Hiring good people is difficult and expensive, and keeping them is harder. The average security pro stays in a new job for less than 18 months. Why is that?