Tips for Writing Better Infosec Job Descriptions

INSECURITY CONFERENCE 2017 - Washington, DC - Advanced security tools can't reach their full potential without qualified employees to operate them, said Dawn-Marie Hutchinson, executive director at Optiv, at Dark Reading's INsecurity conference here last week.

In her presentation entitled "Finding and Hiring the Best IT Security People," Hutchinson described her own challenges in finding the right talent. As the former CISO of Urban Outfitters, her challenge wasn't in securing the budget for security tools, but finding people to run them.

Some businesses have both tools and talent but struggle when the two don't align, she explained. You might be well-staffed with employees who lack skills to be helpful. To find the right employees, Hutchinson suggested reevaluating job requirements and approaching the hiring process similar to how you would build a security program.

The key is becoming more involved in the hiring process and being more specific when looking for candidates. Security leaders looking for talent often tell their human resources department they're seeking candidates with certain skill sets. HR then compiles a job description cobbled from descriptions they find online, which may include certifications or number of years of experience.

As a result, many companies use similar job descriptions for open positions, and applicants tailor their resumes to suit them. Many talented people who could be successful are weeded out because they lack specific credentials and experience they may not necessarily need for a specific role.

"When you go looking for people, be mindful," said Hutchinson. "The number of years isn't as good as the quality of years and most recent experience … let's not [cross off] candidates because they don't have experience in systems that don't exist anymore."

Compliance requirements also block potential candidates. Many qualifications added for compliance; for example, familiarity with HIPAA, are things a smart individual could figure out and learn. However, because HIPAA isn't on their resume, they don't make it to the interview. Similarly, certifications like the CISSP are "easy hits" and make it easy to narrow down the candidate pool but could prevent security teams from gaining valuable talent.

"We need to find people where they are and develop them into what we need them to be," she noted.

Think about what you want your employees to do, and how you want them to operate, and build your staffing strategy around it. "What's your desired outcome?" Hutchinson asked. Shaping a job description based on outcomes will result in a completely different posting.

So where do you look for job candidates? Hutchinson recommended networking with peer groups and looking to your internal tech staff to find talent. Former military members are also potential candidates; check with veterans organizations or the Wounded Warrior project to find people looking for work.

It's also worth your while to hunt for candidates in new, unexplored pools. Business school graduates could be particularly valuable at a time when security pros need to explain risks and technology issues with board members. Security teams need people who can speak to the business, write, and communicate well.

But hiring is just one piece of the equation. Retention of loyal employees is another.

"What we really need to do is start figuring out how to keep them," said Hutchinson. Most people who leave are swayed by higher salaries. Fair compensation is an obvious must-have; if you don't pay your employees fairly, you will lose them. No perk will change their mind.

That said, it takes more than money to keep talent. You need to understand what motivates your employees. Many people swap jobs because they want more challenging or exciting work. They also highly value mobility and work flexibility, which the most preferred employee benefit from 2014 to 2016, she pointed out.

"Make them excited about being at work, excited about being in security," she emphasized. "It will make them loyal to you … give them something they can get behind."

If you can't retain talent, it will ultimately cost your business. Not only will you have to invest time and resources into vetting new candidates, you'll have to show them the ropes. It costs about nine months of someone's salary to get them on-boarded, Hutchinson said.

Related Content: