Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

How Diversifying Your Cybersecurity Team Can Help You Combat the Cyber Skills Shortage

What if the current handwringing around a cyber skills shortage was overdone? What if the problem facing cybersecurity isn’t the lack of the right training or the correct academic degree, but the failure to apply the best lens through which to assess those entering the field?

This question urgently matters for business and our country because last month the federal government launched a $26.5 million grant scheme to support the cybersecurity workforce. Companies are scrambling to understand what skills they need to bolster their cybersecurity capacity.

Hats off to the government for recognising the importance of Australia’s cybersecurity workforce and actively working to strengthen it.

But who exactly is this workforce?

Almost every company in Australia needs to know the answer to this question because it will influence whether we have the right workforce in place to handle our cybersecurity future.

And here’s the answer: it’s probably not who you think it is.

If the first image you have in your mind is a hoodie-clad basement dwelling hacker with a sticker bedecked laptop, pizza in hand, you’re thinking of only a small part of the actual cybersecurity workforce.

Sure, these people exist, but after three decades in the industry, I’d argue that very few of today’s cybersecurity luminaries took anything that remotely resembles what most people would consider a normal cookie cutter path into this industry today.

Here’s the reason cookie cutter doesn’t cut it: cybersecurity is an ever-changing landscape of threats, challenges and opportunities that requires adaptable, fluid and creative thinkers and doers. It also requires a mix of people who are good with other people, diplomats and those calm headed in a crisis.

Well-rounded humans have thrived in cybersecurity from the beginning because while coding is literally binary, cybersecurity is not. In the face of a cyber degree explosion, we’re still hiring humanities grads, lawyers and those told they must learn to code but never did, because the optimal cybersecurity team is a truly diverse one.

As the old adage goes, “science can tell you how to bring dinosaurs back to life, humanities can tell you why not to”.

I’m writing this now so that we don’t have a deficit of these kinds of people later because we fall into the trap of being too afraid to hire outside the box. What we’re seeing is too many organisations looking to close the cybersecurity resource gap the wrong way. Instead of diversifying their hiring set, they are narrowing it.

Ultimately, it’s a diversity of thought and perspective that gives the balance, depth and insights to crack the problem.

Here are some tips for building this diversity in a cybersecurity staff.

Search For Talent Far and Wide

  • Start with referrals from people you know and trust, and the people they know and trust.
  • Avoid narrowing your search to the same people with the same cybersecurity degrees or backgrounds. An army of clones is a predictable foe.
  • Forget about perfect. Instead, ask if you can build upon this person and skill them up in the areas that their background or experience is lacking.
  • Even if specific technical requirements are indeed a part of the hiring criteria, on-the-job experience should usually outweigh professional certs and degrees.
  • Age is no indicator. We’ve hired people as young as 21 and seniors. Different learning styles and different perspectives are all valuable contributors.
  • Remember to write your job description carefully, and avoid gender-charged terms like empathetic, or aggressive.
  • Don’t use the same job description for a recently vacated role. The former employee whose role you’re trying to fill likely grew into that job and you want their replacement to do the same, so you may actually need to delegate some of the responsibilities the former employee had taken on during their tenure.
  • If you’re using a recruiter, ask for all the resumes (sometimes the recruiter’s filters and personal biases mean you may miss the right candidate).
  • Work closely with your Talent Acquisition (TA) team. We have our TA team annotate every CV with their thoughts, and the hiring manager reviews almost every application.

Get the Interview Right

  • Stay consistent with your interview questions, don’t rely solely on gut feel.
  • Look for evidence of empathy, awareness, innovative thinking, creativity and problem solving.
  • Ask what they do in their time off and how they keep across what’s happening in the cybersecurity industry.
  • Probe a little to see if someone expresses a strong opinion on cybersecurity and then see how they handle this expression  are they impassioned, excited, engaged, expert or too over-the-top?
  • Identify the non-negotiable skills and test for them. One of our specific tests? We test to see if people can really write.
  • It takes a panel. Never let one person do all the interviewing.

Hiring Cybersecurity Talent From Within

  • Consider using staff from other departments if you have them. Try them out. A secondment is a great opportunity to see how someone performs on the cybersecurity coalface.
  • Think hard about whether you actually need to hire. You might be able to get better use out of what you already have, both people and tools. There might also be jobs that are better outsourced.
  • If you do need someone to hit the ground running, think about further delegating parts of the role to lighten the load for a new starter. If that’s not possible, maybe you need a consultant.

The future of cybersecurity talent concerns all of us and we need to get it right.

Cybersecurity is broad and we need our approach to cybersecurity talent to be broad too.

This article originally appeared in SmartCompany.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More