Can't Fill Open Positions? Rewrite Your Minimum Requirements

Cyber and information security job openings seem to have one of the higher barriers to entry compared with other services-focused roles, and this gatekeeping can be largely blamed for the shortage of available talent in the field. For some reason, other positions are very open to nontraditional backgrounds and limited experience provided the candidate isn't a complete novice and can demonstrate interest in pursuing the field (think: customer service/support, bookkeepers, or IT help-desk roles).

In a world where talent is desperately needed, it is incumbent on hiring managers to rely less on keywords in a resume to prescreen candidates for most roles and instead consider the candidate's transferable skills.

Take the list of requirements and preferences below, which was derived from a recent posting for an entry-level security role. Here are some ways to reframe the skills and qualifications that are likely to give employers most, if not all, of what they're seeking. I've also included suggestions for adjacent skills that may satisfy what the job poster is looking for.

Requirement: Thorough Understanding of Cybersecurity Principles, Concepts, and Best Practices

Let's change this to, "Demonstrated understanding of at least one cybersecurity domain." Why? Anyone who has been in this field for any length of time knows you can dedicate your entire career to mastering the concepts, principles, and best practices of just one domain, let alone all of cybersecurity. Instead, highlight those areas most important for this role. If the person needs to understand the basics of identity access and management and the rest is beneficial, state as much. This way, if the person is truly new to the field, they can study up on exactly what you need and highlight their willingness to learn during the interview.

Requirement: Excellent Critical Thinking and Problem-Solving Skills and Ability to Work Under Pressure

Leave as is, but carefully consider where the applicant may have acquired these skills. As hiring managers, we always want to hear examples of dealing with this pressure during an outage or other event. Be open to hearing from a parent who had to juggle two sick kids while their spouse was traveling, or the department manager who severely underestimated the demand for toilet paper in 2020. None of these stories involve incident response (at least as we define it), but all will provide examples of being put in a difficult situation, navigating their way through it, and what they learned from it that can be applied to your role.

Requirement: 1-2 Years Professional Experience with Firewalls, VPN, SIEM, and/or IDS and Network Management/Monitoring Tools, Azure or AWS, and IAM

Change this to, "Demonstrable experience with common security tools, such as firewalls, cloud providers, SIEM tools, IDS/IPS, or identity providers." This requirement is nearly impossible to meet for someone brand new to the field, but if it is a requirement for the role, consider those with amateur experience with the same tools. Perhaps they built a virtual lab at home with freeware to understand the concepts, took a course on Wireshark and tapped their home Internet, or configured Pi-Hole to better secure their home network. Perhaps they have a free Amazon Web Services account and configured RBAC with test accounts or stood up a virtual syslog server.

This is arguably the most difficult requirement for new entrants and even some experienced ones because we all use different tools, so look for someone who has used any relevant tools and ask them how they learned about it, what they did with it, and what they learned from the experience. A natural curiosity shows a propensity to spend the time learning any tool your company has now or will acquire later.

Requirement: Industry Certifications

Leave as is but consider it optional and not required. This is perhaps the easiest to meet as CompTIA, ISC2, and others offer entry-level certifications, but consider the candidate may not have the means to pursue these certifications independently due to the cost, time, or other factors. One of the greatest benefits we can offer candidates is the opportunity to learn more, so don't let this be a disqualifier.

Requirement: 2- or 4-Year Degree in Computer Science or Related Field

Try using, "A college degree or recently completed training in relevant technologies and concepts." I concede this one proves a base level of knowledge in a topic, but it ignores several important factors. Many candidates may not have pursued college for one reason or another; it may have been unaffordable, or they tried and weren't successful, or like many of us perhaps they simply didn't know what they wanted to do after high school. Regardless, otherwise qualified candidates should not be rejected because of a lack of a degree if they can prove relevant training and skills. 

There are plenty of other degrees and backgrounds that lend themselves to what we do. A candidate who spent four years in the military has the mindset to understand an adversary and execute on a plan as it's been prescribed, both of which are incredibly helpful in incident response. A middle school teacher can demonstrate juggling multiple priorities while maintaining incredible documentation and providing updates to stakeholders (parents). It's also exactly what you need from an internal compliance team. Similar examples are all around but require us to be flexible when deciding what we really need from entry-level hires.