Success Strategies for 

Cybersecurity Hiring

for Human Resources and 

Hiring Professionals

he shortage of cybersecurity talent can make it challenging for organizations and Human Resource professionals to 

hire and retain a skilled cyber workforce. Additionally, organizations need to build a human capital pipeline that 

brings new candidates into the field, and increases representation from under-represented populations. Adoption of 

one or more of the following strategic concepts may allow a hiring manager to identify gaps in their cybersecurity 

workforce and develop career pathways, while reducing "time-to-hire" and improving retention.

ASSESS THE CURRENT CYBERSECURITY ENVIRONMENT

Every individual has a work role in an organization’s cybersecurity workforce. Organizations can use the National Initiative 

for Cybersecurity Education (NICE) guidebook, Cybersecurity is Everyone’s Job to identify work roles by business function, 

defining each role and function as a part of the cybersecurity workforce.

Resources, like the NICE Workforce Framework for Cybersecurity (the NICE Framework), the Department of Labor’s O*Net

tool and the Cybersecurity and Infrastructure Security Agency (CISA) NICCS website can help evaluate workforce needs

and improve the overall understanding of cybersecurity work in an organization.

Create a demographic profile of the cybersecurity workforce and determine if staffing is designed to support diversity 

objectives. Assess the time it takes to hire new personnel (time-to-hire) and annual retention rates. Evaluate salaries, using 

tools like the Department of Labor BLS Wage data by Area and Occupation, against competitive data for the local job 

market and national averages.

REVIEW JOB REQUIREMENTS

Using the NICE Framework, describe the necessary Tasks, and related Knowledge and Skills to build job descriptions 

aligned to business needs. Organizations are re-evaluating requirements such as college degrees, advanced certifications

and experience requirements that might unnecessarily discourage otherwise qualified talent from applying or being 

considered. The U.S. Bureau of Labor Statistics uses a system to assign categories for entry-level education, work 

experience in a related occupation, and typical on-the-job training to each occupation.

STANDARDIZE CYBERSECURITY JOB TITLES

Cyber Threat Hunter? Information Security Analyst? Job titles are different across industry, academia, and government. The 

NICE Framework and the Department of Labor’s O*Net tool can help provide some examples; review the Cyberseek 

website to see other common titles in use.

REMOVE HIDDEN BIAS IN POSITION DESCRIPTIONS AND HIRING

Seek to remove language from job advertising and position descriptions that may discourage diverse candidates from 

applying for open positions, i.e. the use of masculine gendered nouns, or references to military-style approaches. This can 

be difficult to recognize without guidance from experts or the use of text-based tools that both spot biased or coded 

terminology and offer suggestions to use in their place.

SHRM.org identifies masking strategies and blind interview steps to strip identifying information from resumes and job 

applications before sharing with the hiring teams. Invite a diverse team from across the organization to assist in panelstyle reviews of candidates.

T
BE Candidate Centric IN HIRING

Make the application process a candidate-centric experience. Consider posting information on the Career portion of the 

organization website that describes the steps in the hiring process, what interactions the candidate may expect to have, 

examples of interview questions per department or position. Ask for and include anonymized candidate feedback.

SCREEN FOR TALENT WITH APTITUDE OR SKILL ASSESSMENT TOOLS

Asking Who, What, When, Where, Why and How questions that relate to critical thinking skills, at the appropriate level can 

help candidates show analytical, interpretative, evaluation, problem-solving and communication skills.

INTERVIEWING CYBERSECURITY CANDIDATES

Finding the right candidate for cybersecurity positions can be a challenge. HR managers and IT professionals can work 

together to balance performance- based questions with education, skills and organizational culture assessments. Reevaluate the importance of soft skills (such as verbal and written communication skills) in cybersecurity positions. 

Interviews should allow candidates to display soft skills as well as hard skills.

Finally, unicorns are rare – don’t build job descriptions and interviews based on all-or-nothing criteria.

Resources

1. CyberSeek, www.cyberseek.org

2. ISC(2) Report, “Innovation Through Inclusion: The Multicultural Cybersecurity Workforce.“ 

https://www.isc2.org/Research/Cybersecurity-Diversity

3. NICE Guidebook, “Cybersecurity is Everyone’s Job”; https://www.nist.gov/itl/applied-cybersecurity/nice/workforce-managementguidebook

4. U.S. Department of Labor’s O*Net tool; https://www.onetonline.org/

5. Cybersecurity and Infrastructure Security (CISA)’s NICCS portal; https://niccs.us-cert.gov/workforce-development/cyber-securityworkforce-framework

6. U.S. Department of Labor’s BLS Wage Data; https://www.bls.gov/bls/blswage.htm

7. The Aspen Cybersecurity Group; https://www.aspeninstitute.org/team/aspen-cyber-group/ and their report, “Principles for Growing 

and Sustaining the Nation’s Cybersecurity Workforce”; https://assets.aspeninstitute.org/content/uploads/2018/11/AspenCybersecurity-Group-Principles-for-Growing-and-Sustaining-the-Nations-Cybersecurity-Workforce1.pdf?_ga=2.34620580.422262154.1564753566-412768538.1560292992

8. U.S. Bureau of Labor Statistics; https://www.bls.gov/emp/documentation/education/tech.htm

9. NCWIT Checklist for Reducing Unconscious Bias in Job Descriptions/Advertisements; https://www.ncwit.org/resources/ncwitchecklist-reducing-unconscious-bias-job-descriptionsadvertisements

10. CyberSN blog: “Unconscious Bias in Cybersecurity Recruiting (and Advice to Fix It): https://www.cybersn.com/blog/unconsciousbias-in-cybersecurity-recruiting-and-advice-to-fix-it

11. SHRM article, “Can Blind Hiring Improve Workplace Diversity?”; https://www.shrm.org/hr-today/news/hrmagazine/0418/pages/can-blind-hiring-improve-workplace-diversity.aspx

12. Yello, “A Recruiter’s Guide to Improving the Candidate Interview Experience,” https://yello.co/blog/how-to-improve-candidateinterview-experience/

13. SHRM Behavior Competency Interviewing: https://www.shrm.org/resourcesandtools/hr-topics/behavioral-competencies/criticalevaluation/pages/behavioral-competencies-interview-questions.asp

14. SHRM Soft Skills: https://www.shrm.org/resourcesandtools/hr-topics/organizational-and-employee-development/pages/the-hardtruth-about-soft-skills.aspx

15. Forbes article, “Here’s What’s Really Behind the Security Skills Shortage,” 

https://www.forbes.com/sites/forbestechcouncil/2019/08/28/heres-whats-really-behind-the-security-skills-shortage/#657570cf644a