A couple of weeks ago, roughly 36,000 security professionals descended on the Moscone Center in San Francisco for RSA Conference 2020, and the theme they chose this year caught my attention more than any keynote or product demo: “The Human Element.” RSA President Rohit Ghai opened the conference by arguing that the cybersecurity industry has spent years telling a technology-centered story where the right firewall, the right encryption algorithm, or the right threat detection platform would eventually solve the problem. That story, he said, has been fundamentally incomplete because it’s missing the human being at the center of it all.

Now, if you’ve been in IT for any length of time, you might read that and think it sounds like corporate keynote fluff, the kind of thing executives say on stage before the vendor booths open. But I think Ghai was onto something real, and I think it matters a lot more for your career than you might expect.

Why “The Human Element” Isn’t Just Marketing

Here’s the number that should get your attention: nearly 90% of successful cyberattacks involve some form of human interaction. Not a zero-day exploit or a sophisticated nation-state tool, but a person clicking a link they shouldn’t have clicked, reusing a password they were told to change months ago, or plugging in a USB drive they found in the parking lot. Seventy-five percent of companies worldwide reported being victims of phishing attacks in the past year, and 61% experienced some form of insider-related security incident. The pattern is overwhelming and consistent. It tells us that the biggest vulnerability in almost every organization isn’t a misconfigured server or an unpatched system. It’s the people.

This isn’t a new observation, but what made RSA 2020 feel different was the industry’s willingness to finally build its identity around it. For years, cybersecurity has marketed itself as a discipline for people who live in terminals, who think in packet captures and assembly code, who can reverse-engineer malware before their morning coffee. Those people absolutely exist and do critical work, but that image has done a disservice to the field by making security seem like it’s only for a very specific kind of technologist. The “Human Element” theme was, in many ways, the industry admitting that it needs a much broader range of people than it has been attracting.

What This Means If You’re Considering a Move Into Security

The workforce numbers paint a picture that should be encouraging for anyone thinking about a career shift. Cybersecurity Ventures is projecting 3.5 million unfilled cybersecurity positions globally by 2021, and the Bureau of Labor Statistics has information security analyst roles growing at 32% through 2028, which is wildly faster than virtually any other occupation they track. Cloud security has emerged as the single most sought-after skill area, with 40% of organizations actively planning to hire for it over the next two years.

But here’s the part that often gets buried in the headline numbers: 30% of the people currently working in cybersecurity came from non-IT backgrounds entirely, and 78% hold only a bachelor’s degree. The field is not some walled garden that requires a master’s in computer science and ten years of SOC experience to enter. It’s a discipline that desperately needs people who can think critically, communicate clearly, and understand how organizations actually function, because those are the skills that address the human element the industry just spent a week talking about in San Francisco.

I wrote recently about my own experience shifting from managing IT teams into an information security role, and one of the things that surprised me most was how much of the work isn’t technical in the way people assume. Yes, you need to understand the fundamentals of networking, systems, and threats, and you need to be able to hold your own in a conversation about vulnerabilities and controls. But a huge portion of the job, the part that organizations are most desperate to fill, involves building security awareness programs, writing policies that people actually follow, designing training that changes behavior rather than just checking a compliance box, and communicating risk to executives who don’t speak in CVSS scores. Regular security awareness training alone has been shown to reduce phishing incidents by up to 70%, which means the person who can design and deliver that training effectively is arguably more valuable than the person who can write a custom detection rule.

The Certification Question

If you’re looking at cybersecurity from the outside and wondering where to start, certifications are probably on your mind, and it can feel overwhelming to sort through the options. My advice is to keep it simple at first. CompTIA Security+ remains the most widely recognized entry-level security certification, and it does a good job of establishing that you understand the vocabulary and core concepts of the field. It won’t make you a security engineer overnight, but it gives hiring managers a clear signal that you’ve invested real time in learning the fundamentals. In a market this hungry for talent, that signal matters more than you might think.

Beyond Security+, the direction you go depends on where your interests and existing skills align. If you’re coming from a systems or cloud background, certifications like AWS Certified Security Specialty or the Azure Security Engineer Associate can position you directly in that high-demand cloud security space. If you’re more drawn to the governance, risk, and compliance side of things, which is closely related to the “human element” work I’ve been describing, the CISSP or CISM certifications carry significant weight, though they typically require a few years of experience before you’re eligible. I covered the certification landscape more broadly in an earlier post that’s worth reading if you’re still sorting out what makes sense for you.

The key insight from RSA’s theme, though, is that certifications alone aren’t what the industry is asking for. They’re asking for people who can bridge the gap between technical security controls and the humans who have to live with them every day. That means your communication skills, your ability to write clearly and present to non-technical audiences, your experience managing projects or leading teams, all of that is directly applicable in ways the cybersecurity job descriptions don’t always make obvious.

The Entry-Level Paradox (And Why the Shortage Works in Your Favor)

I won’t pretend that breaking into cybersecurity is easy. There’s a well-documented paradox where employers post “entry-level” positions that require three to five years of experience, which is frustrating and, frankly, a failure of hiring practices across the industry. But the sheer scale of the talent shortage is starting to force a correction. When 3.5 million positions sit unfilled and 73% of companies report struggling to find qualified candidates, the organizations that insist on five years of experience for a junior analyst role are the ones that end up with nobody at all. More companies are starting to recognize that they need to hire for aptitude and train for skill, which is exactly what the “Human Element” theme is pointing toward.

This is where the pro-worker angle matters. If you’re an IT professional with a solid foundation in systems, networking, or helpdesk work, you already have more relevant experience than you probably realize. You’ve troubleshot problems under pressure, communicated with frustrated users, documented processes, and navigated organizational politics to get things done. Those are security skills, even if nobody ever called them that. The industry spent a week in San Francisco acknowledging that it needs exactly those capabilities, and the workforce data shows it needs them badly enough to meet people halfway on the traditional credentials.

Bringing It Back to the Human

I came out of RSA week feeling something I haven’t felt in a while about the security industry: a genuine sense of optimism about its direction. For a long time, cybersecurity conferences felt like places where vendors competed to see who could make the most alarming threat predictions, and the career messaging was always about scarcity, urgency, and the terrifying sophistication of the adversary. The “Human Element” theme was a different kind of message. It was the industry saying, in a surprisingly honest way, that the problem isn’t just out there in threats we’re trying to detect; it’s in here, in how we train our people, build our cultures, and communicate about risk.

And if the problem is fundamentally human, then the solution has to be human too. That’s good news for anyone who brings more to the table than just technical skills, and it’s especially good news for IT professionals who have spent years building exactly the kind of people-centered expertise that the cybersecurity field is finally ready to value. The door is open wider than it’s been in a long time, and if you’ve been thinking about walking through it, the industry just told you that what you bring is exactly what it needs.