devopsy.kinsta.cloud

Tag: skills gap

Addressing the Developer Skills Gap
Although organizations are boosting their cloud architecture investments, the developer and database market is experiencing a severe skills shortage. Organizations need to start building those skills from within by giving employees the time and resources they need to be successful.

The ongoing expansion of cloud and cloud-based database architecture expenditure has created a significant gap in the software developer and database market—namely, a shortage of developers with the right skill sets.

The lack of developers and professionals with enhanced abilities was the top challenge in the market for two years running, according to Infragistics’ annual Reveal Survey. More than a third (37.5%) of respondents said they expect to continue to have trouble finding skilled developers in 2023. DevOps engineers, data analytics developers and IT security engineers were highlighted as the most difficult jobs to fill.

Finding skilled developers may be a priority for organizations, but there still aren’t enough skilled cloud architects in the job market, despite the recent tech sector layoffs. This talent shortage is industry-wide, with the U.S. Department of Labor estimating the global shortage of software engineers will reach 85.2 million by 2030.

To overcome this, organizations must adjust their approach. It’s crucial that they adopt effective ways to help employees quickly develop the cloud architecture skill sets their organization–and the industry–requires.

Identify the Skills Most in Demand

The first step towards filling the skills gap is to identify the specific skills IT professionals and developers require to support cloud-based database architectures. These core skills include:
- A proficiency in PostgreSQL and distributed SQL databases
- An ability to build global applications
- A deep understanding of cloud environments
PostgreSQL proficiency is in high demand these days. It’s the number-one database according to the latest StackOverflow survey. Moreover, according to the DB Engines website, PostgreSQL is one of the fastest-growing databases in the market. It’s already ranked as the fourth most-popular database on the market (it runs the majority of applications) and is PostgreSQL-based.

Looking toward the future, distributed SQL, which combines the relational database features found in PostgreSQL with the scalability and availability of NoSQL systems, is poised to emerge as the de facto database architecture for enterprises looking to deliver market-leading applications and services. Distributed SQL allows them to monetize and scale their data regardless of industry or operation size.

In a rapidly developing cloud-native environment, applications and services are increasingly going global, with user bases around the world. Organizations seek developers with experience building cloud applications that are seamless, flat and scalable across all locations. These developers need to be able to build global applications that support business continuity and disaster recovery, comply with data residency laws, and move data closer to users wherever they are based. They must also build geo-distributed applications that span multiple geographic locations and provide high availability and resiliency while enhancing compliance and performance.

Because cloud architectures involve a mix of environments, developers also require a thorough understanding of cloud environments—public, private and hybrid—as well as familiarity with the largest cloud providers. These include the big three: AWS (Amazon Web Services), Microsoft Azure and Google Cloud.

The type of cloud being used can have unique security, compliance and governance requirements, as well app migration issues. Each cloud provider has their own set of procedures that developers should be familiar with.

These skills are all necessary for developers operating in today’s cloud workforce. But the question remains: How can employers fill this skill gap when developers who already have the necessary skills are so scarce?

Building Skills From Within

Investing in hands-on training and upskilling people already on staff is a great way to start enabling developers to acquire the skills they need. Organizations can choose from a variety of learning paths.

One option is to make use of communities of cloud-native developers and database practitioners. A good example is Yugabyte University, a global community offering free training in distributed SQL, provider configurations and cluster replications, and many other useful topics. Communities like this offer database training libraries, developer hubs and content libraries to their students.

Many other vendors and developer groups, including the Linux Foundation, the Cloud Native Computing Foundation and GitHub offer specific cloud-native training with certification, as do companies specifically focused on training.

Organizations need to be aware that one of the biggest challenges with upskilling employees is time. Developers already have a full plate, especially in cloud environments where the emphasis is often on building and deploying applications, services and updates as quickly as possible. These valuable staff don’t have time to spend on learning, studying, and then practicing new skills.

This is where organizations need to make an investment, not just making training resources available to developers on staff but giving them the time required to train. Learning platforms that give employees self-paced learning options, virtual training, and in-person workshops can help. This allows them to learn more easily on the job. It’s also important to tailor any training to focus on developing the skills your organization needs most.

A successful training program will benefit the company by increasing the quality of software development and the employees by enabling them to develop new skill sets that further their careers.

Invest in the Right Kind of Training

The skills shortage afflicting the entire IT industry shows no sign of easing. A significant number of developers with advanced cloud-native skills will not suddenly appear on the job market. Organizations must find ways to upskill their own developers.

Employers need to make resources available, tailor them to meet the highest priority needs and offer courses and workshops in a flexible platform that makes learning on the job practical and stress-free. It’s important that employees have the time they need to learn these vital new skills rather than making upskilling one more burden on the shoulders of already overworked staff.

As cloud environments continue to grow, training and upskilling your existing staff is a necessary investment that promises to pay off in the longer term.
February 12, 2024
Businesses Must Bridge the Skills Gap to Succeed With Quantum Computing

Quantum computing is poised to transform the way companies solve business problems. The technology needed to power this revolution is becoming a reality, with large developers like IBM making excellent progress toward building quantum-centric supercomputers. But while the technological barrier to deploying quantum is falling away, another obstacle remains: The lack of quantum skills in the labor market.

Last year, Classiq commissioned a survey of over 500 professionals familiar with quantum technology, which highlighted a range of possible benefits that quantum computing will unlock, including cost savings, new revenue streams and competitive advantages for companies that successfully deploy the technology. But the survey also highlighted that the shortage of qualified engineers and scientists who can program quantum computers remains one of the biggest barriers to increased quantum deployments.

This skills gap will not only prevent companies from leveraging the power of quantum computing but also lead to expensive competition for talent as businesses try to recruit the few quantum professionals available in the workforce. Why has this skills gap grown, and what can companies do about it?

Coding for the Quantum Computing Era

First, we need to understand what skills are missing that are contributing to a skills gap, as some readers may ask why existing programmers and computer engineers cannot meet this demand. Besides lacking the purely technical skills needed to code for quantum computing, such as creating quantum circuits and software, there is also a knowledge gap around how to solve business problems using a quantum computer.

For instance, while many programmers trained in classical computing could figure out a way to design a program for portfolio optimization, they likely have no idea how to do the same using a quantum computer. They are unlikely to know where to start, how to check their results or even how to run their code on a quantum device.

Coding for quantum computers is also more complicated than for classical computing. As each “qubit” can be one and zero simultaneously instead of either/or, writing the quantum code is more complex. Developers need to understand quantum concepts such as superpositions, so working in quantum requires new ways of thinking about problems and necessitates new ways of working.

This last issue is compounded by a technology gap, as quantum programming has not been abstracted away as it has for classical programming – it is mostly still at the assembly language level. At this level, writing a few dozen lines of quantum programming is achievable but time-consuming, so creating complex quantum programs of hundreds or thousands of lines of code is almost impossible.

Solving the Skills Gap

The first instinct for companies wishing to leverage quantum technology is to hire their way out of this problem, but there are simply not enough Ph.D.-trained quantum experts in the market, and there is likely to be stiff competition for the few quantum-trained graduates coming out of university. Given the shortage, companies must instead consider how to train and upskill their staff.

Convincing existing staff to take part in this training should not be an issue. Engineers and programmers are keen to learn – nearly 95% of respondents to our survey said they would like to be trained in quantum. Why is there such high demand? Not only is this new technology exciting, but many workers may hope to future-proof their jobs or increase their earning potential through quantum skills.

Upskilling your workforce does not have to be expensive. There is already a wide range of open source material, such as the Qiskit development kit, designed to help people explore this new technology. For companies, a straightforward solution is to give their engineers the time and space to learn about quantum for themselves. Simply giving your existing coders permission and resources to learn about this technology and how it can benefit your business could prove to be a profitable long-term investment.

The added advantage of upskilling your staff, rather than recruiting quantum Ph.D. graduates, is your existing workforce understands the sorts of problems your business needs to solve.

Plus, new products are emerging that can help solve the technology gap and make it easier to code for the quantum era. Sophisticated low-code software can abstract away some of the complexity involved in writing quantum coding, which in turn will speed up the process of learning.

But upskilling is only one thing to consider. Companies also need to invest in the resources and infrastructure around their emerging quantum talent. They need to build a team, identify use cases that can benefit from quantum technology and locate the right vendors and cloud providers that will allow them to test and simulate their quantum programs.

The quantum revolution remains several years away, but companies need to make sure they have the skills and infrastructure ready to take advantage of this technology or risk being left behind by quantum-prepared competitors.

January 15, 2024
Addressing Skills Gaps in Your DevOps Team

Skills gaps refer to the disparity between the skills that employers need and the skills that employees possess. These gaps can occur at an individual level, in a certain organization or across an entire industry or sector. Either way, they hinder productivity, stifle innovation and lead to missed opportunities.

Understanding skills gaps is crucial for anyone looking to advance their career or improve their organization’s performance. By identifying skills gaps, organizations can take steps to close them by helping their teams become more proficient and versatile.

Skills gaps are not always negative. They can also present opportunities for learning and growth. If an organization knows its skills gaps, it can proactively give employees the necessary skills and knowledge. This can result in increased employability and job satisfaction and foster a culture of continuous learning and improvement.

The Importance of Having a Skilled DevOps Team

One area where skills gaps can have a significant impact is DevOps. The DevOps model requires a broad range of technical, operational and soft skills, making it particularly susceptible to gaps.

Having a skilled DevOps team is vital for several reasons. First, it enables faster, more efficient software delivery, which can give your organization a competitive edge. Second, it promotes a culture of collaboration and continuous improvement, leading to higher-quality products and services. Third, it increases job satisfaction among team members who can see the direct impact of their work on the organization’s success.

Unfortunately, skills gaps in DevOps teams are common and can hinder these benefits. They can delay software delivery, create friction between team members and lead to subpar products. Therefore, identifying and addressing these gaps should be a top priority for any organization using the DevOps model.

Common Skills Gaps in DevOps Teams

Technical

When it comes to DevOps, technical skills gaps are often the most noticeable. These can include a lack of proficiency in coding, system administration, cloud computing and other technical areas.

Gaps in this area can have a significant impact on a DevOps team’s performance. They can slow down software delivery, lead to more bugs and errors and make it harder to implement new technologies or practices. Moreover, they can create a divide between team members, with some feeling overwhelmed or underqualified while others feel overburdened.

Operational

Operational skills gaps in a DevOps team can be just as detrimental, if not more so, than technical skills gaps. These can include a lack of understanding of the software development life cycle, project management or the ability to monitor and troubleshoot systems effectively.

Gaps in this area can lead to inefficient processes, missed deadlines and poor-quality products. They can also create tension within the team as members may struggle to understand their roles or how their work contributes to the overall goals of the project.

Soft Skills

Finally, let’s talk about soft skills gaps. These are often overlooked in the tech industry, but they are crucial for a successful DevOps team. Soft skills include communication, teamwork, problem-solving and emotional intelligence, among others.

Gaps in this area can lead to miscommunication, misunderstandings and conflict within the team. They can also hinder collaboration and continuous improvement, which are at the heart of the DevOps philosophy. Therefore, addressing these should be an integral part of any DevOps skills gap strategy.

Identifying Skills Gaps in a DevOps Team

Define What’s Required

The first step is to outline what’s necessary for the DevOps team. These could range from specific technical skills such as coding or system administration to soft skills like problem-solving and communication. A clear understanding of the skills required for each role within the team is crucial. This should not be a static list but rather a dynamic one that evolves with the changing needs of the industry and the organization.

Evaluate Current Skill Levels

Once the required skills have been defined, the next step is to evaluate the current skill levels of the team members. This can be done through performance reviews, one-on-one meetings or skills assessments. It’s important to be objective in this evaluation and focus on the skills rather than the individual. This process will help identify where the team stands in terms of what is necessary and which areas need improvement.

Identify the Gaps

The comparison of the required versus current skills will help identify the gaps. These are the areas where the team’s skills do not meet the requirements. Identifying these gaps is not an indictment of the team’s abilities but rather an opportunity for growth and development. It is crucial to communicate this to the team to maintain morale and motivation.

Prioritize the Gaps

Not all skills gaps are created equal. Some may have a more significant impact on the team’s performance and the organization’s goals. Therefore, it’s important to prioritize the gaps. Consider factors such as the impact of the gap on the team’s productivity, the complexity of the skill and the resources required to address the gap.

Create a Skills Matrix

A skills matrix is a visual tool that maps out the team’s skills against the requirements. It provides a clear picture of where the skills gaps lie and can help in planning how to address them. A well-designed matrix can also identify hidden talents within the team and highlight areas for cross-training.

Four Strategies to Address the Skills Gaps in Your DevOps Team

1. Internal Training and Development Programs

One of the most effective ways to address skills gaps is through internal training and development programs. These can be tailored to the specific needs of the team and can provide in-depth knowledge and hands-on experience. They also provide an opportunity for team members to learn from each other and strengthen their collaboration skills.

2. Hiring and Onboarding Skilled Professionals

While training existing team members is important, sometimes the skill gaps may be too large or the need for the skill too urgent. In such cases, hiring new team members with the required skills can be a viable option. A well-structured onboarding program can help these new members integrate into the team and share their skills.

3. Leveraging External Training Resources and Certifications

External training resources and certifications can also be an effective way to address skills gaps. These can provide industry-recognized validation and can often be tailored to the specific needs of the team. In addition, they offer an opportunity for team members to expand their network and learn from industry experts.

4. Cultivating a Learning Culture within the Team

Finally, this is not a one-time task but an ongoing process. Cultivating a learning culture within the team can help in this regard. Encourage continuous learning and make resources available for team members to upgrade their skills. Recognize and reward efforts to learn and grow. This will not only help address the current gaps but also prepare the team for future challenges.

Conclusion

In conclusion, skills gaps in a DevOps team can be a challenge but also an opportunity. By identifying and addressing these gaps, we can ensure that our team is equipped to deliver high-quality results. As professionals, it’s our responsibility to lead this process and create a culture that values continuous learning and skill development.

July 10, 2023
Survey Sheds Light On Cloud, API Expertise Skills Gap

Enterprise IT faces a three-pronged onslaught: Digital transformation, open APIs and security threats. First, most organizations are still navigating ongoing digital transformations and cloud migrations. Second, development teams continue to increase their use of open APIs, leading to sprawl concerns. And third, we’ve witnessed a slew of cybersecurity threats that appear to be growing in sophistication. Tech leaders are attempting to govern this influx of new tools and risks, yet it can be challenging to innovate quickly while ensuring that sensitive data is always protected.

The Axway 2022 Open Everything Survey shed light on some of the above challenges and attitudes of those invested in API development and API-enabled managed file transfer (MFT). Most notably, the survey found that 86% of respondents feared an expertise gap in the coming years, in which their organization won’t have the skilled software and IT infrastructure talent they needed to innovate. Below, we’ll review other findings from the survey, focusing on the responses from those who indicated they’re invested in API development.

Cloud Migrations Are Still Underway

Digital transformations are still underway in the vast majority of organizations. Only 12% reported being wholly digital and leading innovation. The rest were either just beginning transformations, were midway through or were still largely brick-and-mortar. More than one-third (38%) also said their company’s digital makeup is a hybrid of old and new technology.

The most-adopted computing environment is the public AWS cloud, at 47%. Yet other options trailed close behind, including hybrid (37%), managed cloud services (32%), Azure (28%), private (25%) and Google Cloud Platform (18%). Other reports substantiated how modern IT is becoming increasingly hybrid and multi-cloud. As digital journeys continue to shift and evolve, some organizations are embracing multiple fit-for-purpose clouds.

Although multi-cloud offers unparalleled flexibility, the primary drawback is security. Just over half (55%) of respondents said that tracking and controlling the flow of personal data into and through the cloud is a key hurdle to a multi-cloud strategy. And 53% reported that dealing with different security requirements for regional instances of cloud infrastructure was a top challenge. This concern is warranted, as companies doing business internationally must carefully navigate many specific regional data regulations.

Open Data Strategies Abound

As the Open Everything name indicates, many different sectors are becoming more “open.” The report highlighted the adoption habits of APIs within supply chains, where they are most often used to configure applications, operate and monitor applications and integrate internal data sources. Popular use cases here included payment and tracking systems. APIs also have a significant role to play in the financial world—41% of those working in finance said open banking is an opportunity to discover new business models. But nowhere is the need for more open data more crucial than in health care, which was found to be the area most in need of digital transformation.

We’d like to think of the API revolution as being driven by API-first startups and SaaS services. While these trends get attention, it’s not the most common use case for APIs. In fact, 44% of the time APIs are used to support IT consulting and system integration requirements. This is followed by providing cloud applications for customers (35%), developing a partner network (35%) and offering cloud services for customers or partners (34%). Although there are certainly business use cases for generating revenue through APIs, they are most often adopted to supplement existing platforms or to glue together internal services and data.

Most Technology Leaders Fear API Sprawl

Security is an encompassing concern for all walks of IT, but is especially top-of-mind when opening up data. Respondents said security is the most important concern when creating APIs (30%). This concern is warranted, as attacks on APIs have increased exponentially in recent years. Other top concerns are API adoption or consumption (15%), customer experience (14%), ease of API management (14%) and design and development (11%).

As APIs and microservices become more abundant within an organization, it’s easier for sprawl to set in. Unbridled technology sprawl can have a deteriorating effect on design standards and lead to unknown shadow APIs that may pose a security vulnerability. As a result, over two-thirds of respondents said the prospect of API sprawl worries them.

To mitigate sprawl and address other concerns, most companies are investing in tools to help manage the growing number of APIs. The majority (83%) said their budget for API management has either increased or stayed the same over the last two years. For 18%, this budget has risen by over 25%. Operationalizing API life cycle management capabilities can have benefits such as standardizing design style and increasing the discoverability of internal services.

API Security Must Still Mature

In a perfect world, we could share data without fear of misuse. But in reality, APIs are a common target for hackers. Publicly exposed endpoints with broken access control or missing object-level authorization can be easily abused for things like privilege escalation and data exfiltration. And although these risks persist, many APIs don’t adopt industry best practices regarding API security.

Although most APIs use authentication and token schemes, under half (43%) implemented OAuth. Furthermore, only 30% implemented policies with an API gateway. OAuth 2.0 and gateways have become best practices in serving APIs, as there are too many vulnerabilities to rely solely on HTTP Basic Authentication and API keys. As such, we will likely see these adoption rates increase as API security matures.

As with other cybersecurity endeavors, it’s really about taking a holistic perspective and applying defense-in-depth. Thankfully, most technology professionals understand this point—developing a more holistic approach to security was ranked as the top strategy for protecting personal data. Other strategies, like data encryption, advanced multifactor authentication, data loss prevention tools and highly-secured data transactions will also be necessary to protect cloud-native assets.

Final Thoughts

The Axway 2022 Open Everything Survey asked 1,000 IT leaders, architects and developers about their top concerns. Above, we focused on results from technology leaders engrossed in cloud and API development. For more insights and the findings from those using managed file transfer (MFT), readers can pick up a copy behind an email gate here.

January 6, 2023
Survey Shows Correlation Between Open Source, DevOps Skills Demand

A survey published this week by the Linux Foundation suggested enterprise IT organizations now prefer to hire IT professionals that have both open source software and DevOps experience.

Conducted in collaboration with edX, a leading global online learning platform from 2U, Inc., the survey polled 1,672 open source professionals and 559 respondents with responsibility for hiring open source professionals. The results revealed there is also a high correlation between demand for that expertise and familiarity with DevOps.

In terms of skills most sought, 69% of employers said they are looking for IT professionals that have cloud and container technology expertise followed by Linux (61%) and DevOps/GitOps/DevSecOps expertise (57%). Another 40% are looking for individuals with cybersecurity skills.

More than three-quarters of the IT professionals (76%) surveyed currently work with Linux (76%), while 60% have worked with cloud/container technologies and 53% have DevOps/GitOps/DevSecOps experience. Well over three-quarters (79%) said it was either very important (44%) or extremely important (35%) to be familiar with DevOps.

Clyde Seepersad, senior vice president and general manager for training and certifications at the Linux Foundation, said with all things being equal in terms of salary and benefits, more IT professionals preferred to work for organizations that are clearly viewed as open source software leaders. Organizations that want to recruit the best talent should make an effort to be seen as significant contributors to open source software projects to attract the best IT talent.

Roughly half the respondents currently work for IT vendors, but the rest represented some type of end-user organization that typically consumes open source software. That distribution showed that demand for open source software expertise has now moved well beyond IT vendors that build commercial applications and IT platforms, he noted.

Overall, the survey found 93% of employers struggling to find enough skilled talent, with nearly half of respondents (46%) planning to hire additional IT professionals with open source software expertise in the next six months. A full 86% said hiring IT professionals with open source software expertise was a priority. Well over two-thirds of employers (69%) said they are more likely to hire an open source professional with a certification. A total of 90% of employers said they will pay for employees to obtain certifications, with 58% reporting that open source IT professionals typically have higher salaries.

A total of 81% of the open source software professionals surveyed also said they planned to add certifications this year. Nearly three-quarters of them (73%) also noted it would be easy for them to find a new job. About a third of those respondents either left or changed jobs in the last year, the survey revealed. Two-thirds of open source software professionals said a higher salary would deter them from leaving a job.

More than three-quarters of IT professionals (77%) also noted they would benefit from additional cybersecurity training.

However, only 43% of employers identified training as a means to close their current skills gaps. Another 41% said they hired consultants to fill these gaps. Only 16% of those respondents said they were willing to delay projects because of a skills gap.

It’s clear that IT vendors and enterprise IT organizations are, in many ways, competing for the same talent. The challenge enterprise organizations face is making sure they have a high enough profile to be perceived as a place where IT professionals can make a meaningful open source software contribution.

June 23, 2022
4 Ways to Combat the DevOps and Security Workforce Shortage

Most people are painfully aware that security breaches have increased in recent years, while at the same time becoming much more sophisticated in their approach. Additionally, ever-expanding application environments and continuously evolving workloads have created more opportunities than ever for attackers. What’s not so apparent to those outside of the tech bubble: The world is dangerously ill-equipped to handle the magnitude of these threats.

Organizations may want to meet this challenge with armies of skilled technologists primed to maintain secure operations. But the reality is there is a major shortage of capable DevOps experts, especially ones with cybersecurity skills. This creates major problems for all organizations operating in modern cloud and container environments.

According to the cybersecurity advocacy group (ISC)2, this skills gap has noticeable, meaningful consequences for DevOps and security teams. Responses collected from more than 4,500 cybersecurity professionals around the world indicate just how severe the problem is. More than 30% of respondents said they regularly experience misconfigured applications, 29% feel that their teams are too slow to patch critical systems and 27% are unable to maintain necessary awareness of all threats active against their IT infrastructures.

It is clear that cybersecurity teams are not staffed to meet current—and anticipated future—demands, processes are not managed, assessment is not addressed and monitoring is incomplete. Yet, this is not just a matter of hiring more people to perform these tasks. The necessary people needed to keep DevOps environments safe simply do not exist as the role has changed faster than the workforce.

Time is a critical factor in security, and there can be no waiting around for a solution to appear. DevOps leaders and CISOs must do something, and fast. Fortunately, they can mitigate the burden of this skills shortage and continue moving forward with their transition to the cloud, containers and Kubernetes by taking these steps:

1. Employ Automation

Security and DevOps teams have to validate that security controls are actually working as intended, but also that they aren’t slowing down development efforts. Many enterprises perform manual checks to determine this, but that’s simply not scalable. Automation is the only way to do this effectively. Companies need tools that can analyze cloud activity without manual processes to understand if things are operating as expected, even in the largest deployments.

The equalizing factor that combines speed, agility and security is found in automation. With an automated approach, cloud activity can be analyzed and interpreted and DevOps and security teams can be alerted about abnormal behavior within their cloud and container environments. This helps to address vulnerabilities and issues before they are exploited, reduce friction in the development process and ensure safe deployment.

For starters, DevOps teams should leverage security tools to automatically build and customize policies. The right tools, some of which can be found in open source frameworks like Falco, are built to adapt to container life cycles and integrations. DevOps teams can rely on these tools to enforce policies and to alert on issues that result from anomalous behaviors that could indicate a threat.

Inherent in the automation approach is the shared responsibility concept; security of cloud and container activity is put squarely into the domain of the cloud customer. They are free to operate as needed, but no organization can ignore the modern demands of speed or the necessary requirements of security. This requires that DevOps teams recognize and adapt to the needs of security oversight while security teams must act on their remit while not slowing down the development and delivery processes.

2. Train People for the Task at Hand

If the right people don’t exist, it’s up to security and DevOps teams to create them. Organizational training is the key to adding people with the right skills, and every organization should be looking to develop the right candidates into qualified DevOps and security experts.

Many of these people already can be found working as application developers or within a security function. You may find individuals who are early in their careers, looking to enhance their skill set and eager to participate in on-the-job training. Every organization should encourage mentoring by more experienced staff, but also should have formalized training programs in place to bring people up to speed on the unique needs of DevOps security.

Some colleges now offer specialized cybersecurity degrees or certifications. Coding schools, like the Eleven Fifty Academy in Indianapolis, for example, train students on the most current cybersecurity practices and can be a great source of talent. The United States military also offers some of the most sophisticated technology training and is also fertile ground for recruiting highly skilled security and DevOps players.

3. Think Globally

There is no single, prescribed way to attack or hack cloud and container environments. Approaches are diverse, and that’s why the talent responsible for security also should champion diversity. One way to do this is to look beyond your own borders for talent. As the world has embraced remote work over the past two years of the COVID-19 pandemic, more organizations than ever are equipped to bring on workers from across the globe to help them solve security and DevOps issues.

Think more broadly about where you can find talent and hire people who can prove their capability through tests and work samples. Not only does this deepen the pool of potential workers, but it also helps you bring new people into the fold who have different perspectives and approaches that could enhance the work you’re already doing.

Nearly half of the employees at the company I work for sit outside of the United States. This has drastically increased the talent pool for us. With a bit of diligence, the major barrier to hiring globally—the time difference—isn’t an issue, and you might even find it makes you more efficient.

4. Rely on Proven Solutions

Finally, use commercially available products to support your DevOps security needs. Building it yourself is always an option, but when it comes to security, that approach may take more time than you have; a luxury you cannot afford.

SaaS products are most reliable and effective in this regard, as they will scale and adapt as your team’s needs change. These tools are purpose-built for the shared responsibility model so they reduce distractions and allow you and your team to focus just on the necessary security and speed-related tasks that are important to helping you achieve your goals. Review sites, the ability to trial them and the perspectives of developer communities will also be extraordinarily helpful in guiding you to making the best decision for your organization.

Managing security and DevOps is never easy. With aggressive timetables and delivery deadlines, it’s easy to let the discipline required for security slip. And what makes it even harder is that we cannot hire enough people to take care of these needs. Yet, with a combination of innovative training, new perspectives on hiring and effective use of technology, any enterprise can overcome these limitations.

January 25, 2022
Best of 2021 – The ‘Great Resignation’ in DevOps? Bah, Humbug

As we close out 2021, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the tenth in our series of the Best of 2021.

Like me, you have probably heard a lot about the “Great Resignation” lately. I’ll admit—at first I did not think it had anything to with tech jobs, especially not DevOps or cybersecurity jobs. After all, there aren’t many workers in those fields who aren’t well-paid (though, of course, when it comes to pay, it’s all relative).

When I first heard about the Great Resignation, I assumed it referred specifically to fast food workers or, perhaps, other restaurant, hospitality and retail industry jobs. You know—the kind in which people struggle to make $15 an hour. But then I began to hear it applied to better-paying tech jobs. Finally, I interviewed several executives who cited the Great Resignation as one reason that they were undermanned in key development, DevOps and cybersecurity positions.

I know what you are thinking: Tech execs will latch on to any excuse to explain why they are short-handed in these skilled positions. I agree with you, to a point. But I have had the chance to speak with several folks at some in-person conferences I’ve attended recently (It’s just not the same online!) and I began to see a trend. The almost mythical work-life balance/quality of life trend was back with a vengeance.

During the COVID-19 pandemic, many workers—even in highly compensated, challenging jobs like software development, DevOps, QA and cybersecurity—had actually changed their perspective as a result of working from home all those months. True, many of them had already been working from home. But they still had a “mothership” that they went to; however occasionally. They still gathered with coworkers at conferences or off-site meetings; they still were part of the “culture”. With COVID-19, despite the best efforts of HR teams and managers to foster and nourish that “culture”, it just wasn’t the same. Much the same way we fooled ourselves into thinking Zoom and Teams were as good as in-person, we thought that we could keep our teams tightly bound and drinking the company culture Kool-Aid.

In place of that corporate culture, when workers weren’t working (and it did take some time for many of them to learn how to use the on/off switch), they began to actually do other things. They spent time with their immediate families. They tried new hobbies, they started (and completed!) DIY projects and more. Lo and behold, they found there was life beyond code.

This radical notion of doing things that were not work-related was not solely due to a failure to pay these people enough money. It was not about letting them work with the tools of their choice. It wasn’t even about who they worked with. At the end of the day, it was because they discovered they had a life, and that they enjoyed that life.

I welcome this trend. I think it will mean less burnout and more productive humans, at the end of the day. Heck, we may even see birth rates rise and divorce rates fall. We may all live happily ever after.

When it comes to the Great Resignation, in the immortal words of John Belushi, “Bu-uut nooo.” Notwithstanding all of the above being true, I don’t think this is what’s leading developers, DevOps or cybersecurity folks to leave their jobs in droves. They are setting boundaries, yes, but they aren’t quitting just because of pay. No—they are leaving for the same reasons they did before. No sooner do they settle into their new jobs than they are being contacted by the ever-present recruiters offering them more money, more benefits and now more work-life balance. Add to this the growth in demand for these positions worsening an already understaffed market and there you have it. A shortage of workers to fill open positions. This convergence of circumstances makes it easier for them to hop from one job to the next, as well.

At the end of the day, we still don’t have enough software developers, DevOps folks, QA or cybersecurity talent. This is driving the market. But Great Resignation? Bah, humbug!

December 24, 2021
Will Automation Fill Gaps Left by the ‘Great Resignation’?

Between burnout, job-hopping and the ongoing pandemic, labor shortages will surely get worse before they get better, and automation is increasingly sought after as a way to mitigate the ripple effects of understaffed IT departments.

For DevOps, automation has several benefits, from freeing up employees to work on more constructive tasks to minimizing software bugs and technical debt.

However, starting off slow and learning how automation will help address staff shortages without complicating processes is a critical factor.

“There’s still a lot of teams that are struggling with far too many manual or repetitive tasks,” said Rich Lane, chief strategy officer at Netenrich, a digital IT and security operations company. “Obviously, trying to do your day job of delivering features and functionality into the wild can be challenging with the speed that business needs demand.”

Lane, a former senior research analyst at Forrester Research, pointed out that slowing down in the present to do foundational work that can lead to higher levels of automation in the future can be hard to sell to digital services stakeholders.

“And yet, without doing so, it becomes increasingly difficult to meet commitments in the event a team becomes shorthanded or delivery requirements increase,” he said.

Generalist or Specialist?

Cody Michaels, application security consultant at nVisium, said when it comes to hiring people for a DevOps environment, you have one of two options: You can hire someone with a wide range of knowledge that spans the entire process or you can hire someone with expertise in one core area like programming or deployment.

“At an individual level, a generalist will be better than an expert, however, a team of experts will outperform a team of generalists,” he said. “Not only can automation fill in gaps between an expert’s area of influence, but it can also serve as a permanent fixture on the team. As a result, the turnover rate won’t affect any automation so long as it’s implemented properly.”

From Lane’s perspective, the main areas DevOps teams should be looking to automate are continuous integration and continuous delivery (CI/CD), IaC and AIOps-enabled incident management platforms.

“By taking the manual nature of day-to-day work off of DevOps engineers’ plates, they are freed to focus on digital transformation,” he said. “The number-one stumbling block is not starting with process.”

Lane noted unless you understand all the steps in a procedure that you’re trying to automate, it is very difficult to maximize the power of automation tools.

“Much of the process that is still adhered to today is outdated for the digital age,” he said. “Spend the time up front to map out what you hope to achieve with an automation project, what all the touchpoints are and how one can measure the quality of automation when it’s implemented.”

Michaels added that while the internet is flooded by companies shouting they have the “best” tools, that proclamation of “best” is going to be determined by budget and known languages.

“The top tools that I would recommend are Jenkins, Docker, Git and Jira, since these four play very well together with regard to automation,” he said.

Git, for example, has hooks that can trigger upon performing certain actions, like freshly submitted code, while Jenkins has automation as its middle name and it’s used in building, testing and deploying, which in turn facilitates CI/CD.

Meanwhile, Docker provides virtualization of operating systems and running applications in a secure manner in conjunction with containers.

“Lastly, Jira is one most don’t think about, but the platform has a lot of macros and filtering functionality that can update the work process automatically from events like code passing a test before it’s deployed, for instance,” he said.

Michaels said a couple of core considerations organizations need to make when approaching the idea of automation and AI are time as well as safety nets in place.

“Automation will take time to set up before you can benefit from it, but in the case of smaller teams, it won’t be too time-consuming to configure it all in one fell swoop,” he said. “But if you’re working with a lot of technical debt, unfortunately, it’s going to be payback time. If this is the case, my best advice would be to start small and not overhaul everything at once.”

Minor Automation Improvements Have Major Benefits

He said he thinks incremental improvement will be the best route for most organizations, and that even minor improvements will compound far faster than waiting a year to see if a redesign will work for you.

“As I mentioned previously, it’s imperative to have safety nets in place,” Michaels said. “Make sure you have a contingency plan if something goes wrong in the process to recover back to a working state. However, strictly speaking, everyone should make it a practice to have a recovery plan in their software development life cycle (SDLC).”

As the DevOps world moves into 2022, organizations choosing to embrace automation could find themselves in a win-win situation—for both developers and operations.

“The more automation takes over the ‘housekeeping’ items of the process, the more time will be freed up to improve the process as a whole,” Michaels said. “As a result, taking time to go back and clean up technical debt can now be set aside between sprints and maintenance.”

He pointed out that senior roles can tackle optimizing the architecture, which will ensure fewer bugs and a healthier work-life balance for all: Just imagine a world where developers can focus on perfecting their craft—instead of waiting hours or days for server reboots or disrupting their flow to update a ticket status.

“It really comes down to the fact that organizations can no longer make automation an afterthought,” Lane added.

He pointed out that given the difficulties in recruiting and retaining staff today, DevOps leaders must make their teams as efficient as possible—and automation can help achieve that goal.

“The number-one way to achieve this is applying as much intelligent automation throughout the IT environment as possible so that the highly-skilled engineers can focus on transforming the business,” Lane said.

December 1, 2021
4 Tips To Plug The Cloud IT Skills Gap
Technical talent is few and far between. The programming world faces a developer shortage, and with this shortage comes a lack of cloud know-how. By now, most organizations have become multi-cloud, yet 86% of IT professionals believe a lack of these skills will slow down cloud projects.

As more teams transition from older architectures to cloud environments, the IT skills gap could pose a severe bottleneck to software development and deployment. Cloud servers require ongoing maintenance, and managing security and compliance is challenging, even for seasoned developers. Furthermore, it’s easy to overspend in the cloud—without keen insight into vendor nuances, it becomes challenging to select the most cost-effective package for the application at hand.

I recently talked with Joe Spurrier, chief technology officer and co-founder, cloudtamer.io, to see how teams can improve their cloud strategies while navigating a short supply of IT cloud know-how. According to Spurrier, increasing automation, sharing reusable templates, centralizing best practices and maintaining agnosticism are strategies to amplify cloud results. Below, we’ll expand on these areas to see how they maximize cloud benefits while retaining a lean engineering footprint.

Automation, Automation, Automation

“Automation is key to furthering your adoption and use of the cloud,” said Spurrier. The drive to automate comes as no surprise to many DevOps and SRE professionals whose goal is to automate their job away. When automating the cloud, infrastructure-as-code (IaC) is a fundamental necessity. “If you’re getting into cloud, you should probably have some scripting skills,” said Spurrier.

Automation can significantly aid scalability when setting up additional accounts since engineers must replicate similar operations, such as server provisioning, deployment patterns, monitoring and so on. Automation is also essential for shift-left testing and to increase observability into production environments. “It’s one thing to deploy an application via automation, but another to have tests in automation—that’s the next level,” said Spurrier.

Now that so many tools are API-driven, orchestration becomes programmable. A cloud service provider’s CLIs or SDKs could also be leveraged to hook into these integrations to construct such automation.

On the flip side, too much automation for high-level privileges could backfire. “Someone could break into a data center, steal a server, disconnect it, then run off,” Spurrier explained. Thus, automation will require a higher sense of security to ensure that every change is appropriately authorized and logged.

Reusable Templating

Along with automation, documenting operational processes to be shared amongst engineering teams is vital for maximizing efficiency in a lean talent landscape. The key here is to make the process self-documenting and reusable, stresses Spurrier. This will most likely involve someone on the team creating shared libraries and repositories for other team members to leverage.

One such example is Amazon’s golden AMI pipeline. Golden AMIs are virtual machines that teams can “standardize through configuration, consistent security patching and hardening.” Golden AMIs can also enable a repeatable process for performing monitoring, logging and even distribution to business units.

Reusable patterns are important for building CI/CD systems so that when you commit code, it is automatically deployed to preferred cloud providers. In general, Spurrier recommends building shared repositories that are easy to clone, with step-by-step instructions for usage. Sample applications that demonstrate components in different languages can also aid developer usability and save time.

Adopt Centers of Cloud Excellence

Another way to encourage better adoption is by creating a center of cloud excellence (CoCE). For an enterprise, having a cloud-centric project management group can be very helpful to organize knowledge and offer support. A CoCE could centralize operations, supply engineers with pre-configured containers and help distribute access to cloud accounts.

A CoCE is a good way to start to unite disparate teams around shared best practices, said Spurrier. Depending on your organization’s needs and workloads, a CoCE will focus on varying skills, he added. In the beginning, a company may have just one center for cloud knowledge. However, as adoption grows, dedicated centers may likely emerge around specific cloud providers, too.

Retain Agnosticism

Contrary to popular belief, multi-cloud steups aren’t always about lift and shift. Business units often adopt a particular cloud to suit specific workload requirements. For example, researchers may choose GCP for its data science functions, or Microsoft shops may prefer Azure.

In a multi-cloud world, management layers could help retain a modicum of vendor neutrality. For example, take Cloud Custodian, a tool developed at Capitol One and recently contributed to the CNCF. Using Cloud Custodian, engineers can run security checks across AWS, Azure and GCP and generate metrics for reporting. Such control and insights could empower teams to automate some of the multi-cloud management burdens.

When working with multi-cloud, it’s also good to consider agnostic tooling that can work across different providers, like Terraform or Kubernetes, Spurrier said.

Templating

Cloud transformation is ongoing at most organizations. With this rise, more cloud-native processes and tools are emerging. Yet, with talent in short supply, DevOps isn’t always fully prepared. To review, we covered four ways businesses can circumnavigate this issue to get an edge:
- Increased cloud automation is a necessary response to a slimmer labor pool. Though building automation requires upfront technical skill, it pays dividends in increased efficiencies.
- Reusable libraries and templates can rapidly configure new projects and do so consistently across business units.
- Consider maintaining a center of cloud excellence to centralize policies and offer support.
- Opt for agnostic tools. This helps to retain vendor neutrality and apply consistent controls across clouds.
Of these above strategies, Spurrier emphasized the importance of creating shared templates. When used right, a templating approach can be very effective, he says. “If you have a templating model, it should be easy for DevOps teams to migrate to new features. If you’re leveraging tools that set up templates, it’s easier to figure out how much infrastructure is going to cost.”
September 30, 2021
How To Address DevSecOps Skills Shortages

“If it’s scarce, it drives the price up,” said McAfee director of systems engineering Sahba Idelkhani. And DevSecOps talent is scarce, and expensive.

Restrictions on international travel are having an effect on immigration in some countries, notably Australia. But there’s practically nothing employers can do about that.

But some aspects of the supposed skills shortage are, in part, self-imposed. One example is recruitment ads that specify “5+ years’ experience required” (or something similar) when that level of experience is only a desirable characteristic.

Such practices don’t just restrict the field of candidates for that particular vacancy, they also make it hard to find entry-level positions. If candidates can’t get a foot in the door, how can they gain the experience that employers say they want?

DevSecOps Change is Needed

Idelkhani suggests that organizations need to change their hiring practices and put more effort into reskilling existing employees.

In particular, if you’re looking for DevSecOps people, he suggests it’s better to teach developers about security than it is to bring security specialists (who are also in short supply) up to speed about development. The result is less rework, reduced risk and shorter development timelines.

However, there is a risk that security specialists will tell developers what they did wrong. Proactively educating developers about security is a more productive approach.

Cloud Academy is one of many sources for online security training courses and includes hands-on labs, sometimes involving the same tools that criminals use to breach security. Other tips Idelkhani offered include adopting a “build secure” mindset to reduce the security effort needed after systems have been created.

A similar perspective can be applied to entry-level positions.

Idelkhani has hired new graduates, even though it requires effort to guide and train them to the point of being productive.

He has even adopted this approach with experienced people that have no background in security, including a former CTO and mobile developers and a pre-sales engineer.

Revamp job descriptions so more people can apply, urges Idelkhani, as aptitude and skill are more important than specific experience, which can be taught.

For example, instead of a large financial services organization recruiting someone with experience in incident response for cloud systems, it would probably be better to hire an incident responder and then sponsor their cloud training, he suggests.

Furthermore, a diversity program increases the supply of candidates, quite apart from the other benefits it may bring.

DevSecOps Training

Employers sometimes suggest training is a waste of time and money because people simply take their new skills elsewhere in search of higher pay.

But Idelkhani reports that his staff turnover has, in fact, fallen over the last three years, and no one has left after being trained.

He puts this down to establishing an “emotional connection” between employee and employer, at least in part.

However, organizations do have to accept the need to pay people what they are worth as they master new skills. But standard HR practices don’t suit skills development situations, he warns.

People usually won’t move from their current role or company for a 10% to 20% pay raise, Idelkhani said, but would be more willing to do so for the 200% to 300% increase that comes from being considered an accomplished worker rather than a mere trainee.

At McAfee, he is able to argue for ‘pay for value’ raises for his team; that task is generally harder at larger organizations, he said.

“It needs a rethink [of] HR practices,” he added.

Planning

Substantial raises tend to require approval from higher up in the hierarchy, and that requires a clear justification for the increase. He suggests this should be done in terms of the capabilities that are being built, not based on the numbers alone.

Managers should look at the skills they are going to need in order to deliver on the business’s strategic goals and plans, and decide how best they can be obtained. An expected DevSecOps vacancy might best be addressed by hiring a cloud developer and training them in the necessary security skills, or by retraining a person with potential who is already on the payroll.

“It’s a long-term process,” though, that requires a lot of management effort, Idelkhani said. Using this method means identifying people’s interests and skills, aligning them with company goals, identifying the skills gaps and then developing those needed skills. This requires a training budget and getting one approved means having clear plans.

But once you have shown the value of this approach, senior management is less likely to question it in the future.

April 2, 2021