U.S. hospitals address cyber skills gap by growing talent in-house
ILLINOIS, UNITED STATES — United States hospitals are struggling to fill critical cybersecurity roles as healthcare becomes a prime target for hackers.
Giles Bruce of Becker’s Health IT writes that competition and budget concerns have compelled health systems to cultivate internal IT employees and mission-oriented candidates, rather than waiting for the ideal candidate with extensive experience to emerge in the rapidly evolving job market, which is becoming increasingly competitive and challenging for workers across all fields.
Internal training emerges as key to cyber resilience
With experienced cybersecurity professionals commanding salaries over $150,000—far beyond most hospitals’ budgets—health systems are increasingly cultivating their own talent.
Frank Sinatra, Vice President (VP) of IT and Chief Information Security Officer (CISO) of Newark’s University Hospital, transformed a programmer with no security background into his top threat analyst through intensive training. His team now automates alert vetting and patches critical flaws.
“When you’re looking for a security engineer, a threat hunter, an incident response person, it’s really hard to find that person with experience in healthcare,” Sinatra said and subsequently added, “These guys are generally working for third-party service providers and others, so we really have to develop our own talent,” emphasizing the move of cultivating a more skilled workforce of their own.
The strategy hinges on hiring for curiosity over credentials. Sinatra scrapped requirements for certifications and years of experience, instead seeking self-starters who learn continuously.
On the other hand, at Tower Health, VP of IT Insurance and CISO Terry Grogan promoted IT support staff into cybersecurity roles after coaching them through the Certified Information Systems Security Professional certification—a model that helps sidestep the industry’s talent gap.
“It was a matter of working on getting appropriate training and coaching seminars, just basically teaching them what they needed to know from the security side,” said Grogan.
Healthcare’s unique cybersecurity demands
Unlike finance or technology, healthcare cybersecurity requires navigating archaic systems—such as Windows 2003 servers—and 24/7 clinical operations.
Melissa Rappl, CISO of Children’s Nebraska, prioritizes recruiting individuals who understand the stakes of medicine, partnering with firms like CrowdStrike for real-world drills.
“Looking back, I’ve realized that our most effective strategy combines strategic hiring, solid operations, and a culture of ongoing learning,” she notes.
Outsiders often falter under healthcare’s technical debt and pace. MultiCare Health VP and CISO Jason Elrod points out it’s important to find enthusiasm in people saying, “Skills can be taught. What matters is mindset and mission alignment, especially when that mission is protecting patients and the health system.”
Her hybrid on-site model ensures IT-security collaboration, a non-negotiable requirement in life-or-death environments.
