Cloud
12/4/2017
10:20 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Tips for Writing Better Infosec Job Descriptions

Security leaders frustrated with their talent search may be searching for the wrong skills and qualifications.

INSECURITY CONFERENCE 2017 - Washington, DC - Advanced security tools can't reach their full potential without qualified employees to operate them, said Dawn-Marie Hutchinson, executive director at Optiv, at Dark Reading's INsecurity conference here last week.

In her presentation entitled "Finding and Hiring the Best IT Security People," Hutchinson described her own challenges in finding the right talent. As the former CISO of Urban Outfitters, her challenge wasn't in securing the budget for security tools, but finding people to run them.

Some businesses have both tools and talent but struggle when the two don't align, she explained. You might be well-staffed with employees who lack skills to be helpful. To find the right employees, Hutchinson suggested reevaluating job requirements and approaching the hiring process similar to how you would build a security program.

The key is becoming more involved in the hiring process and being more specific when looking for candidates. Security leaders looking for talent often tell their human resources department they're seeking candidates with certain skill sets. HR then compiles a job description cobbled from descriptions they find online, which may include certifications or number of years of experience.

As a result, many companies use similar job descriptions for open positions, and applicants tailor their resumes to suit them. Many talented people who could be successful are weeded out because they lack specific credentials and experience they may not necessarily need for a specific role.

"When you go looking for people, be mindful," said Hutchinson. "The number of years isn't as good as the quality of years and most recent experience … let's not [cross off] candidates because they don't have experience in systems that don't exist anymore."

Compliance requirements also block potential candidates. Many qualifications added for compliance; for example, familiarity with HIPAA, are things a smart individual could figure out and learn. However, because HIPAA isn't on their resume, they don't make it to the interview. Similarly, certifications like the CISSP are "easy hits" and make it easy to narrow down the candidate pool but could prevent security teams from gaining valuable talent.

"We need to find people where they are and develop them into what we need them to be," she noted.

Think about what you want your employees to do, and how you want them to operate, and build your staffing strategy around it. "What's your desired outcome?" Hutchinson asked. Shaping a job description based on outcomes will result in a completely different posting.

So where do you look for job candidates? Hutchinson recommended networking with peer groups and looking to your internal tech staff to find talent. Former military members are also potential candidates; check with veterans organizations or the Wounded Warrior project to find people looking for work.

It's also worth your while to hunt for candidates in new, unexplored pools. Business school graduates could be particularly valuable at a time when security pros need to explain risks and technology issues with board members. Security teams need people who can speak to the business, write, and communicate well.

But hiring is just one piece of the equation. Retention of loyal employees is another.

"What we really need to do is start figuring out how to keep them," said Hutchinson. Most people who leave are swayed by higher salaries. Fair compensation is an obvious must-have; if you don't pay your employees fairly, you will lose them. No perk will change their mind.

That said, it takes more than money to keep talent. You need to understand what motivates your employees. Many people swap jobs because they want more challenging or exciting work. They also highly value mobility and work flexibility, which the most preferred employee benefit from 2014 to 2016, she pointed out.

"Make them excited about being at work, excited about being in security," she emphasized. "It will make them loyal to you … give them something they can get behind."

If you can't retain talent, it will ultimately cost your business. Not only will you have to invest time and resources into vetting new candidates, you'll have to show them the ropes. It costs about nine months of someone's salary to get them on-boarded, Hutchinson said.

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
12/5/2017 | 10:18:49 AM
Risk
To me this is a risk. One of the first places I hit when doing reconnaissance work is the help wanted ads and Linked profiles of targets. Looking for system information as well as software information that the business utilizes. Having too much information about your systems open to the public makes you more vulnerable. You have the opprotunity to evaluate the potential employee during the interview without putting systems at risk.
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.