Tips for Writing Better Infosec Job Descriptions

Security leaders frustrated with their talent search may be searching for the wrong skills and qualifications.

INSECURITY CONFERENCE 2017 - Washington, DC - Advanced security tools cant reach their full potential without qualified employees to operate them, said Dawn-Marie Hutchinson, executive director at Optiv, at Dark Readings INsecurity conference here last week.
In her presentation entitled Finding and Hiring the Best IT Security People, Hutchinson described her own challenges in finding the right talent. As the former CISO of Urban Outfitters, her challenge wasnt in securing the budget for security tools, but finding people to run them.
Some businesses have both tools and talent but struggle when the two dont align, she explained. You might be well-staffed with employees who lack skills to be helpful. To find the right employees, Hutchinson suggested reevaluating job requirements and approaching the hiring process similar to how you would build a security program.
The key is becoming more involved in the hiring process and being more specific when looking for candidates. Security leaders looking for talent often tell their human resources department theyre seeking candidates with certain skill sets. HR then compiles a job description cobbled from descriptions they find online, which may include certifications or number of years of experience.
As a result, many companies use similar job descriptions for open positions, and applicants tailor their resumes to suit them. Many talented people who could be successful are weeded out because they lack specific credentials and experience they may not necessarily need for a specific role.
When you go looking for people, be mindful, said Hutchinson. The number of years isnt as good as the quality of years and most recent experience … lets not [cross off] candidates because they dont have experience in systems that dont exist anymore.
Compliance requirements also block potential candidates. Many qualifications added for compliance; for example, familiarity with HIPAA, are things a smart individual could figure out and learn. However, because HIPAA isnt on their resume, they dont make it to the interview. Similarly, certifications like the CISSP are easy hits and make it easy to narrow down the candidate pool but could prevent security teams from gaining valuable talent.
We need to find people where they are and develop them into what we need them to be, she noted.
Think about what you want your employees to do, and how you want them to operate, and build your staffing strategy around it. Whats your desired outcome? Hutchinson asked. Shaping a job description based on outcomes will result in a completely different posting.
So where do you look for job candidates? Hutchinson recommended networking with peer groups and looking to your internal tech staff to find talent. Former military members are also potential candidates; check with veterans organizations or the Wounded Warrior project to find people looking for work.
Its also worth your while to hunt for candidates in new, unexplored pools. Business school graduates could be particularly valuable at a time when security pros need to explain risks and technology issues with board members. Security teams need people who can speak to the business, write, and communicate well.
But hiring is just one piece of the equation. Retention of loyal employees is another.
What we really need to do is start figuring out how to keep them, said Hutchinson. Most people who leave are swayed by higher salaries. Fair compensation is an obvious must-have; if you dont pay your employees fairly, you will lose them. No perk will change their mind.
That said, it takes more than money to keep talent. You need to understand what motivates your employees. Many people swap jobs because they want more challenging or exciting work. They also highly value mobility and work flexibility, which the most preferred employee benefit from 2014 to 2016, she pointed out.
Make them excited about being at work, excited about being in security, she emphasized. It will make them loyal to you … give them something they can get behind.
If you cant retain talent, it will ultimately cost your business. Not only will you have to invest time and resources into vetting new candidates, youll have to show them the ropes. It costs about nine months of someones salary to get them on-boarded, Hutchinson said.
Related Content:
Cybersecuritys Broken Hiring Process
Sallie Mae CISO: 4 Technologies That Will Shape IT Security
5 Free or Low-Cost Security Tools for Defenders
First US Federal CISO Shares Security Lessons Learned

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Tips for Writing Better Infosec Job Descriptions