As a kid, Catherine Stamm was always interested in police work and criminal forensics, until she realized she couldn’t stomach “the whole blood thing.” But as a high school student in North Babylon, N.Y., she also loved messing around with computers. So she decided to attend Champlain College and pursue a degree in computer and digital forensics, which doesn’t involve messy crime scenes.
After Stamm graduates from Champlain this month, she’ll start a job with Kivu Consulting, a small, San Francisco-based firm that does digital forensics and computer investigations. Stamm began interviewing for jobs back in November and was courted by several different firms before accepting Kivu’s offer in February. The 22-year-old’s starting salary: about $60,000 a year, she says.
Jacob Berry, a 21-year-old senior at Norwich University, also had a job in hand for most of the spring semester. When he graduates next week, with a bachelor’s degree in computer security and information assurance, he’ll go to work as a security analyst for the Center for Internet Security, a federally funded research and information center in Albany, N.Y.
Berry, who’s from Ossipee, N.H., got his first job offer at the beginning of his senior year and was pursued by at least four different potential employers. They included his professor and mentor at Norwich, Peter Stephenson, who’s also Norwich’s chief information security officer and director of the Center for Advanced Computing and Digital Forensics.
In January, Berry chose the Albany job, which offered him more than $70,000 a year. “I just couldn’t top that,” says Stephenson with a sigh.
Never mind the talk about graduating seniors facing the toughest job market in decades; that is certainly not the case for students getting degrees in cybersecurity. That umbrella term covers a broad range of disciplines involved in protecting computers, mobile devices, websites, databases and networks from theft, vandalism, attack and other unauthorized access — as well as investigating those intrusions after they occur.
Last week, after an Associated Press Twitter account got hacked with a fake tweet about an explosion at the White House, the Dow instantly plunged 143 points before recovering. While the damage was short lived, the incident highlighted the ever-growing threats in the online environment — and the need for digital defenders adept at fending them off.
As Stephenson explains, companies, government agencies and institutions like his face a major problem in finding good candidates to work in cybersecurity. How severe is the shortage of qualified applicants? Nationwide, job vacancies now “number in the thousands,” he says. As a result, Stephenson’s students can virtually write their own ticket upon graduation, pursuing lucrative careers in law enforcement, private consulting, defense or national intelligence.
“I have never had a year since I’ve been here when all of my seniors weren’t employed or considering job offers well before the end of the first semester,” says Stephenson, who’s been at Norwich since 2004.
And it’s not just seniors who are being aggressively recruited. Meg Rioux, a 21-year-old junior at Norwich from Jefferson, Mass., is majoring in computer security and information assurance with a concentration in digital forensics.
Rioux, who’s attending Norwich on a full scholarship from the National Science Foundation, landed an internship this summer at the Center for Internet Security in Albany — and didn’t even have to interview for it. She says she’ll likely go work there after she graduates next year but if not, “I know the FBI in Albany is also recruiting.”
Rioux’s experience in the job market differs markedly from those of her friends and classmates in other professions.
“It’s like night and day,” she says. “One of my friends is a graphic-design major and is freakishly talented. She’s having such a hard time even getting an internship.” Rioux’s cousin, who’s studying engineering at Norwich and has a grade point average “well above 3.5,” she says, has barely gotten a nibble, either.
Cybersecurity majors from Norwich aren’t the only highly desirable grads in the job market. Jonathan Rajewski is an assistant professor of digital forensics and director of Champlain College’s Leahy Center for Digital Investigation. The students he teaches are now so highly sought after that many are being recruited while still in their junior year, and sometimes even earlier.
“It’s pretty crazy,” Rajewski says. Earlier this year, three companies visited Champlain to interview his students, including Dell SecureWorks, a security division of the global computing giant. That company hired five of his students “on the spot,” he says. Another firm, defense contractor ManTech International, extended an offer to one of his sophomores — contingent upon his graduation, of course.
As Rajewski explains, his program’s national profile got a major boost in February when SC Magazine, an industry trade publication for IT security professionals, named Champlain’s digital forensics program the best cybersecurity higher education program in the United States.
The day after Champlain got the award, Rajewski says, he got a call from the former chief scientist at Lockheed Martin, whose son is interested in entering the field: “He asked me, ‘Who are you guys? I’d never even heard of Champlain before.’”
Today, Champlain and Norwich stand toe-to-toe with some of the top cybersecurity institutions in the country. Neither Stephenson nor Rajewski considers their schools competitors, but the programs do have many similarities. Both are small private schools in Vermont that have earned national reputations in the cybersecurity field with help, in part, from Sen. Patrick Leahy and the major financial resources he’s secured for them.
And both schools, unlike cybersecurity programs at other colleges and universities around the country, also offer their students hands-on experience in working on actual criminal cases.
Notably, Stephenson is a member of the nationally renowned Vidocq Society. An elite crime-solving organization composed of dozens of forensic experts and retired law-enforcement workers from around the world, the society meets monthly in Philadelphia to work on cold-case homicides and other unexplained deaths.
As Stephenson explains, his work at the Vidocq Society has become a “feeder” for cases for his students to work on. One, an active investigation about which he can’t reveal many details, involves a 19-year-old girl who was killed by a double shotgun blast to her head.
“This young lady lived in cyberspace,” Stephenson explains about the victim’s obsession with computers. “I now have 80 students … all working on this case. It’s their semester project.”
Champlain College also offers its computer and digital forensics students an opportunity to work on actual criminal cases, including investigations for the Vermont State Police and the Vermont Internet Crimes Against Children Task Force. Rajewski notes that the Leahy Center for Digital Investigation is also assisting several “local large corporations and governmental entities” with their cybersecurity efforts — though he’s not at liberty to identify which ones.
What distinguishes the two programs? Generally speaking, Champlain is more inclined to groom its digital forensics students for jobs in law enforcement and the private sector. Norwich, the nation’s oldest private military college, tends to funnel its cyber-grads into careers in the military, defense contracting and the intelligence community. (That said, both Berry and Rioux are pursuing careers in the civilian sector.)
Another thing Champlain and Norwich have in common: Both programs have become highly selective in the students they accept. What are they looking for in applicants?
Stephenson says he looks for many of the obvious skills needed in computer work: strong math skills, especially calculus or pre-calculus, as well as computer programming experience. He points out that when Rioux arrived at Norwich, she already had experience programming in five computer languages.
Stephenson also takes a serious look at computer gamers. Why?
“Gamers have an analytical way of looking at something. They’re problem solvers,” he says, adding that gamers also tend to look for “the elegant way of doing things” but always keep in mind that time counts. “If we can refine that, we end up with someone who is quick on their feet, creative, accurate and technical,” Stephenson adds.
“It’s a given that they’re likely to be geeks, but that’s OK,” he adds. “We’ll socialize them over the fours years they’re here.”
Stephenson also looks for applicants with good English scores, largely because “people in our field are notoriously bad writers. They can’t be, because they’ll be expected to write very detailed, unambiguous reports.”
The Norwich prof has made a concerted effort to seek out qualified female candidates, and not only because the field is still predominantly male. He says that women and men solve problems very differently.
In Stephenson’s experience, the best scenario is to have both men and women on the same team, because they have a higher probability of solving an assigned problem, they get their work done faster, and their answers are more complete, concise and creative.
As for the kinds of students who go into this field, Berry says he fits the classic mold: He was a gamer in high school and, as a kid, loved to tinker with things, taking them apart and putting them back together again. That skill set, Berry suggests, could be applied to the nondigital world when trying to solve problems such as war and world hunger. “Essentially,” he says, “it’s about looking at how things work, understanding why it works that way and figuring out whether it can work differently.”