How to Recruit Information Security Talent

TL;DR

Recruit scarce information security talent by treating hiring as a forward-looking sales process, aligning executives and human resources with relevant data, and removing internal delays. Candidates operate in a seller's market, so employers must evaluate future value, offer market-appropriate compensation, respond promptly, and create an efficient process that demonstrates why capable people should join the team.

Transcript

Thanks everybody for coming. Um, my name is Lee Kushner, and um, I'm gonna talk about something that's been kind of permeating the conference, um, the concept that there's a huge talent shortage in the information security industry, that people are having significant troubles recruiting. And, um, you know, my hope is that you come out of the presen... Read More

Key Insights

• Recruiting is an essential leadership responsibility because a solid team makes a security leader's job easier, improves efficiency, supports requests for resources, and helps demonstrate value. A leader who cannot assemble capable people may struggle to build the security program the organization expects.
• Security recruitment is difficult because its outcome depends on many external variables, especially human behavior. A leader can invest substantial time while receiving little yield, making recruitment feel unusually uncontrollable compared with other responsibilities that have clearer inputs, processes, and results.
• Candidate value is forward-looking, not merely a record of previous jobs or earnings. Employers should consider what a person's skills could contribute in the new environment and what the open market would pay for that contribution, rather than automatically basing compensation on a standard increase.
• Information security hiring operates according to supply and demand. The transcript cites reports of one million open security positions and an ISACA survey in which only 24% of respondents filled positions within three months, leaving 76% unable to do so in that period.
• Candidates behave more selectively when they have many real or perceived options. In a seller's market, they scrutinize prospective employers more intensely, make additional requests, and expect an opportunity to reflect the market value of scarce skills rather than the limitations of an employer's existing process.
• Internal inefficiency can prevent successful recruitment even when qualified candidates exist. Delays in identifying prospects, scheduling interviews, producing offer letters, completing background checks, approving salaries, and reaching decisions create obstacles that employers must address if they want to compete effectively.
• Stakeholder alignment is necessary because executives, human resources, managers, and interviewers influence budgets, compensation, offers, and process speed. Security leaders should bring these groups into the discussion early and establish a shared understanding of the talent problem and its business consequences.
• Relevant data makes the case for recruitment resources more persuasive. Leaders should tailor evidence to what each audience understands, combine market information with internal facts such as vacancy duration, explain why the process is failing, and connect unfilled roles to the organization's ability to protect itself.

Questions & Answers

Q: How can security leaders recruit scarce talent effectively?

Security leaders can recruit more effectively by treating recruitment as a central leadership and sales responsibility. They should align executives, human resources, managers, and interviewers around the hiring need, support requests with relevant market and internal data, remove delays from the process, assess candidates by future contribution, and offer compensation that reflects the value of their skills in the open market.

Q: Why is information security recruitment so difficult?

Information security recruitment is difficult because demand for skilled people exceeds the available supply, while hiring outcomes depend on many factors outside a leader's direct control. Candidates have real or perceived alternatives, and internal steps such as identification, interviews, salary approval, offer production, and background checks can slow decisions. Significant effort can therefore produce little hiring yield.

Q: How should employers evaluate security candidates?

Employers should evaluate security candidates by considering the value they can provide in the future, rather than focusing exclusively on completed duties, previous experience, or current earnings. The relevant question is what the candidate's skills would be worth in the open market and how those skills would help the organization build its program, improve protection, and meet its commitments.

Q: Why should previous salary not determine a job offer?

Previous salary does not necessarily represent the market value of a candidate's skills or the value that person could create in a new role. The transcript challenges the practice of simply adding a standard percentage to prior earnings. Compensation strategy should instead consider what employers would pay for the candidate's capabilities in an open, competitive market with scarce information security talent.

Q: How does a seller's market affect security hiring?

A seller's market gives candidates greater leverage because they believe they have multiple employment options. As a result, they can be more selective, examine prospective roles more carefully, and make greater demands or requests. Employers must recognize this imbalance and design their attraction strategy, compensation, communication, and hiring process around what qualified candidates need to choose the opportunity.

Q: What internal delays can cause recruitment to fail?

Recruitment can fail when organizations take too long to identify candidates, move them through interviews, reach a decision, produce an offer letter, approve compensation, or complete a background check. Each step can become an obstacle. Because candidates in a scarce market have alternatives, an inefficient process can weaken the employer's ability to secure capable people before another opportunity does.

Q: How should security leaders gain executive support for hiring?

Security leaders should give executives relevant data that explains the scarcity of talent, the organization's specific hiring obstacles, and the business impact of leaving positions vacant. Evidence should come from sources executives can readily understand and should use clear cause-and-effect reasoning. Leaders should connect staffing directly to their ability to build a capable program and protect the organization.

Q: Why is team building critical for a security leader?

Team building is critical because a security leader cannot depend solely on personal effort to fulfill the organization's security responsibilities. A capable team improves efficiency, supports access to resources, demonstrates organizational value, and enables the construction of a sound security program. Without that team, the program may fail, the environment may remain insufficiently protected, and the leader's position may be threatened.

Summary & Key Takeaways

• Information security recruitment is difficult because leaders depend on candidates, human resources, executives, interviewers, budgets, and approval processes they cannot fully control. Despite that uncertainty, recruiting remains essential because a capable team enables a security leader to operate efficiently, secure more resources, demonstrate value, and build a stronger security program.

• Recruitment strategy should focus on a candidate's future contribution and open-market value, rather than relying only on past duties, previous compensation, or a standard percentage increase. Scarce security professionals recognize that they have options, so they scrutinize opportunities closely and may make greater requests concerning compensation, process quality, and the employment decision.

• Security leaders should build support among executives, human resources, managers, and interview teams by presenting relevant evidence about hiring conditions, business consequences, and internal obstacles. They should also respond promptly to requested deliverables, use clear cause-and-effect reasoning, advocate for the value of capable hires, and request concrete commitments from their partners.