Yash Jain discusses how cybersecurity needs to be an institutional ‘fundamental component’, not a ‘compliance checkbox’.

For Yash Jain, a cybersecurity, forensics and privacy manager at PwC, Ireland’s cybersecurity landscape is “evolving rapidly as awareness grows following targeted cyber-attacks on critical national infrastructure, such as the Health Service Executive (HSE) and pharmaceutical companies”.

He told SiliconRepublic.com, “These incidents highlight the importance of cybersecurity in modern digital infrastructure, prompting both government and private sectors to prioritise security as a fundamental component, rather than a mere compliance checkbox.”

Can you elaborate upon some of the challenges?

Cybersecurity awareness is widespread, yet many struggle with the practical steps needed to protect both organisations and individuals from cyber threats. The primary challenge lies in crafting a security strategy that aligns with business goals and compliance requirements. Cybersecurity isn’t just about adopting automated tools or running awareness campaigns. It’s about selecting a strategy that effectively implements protective measures across both people, process and technology. Additionally, skill shortage is another challenge that this sector is facing at this stage. Finding the right talent to deal with security and this has been a key challenge.

What skills do modern day professionals need in their arsenal to manage or stay ahead of threats?

In the current cybersecurity environment, mitigating skills shortages demands a strong grasp of networking concepts and familiarity with foundational development tools, including APIs and commonly used scripting and web technologies. These core skills enable professionals to understand how systems communicate, identify vulnerabilities and effectively analyse and respond to cyber threats. This knowledge lays the groundwork for understanding complex technical concepts. Pursuing globally recognised certifications like Certified Information Systems Professional (CISSP) and Certified Information System Auditor (CISA) can further enhance their security expertise. This approach equips professionals to navigate the evolving challenges in cybersecurity. Additionally, leveraging AI to develop these skills offers a modern alternative to traditional learning methods, such as sifting through extensive books.

How can an organisation ensure the workforce is adequately skilled in cybersecurity best practice?

To build a robust cybersecurity culture, organisations should make sure their teams understand the impact of cybersecurity on both them and the organisation. Education should be straightforward and clear, especially for those in non-IT roles like HR, finance, and operations. Engage your workforce with interactive sessions, such as in-person training and large-scale phishing simulation exercises. These simulations, managed by your security team or a trusted third-party, involve sending fake phishing emails to employees to test their ability to spot and handle phishing attempts—without any real threat to the organisation.

And back to basics, it’s crucial to maintain basic security practices, avoid sharing passwords, refrain from writing them down on desks or laptop covers and don’t use corporate email addresses for personal activities like gym memberships. By fostering these habits, you can enhance your organisation’s cybersecurity resilience.

How critical is cross-collaboration to ensure strong cyber hygiene and quick responsiveness to threats?

Cross-collaboration is critical to building a resilient cybersecurity posture. Cybersecurity is no longer solely the responsibility of the IT or security team, it is an organisational concern that touches every department and individual. When teams across HR, legal, finance, operations and technology work without collaboration, it creates blind spots that threat actors can easily exploit. Effective collaboration ensures that threat intelligence is shared swiftly across the right teams, enabling faster detection and response to incidents. For example, during a ransomware attack, a coordinated response between the security team, senior leadership, legal counsel and communications is essential to minimise damage and maintain compliance obligations.

It is essential that organisations take concrete measures to sustain and strengthen their current state of effective collaboration and consequently consider moving away from traditional cyber assessment exercises, such as conventional penetration testing. Instead, they should shift their focus towards purple team exercises. A purple team exercise is an advanced cyber penetration testing assessment in which penetration testers simulate sophisticated cyberattacks to evaluate an organisation’s security maturity across people, processes and technology, with the objective of detecting and blocking potential cyber threats.

Are there any myths around your role in cybersecurity that you would like to debunk?

Absolutely. There are a few misconceptions I frequently encounter that I think are worth addressing. The first is that cybersecurity is purely a technical role. While technical knowledge is certainly valuable, a large part of what I do involves strategic thinking, risk assessment and communicating threats in a way that non-technical stakeholders can understand and act upon. You do not need to be a programmer to have a meaningful and impactful career in this space. The second myth is that cybersecurity is only a concern for large organisations. In my experience, small and medium-sized businesses are often more vulnerable precisely because they are assumed to be low-risk and therefore invest less in their defences. Attackers are very aware of this. The third and perhaps most dangerous myth is that having the right tools means you are protected. Technology is only one layer of defence. Some of the most damaging breaches I have seen were not the result of a technical failure, they happened because a person clicked a link they should not have, or shared credentials without realising the consequences.

What is your advice for professionals looking for a similar career in this space?

My advice is simple, start with curiosity and never stop learning. Begin by building a solid foundation in networking and IT fundamentals, and consider pursuing recognised certifications such as CompTIA Security+, CISSP, or CISA depending on your area of interest. Do not be discouraged if your background is not in traditional IT, as some of the most effective professionals in this field come from diverse backgrounds such as law, business and psychology, because soft skills like communication, critical thinking and problem-solving are just as valuable as technical expertise. 

We have witnessed such scenarios where people coming from diverse educational backgrounds like business studies, law and other non-tech courses followed the above approach and enabled them as competent cyber professionals. PwC provides tailored learning programmes bespoke for employees joining the firm from different backgrounds to achieve this goal. The learning path is aligned to develop individuals into cybersecurity professionals capable of managing routine governance, risk and compliance tasks to maintain an organisation’s cybersecurity posture. However, to gain further depth in this career, specifically to become an offensive security engineer additional skills are required.

Leverage AI-driven learning tools and online platforms to accelerate your development rather than relying solely on traditional methods. Most importantly, engage with the wider cybersecurity community through events, forums, and networking opportunities, as this field thrives on collaboration and knowledge sharing and those who embrace that will always stay ahead.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.