Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Management & Strategy

3 Steps to Thriving in One of Cybersecurity’s 1 Million Open Positions

Cisco’s John Stewart believes there are roughly a million security role vacancies, and this gap is now officially a crisis. We are about a million brains and bodies short of what we need to plug the many growing holes that perforate our highly internetworked environments.

Cisco’s John Stewart believes there are roughly a million security role vacancies, and this gap is now officially a crisis. We are about a million brains and bodies short of what we need to plug the many growing holes that perforate our highly internetworked environments. Complicating this are legions of posers, intentional and uninformed, feeding off the payrolls of organizations desperate to hire anyone, anyone, who understands what AV, OWASP, or CISSP mean.

Here is a simple three-step process to be the security professional companies are looking for: 

Step One: Research the Reasons for the Role

Typically, a new security opening in a company means that something happened. By the time a real job is posted or a recruiter is engaged, there has been some catalyzing event. The first step to getting that job is to research why they’ve decided to post it in the first place. Sometimes the role arises because there is a new and visionary manager or because an existing program has gotten bigger than the team that runs it.

Whatever the case, here’s where to start:

1. Look into the organization to understand the industry it is in and the customers it serves. See if they have had any recent incident disclosures, and check for disclosures or lawsuits involving companies in related markets. Google any new regulations that may be coming their way. Take notes, collect some names and dates, and get acquainted.

 2. Look at their executive team and their board. Sometimes change or investment can be sparked by a new CEO, CIO, CFO or CISO coming from another company that invested more heavily in security, or had some security problems of their own. Check out their work history on LinkedIn or Google.  Take notes on any media interviews or presentations they may have given, and look for any places where your experiences may overlap. Having a good sense of this will help you better understand how you can make them successful.

Step Two: Develop a comprehensible approach

Advertisement. Scroll to continue reading.

The companies who have the most interesting jobs with the broadest scope will likely not know very much about the details of security. Helping them understand why you are a great choice first requires that you educate them on what it is you do. Come equipped with a rich description of your own background that is understandable and relevant to the company.

Here are a couple of specific things to do:

1. Become familiar with the language of the industry you are thinking of moving into.  Retailers, hospitals, banks, and utilities all have different vocabularies, yet all think about common areas of concern like data breaches, mobile security, and monitoring. When you understand the industry dialect, your discussions will be smoother and it will be clear that you can hit the ground running.

2. Develop your own views on security challenges for companies like the one you are visiting. Are they growing quickly through acquisition and feeling the pains of integration complexity? Take the time to look for industry-specific press mentions of security and note the problems, and solutions that are featured. With this, create your own initial view on how the average company in the space can improve.

Step 3: Start with a call and targeted questions

You now are knowledgeable on the company, the team, and you have an idea of the problems they may be looking to solve. Finish the picture by establishing yourself as an exceptional candidate, with a call.  When you speak with the recruiter or HR executive, ask to follow-up with someone who works there. This gives you the chance to refine your approach and test your assumptions.

Create relevant questions to help you fill in your assessment of the issues, write them down, and have them near you. Avoid making it obvious that you are reading from a script. Don’t look for too much technical detail or information about any security events, because most companies won’t be comfortable sharing it. Ask about the team, the projects, and the rationale behind the creation of the role.  Beyond making you unexpectedly prepared for the interview process, you will find that these calls are much more interesting than the usual blather.

The Results?

If you do this kind of homework, you will not only be better prepared, but also a better candidate. You will also have a head start as you look at any other opportunities in that same industry.

And here is the punchline. This process is great for finding a new gig, but it can also help you reassess the way you are doing the job you have right now. It’s important to better understand your peers and leaders, be sensitive to the business concerns of others in your industry, and flesh-out how you think organizations can improve. Revisit these steps regularly, and if you keep your focus on how you can remain attractive to those that worry more about keeping the doors open than keeping the network ports closed, you will be more than just one of the million.

Related: The Harsh Truth o
f the Cybersecurity Talent Gap

Related: Recruitment Challenges Continue to Plague Cyber Security

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

CISO Strategy

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Cybersecurity Funding

2022 Cybersecurity Year in Review: Top news headlines and trends that impacted the security ecosystem