Let's summarise some good points here, and maybe add some new:
- Recruiters very often cannot distinguish between a CISSP and a Cisco CCSP or a CSSP (cloud). Let alone differences between CISSP, CRISC, CISA or CISM. For many recruiters that is just a soup of 'the security thing'.
- Sector experience: Agency recruiter telling that "Your CV is a perfect match.. Except.. The client insists on someone who has 'banking experience'" . Well, explain them that people are not born with that. Maybe if they start with hiring a security-competent and experienced person, they can bet that in around one or two years they will certainly have also that 🙂 -Is it born first the experience or the candidate?
- Language (cultural?) barriers In some countries (e.g. Switzerland) some company may search for many months (over 9 months!!) for experienced security candidates, although they insist on a fluent German-speaking mandatory requisite even when the role is clearly going to be working in an international setting. Doesn't the recruiter realise that maybe there are not so many Security experienced interested candidates speaking German...? And no, one should not be tempted to think that asking for fluent German is a veiled form of racism. (Note that in Europe German is spoken in: Germany, Austria and Switzerland - plus a couple of countries adding to the same inhabitants of Denver. English speakers in comparison are incomparably easier to find.)
- Pay & Skills We want Security superman (list here all security certs...), 10+ years management experience, but also hands on, ready to work in a stressful environment (read: handle security incidents) and possibly holding an MBA. Nonetheless, we publish a salary which is 20% less than what we publish for a Cloud Architect with 3 years experience. In other words, we could pay you like an Agile/Scrum newcomer...
- Reporting structure Yes, you will probably not report up to the CISO under the CEO. Most likely if you will ultimately report into IT. To the CIO if you are lucky. If not, below. Or maybe the CFO. Why not the CCO..? Anyway to someone who will not understand what you would need to at least 'attempt' to improve the "organisational security posture". Risk Management? Committees? Mmm.... Let's see... where we are with that? CMMI... 2-3 ? Let re-talk about this another time..
- Team Obviously your Team will be understaffed. So what? Every Team is understaffed, you know? But yours will be MORE understaffed, is it crystal clear?? You know...Security is not a profit center... (Would those be the moments when you would think that you should have studied Economy & Marketing and be in Sales Team..?)
- Skills Gap Hahhahahaha... Ehm, excuse me -I lost the aplomb for a sec :D.. Ok, this one is not serious, right? In average takes anywhere from 3 to 9 months to land a job in Security, not always decently paid. We are talking for people with more than 5 years experience. The higher the experience, the...harder!!! (should not be the reverse?!?!?!). Skills gap seems to be simply a joke. The reality seems to be that a lot of 1st line incident handlers or firewall specialists / SIEM engineers are sought (read: underpaid low-skilled cannon-fodder). But... see next point 🙂
- Career Path The EVPs or the MDs or the CISO itself will be (nearly) always... what they call "non-technical" people. Translation: Almost never they do not hold any kind of Security certification. Not only they are non-technical. They have often no real Information Security background or they have covered few roles and then have been rocketed to the top. Very often they just got the job because of "good social skills". They might sometimes hold an MBA. Plenty of examples on Linkedin - And yes, sure that there are exceptions.
(Favorite Movie Trailer: Maverick).
Now, who would suggest his/her children to work as an Information Security Professional?
Be smart, next time teach your kids how to distinguish between Futures, Hedge Funds and Swaps... 🙂
