Few have a longer or more varied experience of cyber security than Professor Norbert Pohlmann.
In the 1980s, when cyber-security was still an emerging field, he was working on his doctoral thesis, “Possibilities and Limitations of Firewall Systems.”
He founded his own company, KryptoKom, and spent 15 years as a successful entrepreneur before entering academia. He now heads the Institute for Internet Security at the Westphalia University of Applied Sciences Gelsenkirchen in western Germany.
In cybersecurity, he recognises that the demand is often for young, relatively recent graduates – like those he trains at the university.
“We have a master’s course in Internet security. We started this course maybe eight years ago, 10 years ago or 10 years ago. Now all the young guys coming from university today have a lot of experience. They have lectures in cyber-security. We teach them what’s really needed,” says the 58-year-old.
“The older guys who studied maybe 10-20 years ago, they haven’t enjoyed all these courses. You could say that’s a problem. Not every older guy has the opportunity to have additional courses outside the university.”
So, is cybersecurity a young person’s field?
Certainly, the tech sector as a whole is often seen as being one where opportunities narrow as people age; there have even been stories of workers having plastic surgery to retain a fresh-faced look.
The Vancouver-based business analytics company Visier looked at the subject for a 2017 report, “The Truth About Ageism in the Tech Industry.”
Based on 330,000 anonymous employee records, the study reported that the average tech worker is aged 38, five years younger than the average non-tech worker.
Millennials – those born from around the early 1980s onwards – make up 42.6 percent of the tech workforce, compared to just 26.1 percent outside tech. Meanwhile, people born between around the mid-1940s to the mid-1960s, or baby boomers, account for a mere 11.7 percent of the tech sector but 26.7 percent of the non-tech workforce.
The report found that there appears to be discrimination in the hiring of workers, with millennials hired ahead of members of Generation X (those born between 1965 and 1980) at a higher rate than in non-tech.
“There’s different criteria that could drive it. One could be that younger workers are less expensive, so if you’re looking at your overall workforce composition and you’re trying to hit certain cost targets, you might want to have a larger proportion of younger workers,” explains Josie Sutcliffe, Visier’s vice president for marketing, who was heavily involved in producing the report.
But the preference for younger workers may be about more than keeping down the remuneration bill. There is, according to Sutcliffe, a conscious or unconscious bias that youth is associated with innovation or risk-taking, seen as ideal attributes in many tech environments.
“One of the [positives] of younger workers is that they haven’t learnt what doesn’t work, so they may be more likely to try things out and trust things than older workers,” she says.
Research by European academics has identified similar biases. When looking at ageism in IT, Dr Ricardo Twumasi, a lecturer at The University of Manchester in the United Kingdom, has found that many areas of the sector are “considered to be a young person’s field”.
“Innovation was expected to come from the young rather then the more experienced workers,” says Twumasi, who is part of the university’s Alliance Manchester Business School.
Many of the negative stereotypes around older people that hold them back career-wise – being seen as unable to learn new things, less productive, more likely to take time off sick, at greater risk of retiring and leaving the organisation, and overqualified – are, Twumasi says, inaccurate. They are often based on “limited and faulty logic”.
“Therefore, these stereotypes and the biases that lead to them need to be challenged,” he explains.
As long as age biases exist in tech, though, older workers are advised to consider how they market themselves.
“If you’re an older candidate, you might want to come equipped to show examples where you’re showing that kind of innovation and pushing the envelope [often associated with younger workers],” says Sutcliffe.
Despite the negative stereotypes, employment prospects for mature IT workers are not overwhelmingly bleak.
Although Visier identified a bias against the hiring of older people in tech, it also found that salary prospects as employees age are not worse than in non-tech. Also, when people are taken on in tech as older workers, companies do not use their age as a reason to pay them less. In addition, resignation rates among older workers in the technology sector are not higher than those of older workers in other industries.
Perhaps most interestingly, Visier identifies what it calls the “tech sage age”: once they hit about 40, workers in tech are increasingly likely to receive a “top performer” rating. By contrast, in the non-tech industries, such ratings become scarcer with age.
It is perhaps no wonder, then, that Sutcliffe suggests that companies “might want to take a second look at hiring practices” to achieve a more balanced workforce composition. Among the benefits could be a reduction in staff turnover.
“There could be a significant cost saving with rooting out some of the ageism,” says Sutcliffe. “If you say that older workers are more likely to be loyal, that goes a long way to future-proof your organisation, more than if you just hire younger workers who will be more interested in job hopping.”
Twumasi notes that, aside from the moral and business cases against age discrimination, there is also the legal case.
“More high-profile legal cases involving age [are] being brought to court and covered by the media,” he says.
Indeed, in recent years the number of cases brought against Silicon Valley firms on the grounds of age discrimination have outnumbered those linked to race or gender discrimination.
In cybersecurity, where skills shortages have been widely identified, it could be especially important to value older workers. Pohlmann suggests that distance-learning courses could help them to learn the latest cyber-security skills.
“We cannot get enough young people helping to make IT more secure, that’s the reason we need older people,” he says.
The psychology of discrimination
Unpicking the human brain’s decision-making processes can help us to understand – and eliminate – biases in recruitment.
Factors at play include selecting employees similar to oneself (members of the ‘in group’) and making quick, instead of slow, decisions.
“We tend to think with rules of thumb, or ‘heuristics’, which make decision-making much faster. However, when selecting this is not the place for a quick decision,” says Dr Ricardo Twumasi of The University of Manchester.
“We often think we are making a slow analytical decision, rather than a fast one, when we choose quickly, and then select reasons to justify our choice.”
Twumasi advises a scientific approach to selection, with rigorous job analysis followed by tests representing the job that will be carried out, and not relying too heavily on an interview. Having diverse assessors is also advised.
In addition, care should be taken in the wording and images used in job adverts to ensure they does not indicate that a younger worker is being sought. A candidate’s age or dates of school or graduation should be removed from the application when it is being assessed.
“A selection process that is transparent is less likely to be discriminatory and offers defence to a potential legal challenge,” adds Twumasi.
