Staffing for cybersecurity has always presented a challenge. But with the old skills shortage combined with the new “Great Resignation,” hiring the right candidates has never been more important.

The first step in looking at any prospective hire is to review resumes. People often don’t appreciate this process. It’s easy, for example, to overlook the best fit. You might toss aside the resume of someone who might be an outstanding candidate because of factors that really don’t matter.

Top Ten Factors in Hiring a Cybersecurity Professional

Here are the ten most important things to look for in resumes for your cybersecurity positions. With these, you’ll have the best chance at the right hire:

  1. Accuracy. Look for signs of exaggerated skills and experience, and also the opposite — someone who is downplaying their own achievements. It can be difficult for some people to ‘sell themselves’ with accuracy, and this ability is largely governed by personality. Some candidates feel the need to overstate their qualifications, and others are modest and self-effacing. Try to get a sense of the candidate’s tendencies so you can get a more accurate reading during the interview.
  2. Someone who can learn and grow. Cybersecurity is a fast-moving, fast-changing world. The ability to adapt, learn and change with evolving threats and security methods is one of the most important skills you’re looking for. Look for people who can learn quickly and effectively.
  3. Someone different from yourself. It’s human nature to favor candidates who are similar in background and training to you. Watch out for this bias and make sure you don’t dismiss people who are different from yourself in gender, ethnicity, training and career.
  4. Soft skills. Scan resumes for evidence of valuable soft skills like leadership, curiosity, tenacity, passion, problem-solving, teamwork, thriving under pressure and communication skills. While certifications are great, it’s those soft skills that can determine success.
  5. Communication skills. Among the soft skills, the ability to speak to others well is probably the most valuable. You’ll find out more in the interview process, but a resume that shows the person can keep it simple, high-level and in plain language should impress you. Jargon, acronym-filled language shows a candidate who is insecure and lacks perspective. If someone struggles to communicate clearly in a resume, they may also struggle to click with coworkers if you hire them.
  6. Unrelated work. Don’t dismiss unrelated work experience right away. It could point the way to soft skills that contribute to the job you want to hire for. For example, if someone succeeded in a previous job doing research, solving hard problems or leading teams, then you might want to mark those down as a big plus for the candidate, even if that experience wasn’t related to your field.
  7. Specialization and its opposite. You’ll probably want to seek out candidates who excel at complex specialties that might be missing on your current team. Specialists are great if the specialty in question is a major issue on the threat landscape your organization may face in the future. At the same time, you also should favor candidates with some breadth of experience and knowledge as well. For example, familiarity and ability with semi-related roles like networking, engineering, end-user support and the like could prove valuable. Look for candidates that are pretty good at everything, and very good at a few things.
  8. Up-to-date skills. Specialists who know a lot about the most recent threats and solutions are key. Note when people have a good fitting with ransomware or solutions involving automation or artificial intelligence. Those are far more valuable than someone who has only worked with dated threats and solutions. Look for current skills, experience, knowledge and certifications.
  9. Balance. Both prospective employees and hiring managers may be tempted to gravitate to the aggressive, go-getter types. While you do want to hire tenacious, loyal and hard-working employees, you also want staff that can pursue work-life balance and avoid burnout. In fact, burnout is a huge problem in this industry and a key factor in the Great Resignation. The best hire is one who will maintain the presence of mind to stay focused on work. This person won’t quit in a few months because they can’t take the burnout anymore. In fact, an employee who maintains a work-life balance is more likely to stay on the job for longer. That enables you to benefit from the training and experience they gain on the job. Look for keepers who won’t get burned out.
  10. Real-world education. Formal education is great and valuable for prospective employees. But don’t consider a lack of formal education a deal-breaker. Look for backgrounds where people have proven real-world skills. Most cybersecurity workers did not get a degree in cybersecurity or computer science. Your best candidate may be one of these.

Keep an Eye on the Big Picture

While these are specific attributes to look for in resumes, be mindful of the big picture. While you’re hiring one person, you’re also assembling a team. The “best” candidate may not be the best hire. Instead of trying to hire an all-star team, get the most complete and well-rounded team for your staffing budget.

Filling your current position may feel very urgent. Don’t rush. The larger goal is to fill a position with someone who will stick around and learn and grow with you. They’ll need to adapt and grow as you face a new world of challenges.

Lastly, even if you have a huge pile of resumes, don’t be eager to put people aside. Instead, sift carefully. There might be nuggets of gold in that pile, and you’re going to want to find them.

More from CISO

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…

Reporting Healthcare Cyber Incidents Under New CIRCIA Rules

Numerous high-profile cybersecurity events in recent years, such as the Colonial Pipeline and SolarWinds attacks, spurred the US government to implement new legislation. In response to the growing threat, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in March 2022.While the law has passed, many healthcare organizations remain uncertain about how it will directly affect them. If your organization has questions about what steps to take and what the law means for your processes,…

Charles Henderson’s Cybersecurity Awareness Month Content Roundup

In some parts of the world during October, we have Halloween, which conjures the specter of imagined monsters lurking in the dark. Simultaneously, October is Cybersecurity Awareness Month, which evokes the specter of threats lurking behind our screens. Bombarded with horror stories about data breaches, ransomware, and malware, everyone’s suddenly in the latest cybersecurity trends and data, and the intricacies of their organization’s incident response plan. What does all this fear and uncertainty stem from? It’s the unknowns. Who might…