March 2, 2022 By Mike Elgan 4 min read

Staffing for cybersecurity has always presented a challenge. But with the old skills shortage combined with the new “Great Resignation,” hiring the right candidates has never been more important.

The first step in looking at any prospective hire is to review resumes. People often don’t appreciate this process. It’s easy, for example, to overlook the best fit. You might toss aside the resume of someone who might be an outstanding candidate because of factors that really don’t matter.

Top ten factors in hiring a cybersecurity professional

Here are the ten most important things to look for in resumes for your cybersecurity positions. With these, you’ll have the best chance at the right hire:

  1. Accuracy. Look for signs of exaggerated skills and experience, and also the opposite — someone who is downplaying their own achievements. It can be difficult for some people to ‘sell themselves’ with accuracy, and this ability is largely governed by personality. Some candidates feel the need to overstate their qualifications, and others are modest and self-effacing. Try to get a sense of the candidate’s tendencies so you can get a more accurate reading during the interview.
  2. Someone who can learn and grow. Cybersecurity is a fast-moving, fast-changing world. The ability to adapt, learn and change with evolving threats and security methods is one of the most important skills you’re looking for. Look for people who can learn quickly and effectively.
  3. Someone different from yourself. It’s human nature to favor candidates who are similar in background and training to you. Watch out for this bias and make sure you don’t dismiss people who are different from yourself in gender, ethnicity, training and career.
  4. Soft skills. Scan resumes for evidence of valuable soft skills like leadership, curiosity, tenacity, passion, problem-solving, teamwork, thriving under pressure and communication skills. While certifications are great, it’s those soft skills that can determine success.
  5. Communication skills. Among the soft skills, the ability to speak to others well is probably the most valuable. You’ll find out more in the interview process, but a resume that shows the person can keep it simple, high-level and in plain language should impress you. Jargon, acronym-filled language shows a candidate who is insecure and lacks perspective. If someone struggles to communicate clearly in a resume, they may also struggle to click with coworkers if you hire them.
  6. Unrelated work. Don’t dismiss unrelated work experience right away. It could point the way to soft skills that contribute to the job you want to hire for. For example, if someone succeeded in a previous job doing research, solving hard problems or leading teams, then you might want to mark those down as a big plus for the candidate, even if that experience wasn’t related to your field.
  7. Specialization and its opposite. You’ll probably want to seek out candidates who excel at complex specialties that might be missing on your current team. Specialists are great if the specialty in question is a major issue on the threat landscape your organization may face in the future. At the same time, you also should favor candidates with some breadth of experience and knowledge as well. For example, familiarity and ability with semi-related roles like networking, engineering, end-user support and the like could prove valuable. Look for candidates that are pretty good at everything, and very good at a few things.
  8. Up-to-date skills. Specialists who know a lot about the most recent threats and solutions are key. Note when people have a good fitting with ransomware or solutions involving automation or artificial intelligence. Those are far more valuable than someone who has only worked with dated threats and solutions. Look for current skills, experience, knowledge and certifications.
  9. Balance. Both prospective employees and hiring managers may be tempted to gravitate to the aggressive, go-getter types. While you do want to hire tenacious, loyal and hard-working employees, you also want staff that can pursue work-life balance and avoid burnout. In fact, burnout is a huge problem in this industry and a key factor in the Great Resignation. The best hire is one who will maintain the presence of mind to stay focused on work. This person won’t quit in a few months because they can’t take the burnout anymore. In fact, an employee who maintains a work-life balance is more likely to stay on the job for longer. That enables you to benefit from the training and experience they gain on the job. Look for keepers who won’t get burned out.
  10. Real-world education. Formal education is great and valuable for prospective employees. But don’t consider a lack of formal education a deal-breaker. Look for backgrounds where people have proven real-world skills. Most cybersecurity workers did not get a degree in cybersecurity or computer science. Your best candidate may be one of these.

Keep an eye on the big picture

While these are specific attributes to look for in resumes, be mindful of the big picture. While you’re hiring one person, you’re also assembling a team. The “best” candidate may not be the best hire. Instead of trying to hire an all-star team, get the most complete and well-rounded team for your staffing budget.

Filling your current position may feel very urgent. Don’t rush. The larger goal is to fill a position with someone who will stick around and learn and grow with you. They’ll need to adapt and grow as you face a new world of challenges.

Lastly, even if you have a huge pile of resumes, don’t be eager to put people aside. Instead, sift carefully. There might be nuggets of gold in that pile, and you’re going to want to find them.

More from CISO

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today