Eric Perez joined the U.S. Air Force at age 17 because he wanted to help fight the bad guys. He spent the next decade working in military intelligence and as a communications network technician.

When he left the service, he went on to earn a bachelor’s degree in accounting, followed by a master’s in accounting. And as an accountant, he was miserable. Especially during tax season.

Then he heard about a six-month course at SecureSet in Denver that offered hands-on cybersecurity training on how to get that digital bad guy.

“I don’t want to say I have a superhero complex, but it feels that way. I want to save people. I want (my job) to mean something,” said Perez, 39, who graduates in June from SecureSet’s program and hopes to find a job in the Denver area. “This seemed logical, it appealed to my analytical side and went hand in hand with my military training and doing deductive reasoning.”

Maybe he’s just wired that way. But coincidentally, about one-third of his class of 22 students are veterans. And SecureSet’s program in Colorado Springs is closer to 100 percent. Something about cybersecurity appeals to some veterans. And that’s a good thing because industry forecasts show that the demand for cybersecurity professionals is growing so fast that by 2021, there will be 3.5 million unfilled cybersecurity jobs. That’s just two years away.

“We promote broadly. However, we do get a lot of interest from veterans,” said Bret Fund, a  SecureSet cofounder who estimates that 40% of its students are veterans. “For a lot of them, their time in the military trains them on a lot of principles that resonate with cybersecurity professionals. It’s easy for them to pick up and transition to this space.”

These days, nearly any business would benefit from hiring someone trained in fighting off malware threats and cyber attackers. A trained employee could help resolve tech issues, actively prevent online threats and get training for staff, especially those darned employees who click on suspicious email links.

But Colorado’s supply of cybersecurity workers is lower than the nation’s, according to CyberSeek, a site with tools to help companies and potential workers better understand the shortage. For each cybersecurity job opening in Colorado, there are 1.8 workers employed in cybersecurity, compared with 2.3 employed nationwide. That means it’s more difficult for Colorado employers to poach cybersecurity workers from competitors, explained Scott Bittle, spokesman for Burning Glass Technologies, which worked on the CyberSeek data.

“So they must look to other tactics — cyber training for current workers, or attracting new talent, for example — to fill their needs,” he said.

To tackle the shortage, Boulder-based LogRhythm works with University of Colorado Denver to “create a pipeline of employees,” said James Carder, the company’s chief information security officer. And having served in the Air Force, Carder says he’s also tuned in to the potential of veterans. If veterans are interested in getting into cybersecurity, they should attend local events and get to know members in the working community.

Make more journalism like this possible with a Colorado Sun membership, starting at just $5 a month.

“I have eyes in the local community on the veteran side,” Carder said. “A good friend is a chief master sergeant in the Air Force, and he asked me to do a presentation on how to transition from the military to the commercial sector. Colorado Springs, that’s a rich talent pool for people coming out of the military.”

The 3.5 million worker shortage statistic comes from Cybersecurity Ventures, a research firm that reports on the industry in its Cybercrime Magazine. Since the number was first published in 2017, efforts to address it have been widespread with many universities adding cybersecurity degrees plus startups mixing security training with gaming to lure inexperienced but potential threat hunters.

But increased awareness and training opportunities aren’t going to make much of a dent in demand, said Steve Morgan, editor of Cybercrime Magazine.

“When street crime goes down, it doesn’t reduce the number of police officers required to safely protect society,” he said in an email. “While phishing campaigns are responsible for a large percentage of total cyber attacks, there’s so many other aspects of cybersecurity that need to be dealt with.”

Cyberfocused in Colorado Springs

Colorado Springs, home to five U.S. military bases, began a concentrated effort a few years ago to reach men and women leaving the military. A nine-month research project culminated in a Colorado Springs Chamber & EDC report last August that found the economic benefit of growing the local commercial cybersecurity industry would be $1 billion.

“As a result of the research we’ve done, we’ve identified the cybersecurity workforce in this metro areas as 3,000 workers averaging $104,000 in salary,” said Vinnie Persichetti, director of the chamber’s cybersecurity group. “One of the greatest and most in-demand requirements is a security clearance, which shows the scope of support that the industry provides to our local DOD (U.S. Department of Defense) installations and missions.”

That has led to renewed efforts to recruit former military. And in Colorado Springs, there are a lot of those folks.

“Over the last few years, we’ve averaged between 350 to 500 members of the military who transition every month. The majority come out of Fort Carson,” said Persichetti, himself a retired Air Force sergeant. “One of the reasons why we focus on cybersecurity is to assist the large number of military who want to transition.”

The chamber doesn’t have data on how many veterans stick around town but in speaking to military transition offices, Persichetti said they estimate 75 percent want to stay in Colorado Springs. Only about 40% can find a job or jump to a degree program.

Several efforts are under way in the city to collaborate and increase training opportunities for ex-military. SecureSet expanded to Colorado Springs in 2017. The region has tech training and cybersecurity programs like LeaderQuest and New Horizons “to offer certifications and a user base to help” Persichetti added.

Pikes Peak Community College last year became the city’s fifth college to receive a National Center of Academic Excellence from the National Security Administration (the Denver area, by comparison, has four with Regis University counted in both cities). The designation coincided with a new cybersecurity associate’s degree, created with the help of local security companies. Since spring 2018, 292 students have enrolled in the Pikes Peak degree program, with one-third classified as active duty, military dependents or veterans, according to the school.

There’s also the Catalyst Campus in Colorado Springs that houses a number of national-security efforts. One is The Center for Technology, Research and Commercialization, or C-TRAC, which connects private companies to work on cyber and tech issues with cadets at the Air Force Academy’s AF CyberWorx program. Microsoft also has a program aimed at transitioning military to tech jobs and cybersecurity.

Not everything on the campus focuses on cybersecurity, but it’s about building relationships between the military and the otherwise unaware commercial sector, said Kevin Kenney, C-TRAC’s program manager for Cyberworx.

“We don’t find hesitation largely. We find, for lack of a better word, ignorance. There are a lot of companies who haven’t thought of the government as a market. And we find those who are intimidated by the process. Another thing we do is demystify the process,” Kenney said.

And often, it’s a chance to work with veterans.

“We don’t look exclusively for veteran entrepreneurs, but we do find a lot of them because a lot of vets know the problems in the military,” he said. “Whatever technology they’re offering or they’ve created often applies to what they knew in the military.”

From lingo to tactics, cybersecurity and military work have a lot in common

After David Muench graduates from SecureSet next month, he’ll head back home to Miami where he already has a job as a defense analyst at the U.S. Department of Defence.  He’d taken an educational sabbatical for a year using the GI Bill to fund a year of coding school at Code Fellows in Seattle and then SecureSet, a rare bootcamp focused on cybersecurity.

Coding school taught him how to make software work. Cybersecurity training taught him how to break it, since that’s what cyber attackers are constantly doing. And if you’re just coding, you may not realize what else can go wrong.

“Here you learn just how easy it is to break everything. It’s terrifying but eye-opening,” said Muench, who spent nine years in the Army and has a background in counterterrorism. “There are a lot of unknown unknowns for coders out there.”

The common lingo and jargon — threat actor, risk assessment, intelligence — plus a more regimented structure makes it easier for veterans to adapt. The program requires students to attack computers and exploit vulnerabilities, just as a malicious attacker would do. Half the time is spent in labs to get actual practice and hunt down holes in the software, said Fund, with SecureSet.

“The industry is also very mission-oriented. Nothing against other areas, but writing code or creating a website isn’t as much of a mission as in cybersecurity where you’re very much defending a company’s assets from cyberattacks,” Fund said. “It’s very attractive to this (ex-military) population.”

Muench agrees. While he has a job waiting for him, he’s hoping that his role will morph to include more cybersecurity integration since he better understands threats and how to fight them.

“When you leave the military, the desire to still be in the fight doesn’t go away easily,” Muench said. “Being able to contribute in some way, shape or form is intoxicating.”