruits by offering internships to students at UC San Diego’s Jacobs School of Engineering and San Diego State University. An occasional, 12-hour “hackathon” event brings in students who know code. During that time Webroot gauges their interest in an internship or work.

“We really like the San Diego talent pool,” Lonas said.

Need for Pipeline

More employers need to open their doors for internships, said Peter Callstrom, CEO of the San Diego Workforce Partnerships, adding that the community needs to create a pipeline of cybersecurity workers.

Webroot provides cybersecurity for small and medium-sized businesses — entities not massive enough to be called enterprises.

Slaght that in 2018, said his industry group will try to get cybersecurity employers to warm up to the idea of providing apprenticeships for students who may not have the desired four-year degree and five years’ experience. SPAWAR is getting more receptive to apprenticeships, Slaght said. (As a Navy rear admiral, Slaght commanded SPAWAR prior to his retirement from the military).

As for the students who are beckoned by more money in the San Francisco Bay Area or Washington, D.C.? Slaght invited students to do the math on how much their greater salary will actually buy in San Francisco. And he offered an airline ticket to the nation’s capital during a January ice storm, so students can get a taste of the commute to work.