Staffing for cybersecurity has always presented a challenge. But with the old skills shortage combined with the new “Great Resignation,” hiring the right candidates has never been more important.

The first step in looking at any prospective hire is to review resumes. People often don’t appreciate this process. It’s easy, for example, to overlook the best fit. You might toss aside the resume of someone who might be an outstanding candidate because of factors that really don’t matter.

Top ten factors in hiring a cybersecurity professional

Here are the ten most important things to look for in resumes for your cybersecurity positions. With these, you’ll have the best chance at the right hire:

1. Accuracy. Look for signs of exaggerated skills and experience, and also the opposite — someone who is downplaying their own achievements. It can be difficult for some people to ‘sell themselves’ with accuracy, and this ability is largely governed by personality. Some candidates feel the need to overstate their qualifications, and others are modest and self-effacing. Try to get a sense of the candidate’s tendencies so you can get a more accurate reading during the interview.
2. Someone who can learn and grow. Cybersecurity is a fast-moving, fast-changing world. The ability to adapt, learn and change with evolving threats and security methods is one of the most important skills you’re looking for. Look for people who can learn quickly and effectively.
3. Someone different from yourself. It’s human nature to favor candidates who are similar in background and training to you. Watch out for this bias and make sure you don’t dismiss people who are different from yourself in gender, ethnicity, training and career.
4. Soft skills. Scan resumes for evidence of valuable soft skills like leadership, curiosity, tenacity, passion, problem-solving, teamwork, thriving under pressure and communication skills. While certifications are great, it’s those soft skills that can determine success.
5. Communication skills. Among the soft skills, the ability to speak to others well is probably the most valuable. You’ll find out more in the interview process, but a resume that shows the person can keep it simple, high-level and in plain language should impress you. Jargon, acronym-filled language shows a candidate who is insecure and lacks perspective. If someone struggles to communicate clearly in a resume, they may also struggle to click with coworkers if you hire them.
6. Unrelated work. Don’t dismiss unrelated work experience right away. It could point the way to soft skills that contribute to the job you want to hire for. For example, if someone succeeded in a previous job doing research, solving hard problems or leading teams, then you might want to mark those down as a big plus for the candidate, even if that experience wasn’t related to your field.
7. Specialization and its opposite. You’ll probably want to seek out candidates who excel at complex specialties that might be missing on your current team. Specialists are great if the specialty in question is a major issue on the threat landscape your organization may face in the future. At the same time, you also should favor candidates with some breadth of experience and knowledge as well. For example, familiarity and ability with semi-related roles like networking, engineering, end-user support and the like could prove valuable. Look for candidates that are pretty good at everything, and very good at a few things.
8. Up-to-date skills. Specialists who know a lot about the most recent threats and solutions are key. Note when people have a good fitting with ransomware or solutions involving automation or artificial intelligence. Those are far more valuable than someone who has only worked with dated threats and solutions. Look for current skills, experience, knowledge and certifications.
9. Balance. Both prospective employees and hiring managers may be tempted to gravitate to the aggressive, go-getter types. While you do want to hire tenacious, loyal and hard-working employees, you also want staff that can pursue work-life balance and avoid burnout. In fact, burnout is a huge problem in this industry and a key factor in the Great Resignation. The best hire is one who will maintain the presence of mind to stay focused on work. This person won’t quit in a few months because they can’t take the burnout anymore. In fact, an employee who maintains a work-life balance is more likely to stay on the job for longer. That enables you to benefit from the training and experience they gain on the job. Look for keepers who won’t get burned out.
10. Real-world education. Formal education is great and valuable for prospective employees. But don’t consider a lack of formal education a deal-breaker. Look for backgrounds where people have proven real-world skills. Most cybersecurity workers did not get a degree in cybersecurity or computer science. Your best candidate may be one of these.

Keep an eye on the big picture

While these are specific attributes to look for in resumes, be mindful of the big picture. While you’re hiring one person, you’re also assembling a team. The “best” candidate may not be the best hire. Instead of trying to hire an all-star team, get the most complete and well-rounded team for your staffing budget.

Filling your current position may feel very urgent. Don’t rush. The larger goal is to fill a position with someone who will stick around and learn and grow with you. They’ll need to adapt and grow as you face a new world of challenges.

Lastly, even if you have a huge pile of resumes, don’t be eager to put people aside. Instead, sift carefully. There might be nuggets of gold in that pile, and you’re going to want to find them.