Skilled security engineers are hard to find (and retain)