Second Chance Talent

The Stack · Workforce & Security · Part of our ongoing series on who will actually defend the network

TL;DR: U.S. employers posted 514,359 cybersecurity job listings in a single year and can fill only about three in four, while more than 600,000 people walk out of state and federal prisons every year into a labor market where over a quarter of them can't find work. Project Phoenix — a partnership between the National Association of Reentry Professionals (NARP), Bluu Kazi and EC-Council — is built to connect those two numbers, and it needs employer partners to scale.

The Breakdown

The call that named it

On December 8, 2025, Bluu Kazi CEO Michel Edwards got on a call with Khalil Osiris — author, NARP board member, and a man who served 20 years in prison after being sentenced as an adult at 17. Osiris opened with the question he says workforce programs keep dodging: how do you actually take someone to a living wage?

His answer was focus. Reentry services, he argued, have looked the same for decades; the genuinely new piece was a cybersecurity pathway built as a business, not a charity. By the end of the call the two had a name — Project Phoenix — and a structure: NARP out front as the voice and validator, Bluu Kazi as the training and placement engine, EC-Council as the credentialing body.

Edwards' condition was standards. The coursework, he told Osiris, is "not for the lazy of mind." Osiris agreed — the motivation in this population, he said, lets the program handpick its candidates.

Two numbers that belong in the same sentence

The demand side — seats nobody is filling:

• 514,359 U.S. cybersecurity job listings in twelve months, up about 12% on the prior period (NIST / CyberSeek). CyberSeek's supply-to-demand ratio sits near 74% — roughly one in four seats stays empty (Programs.com, citing CyberSeek).
• $129,180 median pay for information security analysts in May 2025, with employment projected to grow 21% from 2025 to 2035 and about 14,100 openings a year (BLS).
• About 280,000 openings a year across computer and IT occupations, median pay $109,470. The on-ramp role, computer support specialist, pays a $62,890 median (BLS).

The supply side — talent nobody is recruiting:

• More than 600,000 people are released from state and federal prisons every year (HHS ASPE).
• The Federal Bureau of Prisons alone held 154,932 people in September 2025 (U.S. Sentencing Commission).
• Working-age formerly incarcerated people faced 27.3% unemployment, versus 5.2% for their peers — still the only national estimate on record (Prison Policy Initiative).
• Shutting people with records out of work cost the economy 1.7–1.9 million workers and $78–87 billion in GDP in a single year (CEPR).

Put them side by side: Phoenix's three-year goal of 10,000 graduates equals under 2% of one year's cyber listings. This is not a charity ask. It is a supply chain nobody has built.

How second-chance hiring works: mindset to placement

1. NARP sources and validates. Members in 40 states, half of them formerly incarcerated and half allies. Executive Director Rosetta Taylor brings 40+ years in incarceration, recovery and reentry work, more than a decade inside the Bureau of Prisons, and her own service as a service-connected veteran. Osiris's psychology-of-incarceration curriculum is the mindset layer.
2. Bluu Kazi trains and certifies. As an EC-Council Accredited Training Center, it pairs self-paced EC-Council content with mandatory guided sessions — a four-week intensive on the way to an 18-week standard shaped by hiring feedback from Amazon's security teams.
3. Employers enter through NARP. The first ask of a company is simple: become a NARP member. Bluu Kazi then runs job matching, interviews and a 90-day replacement guarantee on every placement.
4. Everything is disclosed up front. Which offenses an employer can't accept, how long training runs, and what support exists while people train — so no one finds out after the certificate that the door was never open.

What is already on the ground

• A veteran-first pilot: ten EC-Council Certified Cybersecurity Technician seats secured, and more interested veterans identified than seats available.
• A live candidate portal and a gated NARP landing page that routes members into training and jobs.
• A hard-won lesson. Interested candidates didn't stall on ability; they stalled on three questions — Will my record disqualify me? How long is this? Is there a job at the end? Taylor put the priority plainly: "Survival is what's important."

Osiris's fix is architectural. Get committed employers to the table, he told the team, and the job question gets answered by the people doing the hiring — not by the program promising what it can't guarantee.

What it would take to fund it

$7,500 per participant, and $75 million to reach 10,000 graduates in three years. That is the partners' own unit cost, built line by line:

The roadmap the partners laid out in November 2025 scales in three phases:

No single check covers it — and it shouldn't. The model braids five sources:

• Employer seat sponsorship. A company that expects to hire ten entry-level analysts sponsors ten seats for $75,000 — less than one year of salary for a single mid-level hire.
• Placement revenue. A typical 20% agency fee on a $55,000 hire is $11,000, enough to fund about 1.5 more seats. Every placement pays it forward.
• Public workforce dollars. WIOA training accounts through local workforce boards, plus Labor Department reentry grants, already exist for exactly this population.
• Veteran benefits. The pilot starts with veterans because education and workforce benefits can follow them into training.
• Philanthropy for wraparound. Stipends and connectivity are where donors move completion rates most.

Employers also carry less risk than they think:

• Work Opportunity Tax Credit: up to $2,400 per qualified hire with a felony conviction. The credit lapsed for wages paid after December 31, 2025; Congress has historically reauthorized it retroactively, so employers should keep filing the screening forms (Congressional Research Service).
• Federal Bonding Program: free fidelity bonds of $5,000 to $25,000 covering a hire's first six months, with no deductible (U.S. Department of Labor).
• Bluu Kazi's 90-day guarantee: if a placement doesn't stick, a replacement graduate steps in.

What it would mean for the economy

At full scale, a one-time $75 million investment would put about $385 million a year in paychecks into communities that need them most. We ran the numbers deliberately low:

• Placement rate: 70% — below the program's 85% target.
• Starting wage: $55,000 — below both the $62,890 median for computer support specialists and the $75,090 that the lowest-paid tenth of security analysts earn (BLS).
• Recidivism effect: 10 points — a cut from the roughly 39% three-year return-to-prison rate to 29% (Council on Criminal Justice).

Read the table from the bottom up. First-year wages return the training budget five times over, and payroll taxes plus avoided custody costs alone recover more than the full $75 million every year after. State prison costs vary widely, so the custody line is a federal benchmark, not a promise.

The returns don't stop at the worker. Roughly 1 in 28 U.S. children has a parent behind bars (HHS ASPE). NARP's two-generation design treats a parent's paycheck as the first line of defense for the next generation — which is why Osiris calls it an ecosystem, not a program.

And the ceiling is enormous. Against the $78–87 billion a year the economy loses to record-based exclusion, 10,000 graduates is a proof of concept. That is the point: prove it in cyber, then carry the same rails into other shortage fields.

The EC-Council Lens

The credential is what lets a hiring manager judge the skill instead of the record. Phoenix maps each rung to a real entry-level work role:

Why this talent fits the work

Zero Trust is a posture: never trust, always verify, assume the perimeter is already breached. The partners argue that many people who survived incarceration arrive with that instinct already sharpened — constant situational awareness and an ear for manipulation.

The mindset curriculum's job is to redirect it. Hyper-vigilance becomes threat awareness. Reading people becomes social-engineering defense — the human layer CEH trainees learn to test. Channelled through labs and ethics modules, that becomes a professional edge.

It also fits where the jobs are going. As AI absorbs routine log triage, Tier-1 analysts shift from watching screens to checking the machines that watch them. Graduates trained on AI-aware CEH content start where the job is heading, not where it was.

How a CISO de-risks the hire (the CCISO view)

1. Scope roles to the record. Phoenix's risk-and-restriction filter matches each candidate against an employer's legal limits before an interview — cleared or heavily regulated roles are screened out early; SOC, help-desk-to-security and industrial-control roles at utilities stay open.
2. Apply controls, not stigma. Least privilege, role-based access, logging and separation of duties protect the organization from every insider. A Phoenix hire gets the same controls as anyone else — no more, no less.
3. Assess the person. Weigh the offense, the time elapsed and the relevance to the role, as with any individualized background review.
4. Onboard for retention. Isolation is the first threat after release. Assign a peer, set a 30/60/90-day plan, and brief managers — Bluu Kazi and NARP coach employers on exactly this.
5. Measure it. Track time-to-productivity, 90-day retention and certification progress, and report them like any other security KPI.

The Stack Takeaway

The talent shortage and the reentry crisis are the same problem seen from two sides — and employers hold the piece that connects them. Training exists. Credentials exist. Candidates exist. What Phoenix needs now is companies willing to say, in public, we will interview these graduates.

What could go wrong, and the fix

• People drop out to survive. → Wraparound stipends are a budget line, not an afterthought.
• A record blocks the job after training. → Restrictions are disclosed and filtered before anyone enrolls.
• Four weeks isn't enough depth. → The intensive is a start; 18 weeks is the standard graduates are held to.
• Tax incentives stall in Congress. → The economics above hold without the WOTC; the credit is upside.

The ask: five ways to partner

1. Join NARP as a corporate member — the front door for every Phoenix employer.
2. Sponsor seats: $7,500 funds one graduate; $187,500 funds a full 25-person cohort.
3. Post real roles on the Phoenix portal, with any record restrictions stated up front.
4. Commit to interviews for graduates who meet your bar.
5. Onboard with the playbook and share 90-day retention so the model keeps improving.

Osiris framed it on that first call: this is a business model with a nonprofit partner, not a charity with a business card. The phoenix doesn't rise because someone feels sorry for it. It rises because the market finally needs what it became.

Companies ready to talk can start at bluukazi.com.

Sources

• Information Security Analysts, Occupational Outlook Handbook — U.S. Bureau of Labor Statistics
• Computer and Information Technology Occupations — U.S. Bureau of Labor Statistics
• New CyberSeek Updates Reveal 57,000 Increase in Cybersecurity Job Openings — NIST
• How Many Cybersecurity Job Openings Are There? — Programs.com (CyberSeek supply-demand ratio)
• Individuals in the Federal Bureau of Prisons — U.S. Sentencing Commission
• Annual Determination of Average Cost of Incarceration Fee, FY2024 — Federal Bureau of Prisons, Federal Register
• Incarceration & Reentry — HHS Office of the Assistant Secretary for Planning and Evaluation
• Out of Prison & Out of Work — Prison Policy Initiative
• The Price We Pay — Center for Economic and Policy Research
• New National Recidivism Report — Council on Criminal Justice
• The Work Opportunity Tax Credit (R43729) — Congressional Research Service
• Federal Bonding Program — U.S. Department of Labor
• Project Phoenix partner meetings, November 2025 – July 2026, and the partners' Project Phoenix financial analysis (internal)