From demanding qualifications that few people have to expecting years of experience in new disciplines, businesses are making mistakes when advertising jobs - and it's leaving IT security teams understaffed and exhausted.