- [Narrator] All right, folks.
So far we've focused a ton of energy on hiring.
But what about retention?
Fact is, we've reached a point in the cybersecurity industry
where retaining talent is almost as challenging
as hiring talent.
We'll focus on some specific retention strategies
in later chapters,
but before we go down the path of all the things we can do
to retain our employees,
let's chat about why retention is important.
Why do we even care?
Remember the questions I posed
at the beginning of the course to keep us grounded
and focused on the team's desired outcome?
Of course you do.
But I'll remind you, just in case you forgot.
The first is, what is the top priority of my security team?
And the second is, what are the team's high level roles
and responsibilities?
Now why did I bring that up?
The reason we always want to refer to these two questions
as security leaders is that it will remind us
of why we exist and why our teams exist
and help guide our decisions a bit.
All right, good talk to you.
But how exactly does this relate to retention?
I'm so glad you asked.
You really do ask all the great questions.
Now I have one for you.
What is the overall mission of your security team?
I'll pause for a moment and let you think about it.
Okay. Time's up.
Now I obviously can't hear you,
but I'm guessing your answer was something along the lines
of reduce the organization's cyber risk,
or maintain regulatory compliance,
or respond to threats
within the organization's infrastructure,
improve the organization's security posture
or something similar.
Right? Okay, one more question.
Think about your response
and the example responses I just provided.
What do they all have in common?
The answer is all these missions
or security program outcomes are continuously developed,
monitored, measured and modified,
so improvements occur over time.
Tying this back to retention,
the longer an employee remains on your security team,
the better they understand business requirements,
internal processes, technology solutions and so on.
They also have historical context regarding things
like why certain decisions were made,
legacy technology, retired solutions and processes,
lessons learned, et cetera.
As we all know, context is critically important
in the world of cybersecurity.
The more detail or experience we have,
the better our decisions become.
This perspective makes long term employees invaluable
and should therefore place employer retention at,
or very near, the top
of every security leader's priority list.
When you lose a resource
that has been a strong member of the team for several years,
your ability to mature or improve takes a hit.
Your security program either takes several steps backwards
because you had to start over with a brand new resource
or at the very least is at a standstill
while you bring an internal resource
up to speed to assume a new role
and or take on additional responsibility.
It is much easier to retain your top mid
to senior level talent
and snap in new junior resources
to handle simple non-critical tasks
than it is to snap in a new, mid to senior level resource
that will need to do a great deal of catching up
before they can begin to take on
highly complex, business critical initiatives.
Not to mention, we've already discussed
how challenging it can be to hire talent at this level,
so we probably want to avoid that.
Now that we're aligned on the problem,
let's jump over to the next section
where we'll begin to unpack the solution.