How do you evaluate cybersecurity skills in job candidates?

??? Prioritize cybersecurity assessment with rigor! I'd emphasize integrating technical and soft skills evaluations when hiring for cybersecurity roles. While deep technical acumen ensures a candidate's readiness to combat security threats, soft skills like collaboration and adaptability foster a cohesive team environment. Incorporate real-world scenarios in skill tests to gauge candidates' practical problem-solving abilities. Ethics should never be sidelined; always ensure a candidate's aligned with ethical and legal benchmarks in cybersecurity. Why? Because a robust cybersecurity team isn't just about thwarting threats but nurturing trust, integrity, and collaboration. ????

The international standard of ISO27000 is important, most frameworks have it at the root of their definitions. Explaining companies dependency on the CIA triad. It is like asking someone to pick their favorite parent or child but some organizations favor different parts. If I say finance, law, or manufacturer I expect them to be able to explain why one is a higher priority without forgetting about the importance of the other two.

Conduct Technical Interviews: Use technical interviews to assess a candidate's hands-on knowledge and problem-solving abilities. Ask questions and give scenarios that relate to the specific cybersecurity skills required for the position. Some examples of questions might

Defining job requirements effectively is the foundational step. It ensures a clear understanding of the skills needed while avoiding overly intimidating or unrealistic expectations. By thoughtfully defining the job criteria, you pave the way to identify candidates who possess the specific technical expertise, problem-solving abilities, and soft skills essential for the role. Moreover, this approach ensures that candidates are not discouraged by overwhelming or unattainable requirements. It's about aligning the role's expectations with the candidate's capabilities to foster a successful and fulfilling match for both the candidate and the organization.

Defining the job requirements is a critical step before initiating the candidate search. Utilizing frameworks such as the NICE Cybersecurity Workforce Framework or the Cybersecurity Skills Matrix can help articulate the roles, tasks, and competencies associated with different cybersecurity functions. It's essential to clearly outline the level of responsibility, work environment, and specific challenges or risks associated with the position. By doing so, you create a comprehensive understanding of the skills and qualifications required, making the recruitment process more targeted and effective.

I would be very careful using automation as I have found instances where for instance a candidate doesn’t have a Bachelors degree in IT but has a Masters or PHD and if the requirements call for a Bachelors it’s an automatic deny. This is one example, the job notice must be written and these scenarios need to be considered or some corporate past positions either inflate a title and the person isn’t really qualified or they are understated.

One thing that I've noticed helpful in accessing entry level applicants is analyzing the the projects and certifications sections of their C.V. Someone willing to push themselves to learn new things in Cybersecurity is a good fit in my books.

I start by discussing the role requirements with the recruiting team to ensure necessary and "Nice to have" skills are well understood. Once I start receiving vetted resumes, I review the years of experience in critical areas (e.g. Python, management, etc.). I generally move forward with the interview if someone is strong in most of the required areas. I take fairly hands on, analytical approach to reduce the risk of overlooking anything important.

Screening resumes in the cybersecurity field poses significant challenges due to the scarcity of skilled candidates, coupled with the diverse and intricate nature of the industry. This often leads to only a few candidates meeting the full spectrum of job requirements. To optimize this initial hiring phase, it's crucial for hiring managers to set clear minimum criteria, ensuring that recruiters comprehend these benchmarks. Leveraging an advanced Applicant Tracking System (ATS) can efficiently capture and filter applicants based on specific criteria, such as minimum years of experience with various tools and technologies. This method refines the candidate selection process, focusing on core technical prerequisites.

Don't be ashamed to ask for help, especially if you don't have a technical background. I've had HR ask for my help at some point to interview someone.. The candidate didn't know the difference between HTTP and HTTPs. When I asked why am I interviewing this person, who was considered for a consultant position at a client site, I was told that "they said they know security on the phone". Shameless plug, I now help organizations find their IT and Cybersecurity talent. Feel free to reach out!

In cybersecurity we face a myriad of challenges that often span multiple domains. Therefore, having a conversation to test a candidate's depth of knowledge is critical, especially if they'll be client facing. Additionally, I think it's key to have a candidate demonstrate their skillset with a hands on assignment with a deadline. Hitting the mark with an assignment alongside a solid interview is a recipe for success. If a skillset is outside of my area of expertise, I partner with subject matter expert to validate.

Employing a Simulated Scenarios and Exercises approach is highly effective in assessing a candidate's core competencies, strengths, and limitations. It allows for the exploration of a vast array of situations derived from past incidents and projects, ensuring a diverse spectrum of interview questions tailored to the company's and team's specific job requirements. This approach not only gauges a candidate's immediate problem-solving abilities but also their adaptability and strategic thinking, essential in an environment that is constantly changing.

Often the information provided about "soft-skills" tell me a lot about a candidate. This information can provide insight to the abilities that may not be as tangible (such as a certification or degree) and those skills can often be the way that they build the relationships required for some of these roles.

Understanding types of bias for their analysis and tool evaluation. A good analyst can list 3 things they need improvement on and 3 things they can teach others. Tools should be based on needs vs requirements vs cost ( Pugh matrix) Understanding the importance of work to alert ratio (poisson factorization) I think anyone can learn and be efficient in any role, but are they suited for it. We all have bias, but everyone cannot overcome those icebergs.

The interviewer's questions should. in part, be aimed at detecting the character and competence of the candidates - all relevant to the role, of course. These aren't the exact questions, but the Q&A should help determine: How do they solve problems? What do they do to keep projects and tasks in order? Do their answers demonstrate some of the nuances of professional knowledge and problem-solving? How do they treat the interviewer (and team, if applicable) during the interview? There can be 4 areas to determining the right fit: Profession, Product, Process, and Personality. Their level of comfort with each of these as it pertains to the interviewing company can help gauge the right candidate.

Define job Requirements Review Resumes Technical Assessments Behavioral Interviews Security Case Studies Red Team/Blue Team Exercises Reference Checks Certifications Continues Learning and Adaptability

To anyone looking for a cybersecurity role, I recommend tailoring your resume to speak to the role requirements. Your resume should generally be 1-2 pages max and easy to grasp. Make it as simple as possible for the hiring manager to understand your "story" and your qualifications for a role.