I often hear from IT executives that it is hard to recruit and retain "good security people." Many lament the shortage of skills in this area and cannot reconcile the skills offered with the positions that need to be filled. Is there really a shortage of good security people? Or just a mismatch in the skills and the jobs?

We've spent a few recent editions of this column looking at security from an operational perspective and a risk-management perspective. From that perspective, there are two types of security skills that might be needed in a company: tactical security operations and strategic risk management. Unfortunately, many companies don't do a good job of separating the two and end up asking people to do both. The two skill sets are rarely found in one person. Worse, asking someone with a strategic risk mind-set to do operational security, or vice versa, often leads to job dissatisfaction and eventually resignation.

Operational security requires attention to details, a methodical and meticulous work ethic, and an ability to process large amounts of information. In a network or security operations center (NOC/SOC), operators are presented enormous amounts of data and need to be able to quickly discover the root cause of any alarm or event, and make efficient and effective decisions reactively. Contrast that type of work with the strategic risk-management work. A security professional who is responsible for managing risk will have to think strategically; look at the big picture; present difficult choices to a management team; and balance conflicting requirements, conflicting turfs and priorities while advancing the interests of the whole company.

The personalities required for these jobs are radically different, yet people are still surprised when someone quits after trying and failing to fulfill both jobs at the same time. Not only is this difference in roles important for hiring and retention, it is also important to keep in mind when deciding on a managed security service. When deciding to outsource part of security, companies are increasingly doing so primarily because of a lack of skills rather than to reduce cost.

Before outsourcing security functions you have to consider what type of people you currently have and how you can best use them? If you excel at operations, then outsourcing the SOC might be a bad idea. If you excel at risk management and want to "free" your security experts from the operational role they grudgingly fill, outsourcing could give you a way to refocus and re-energize your internal team.

There might be a shortage of security skills, but I think there's a much bigger problem of mismatched skills and jobs. Understanding the strengths of your current team will allow you to apply their skills better, but also make them happier and less likely to leave.