- I provide mentorship and advice
to countless individuals looking for ways
to break into the cybersecurity industry.
The most consistent feedback I receive is the frustration
they feel when viewing job descriptions
for entry level cybersecurity roles
that either require too broad a skill set
or have unrealistic certification requirements.
There are a number of reasons for this,
but the bottom line is we have to get better
because the better and more realistic we are
the better and more prepared our talent can become.
Let's check on our friend Chris
at Global Bank International.
As the saying goes, no good deed goes unpunished.
Chris was so happy with our proposal
for the SOC analyst role, he gave us major kudos
and more work to do.
As Chris begins to build his team, he wants to make sure
that job descriptions are clear,
specifically those targeting entry level talent.
So he's asked us to review
the qualifications and requirements
for a couple of entry level job descriptions
and provide him with our thoughts.
I'll be putting on my entry level candidate hat
so we can have some fun with this.
All right, exhibit one.
So far so good.
I know all about networks and logs and packing analysis
and I'm pretty good with these operating systems.
Malware and forensics check.
I'll tell the hiring manager all about my home lab.
This is awesome.
Eh, I don't have any coding skills,
but maybe it's just a nice to have, I can navigate that.
I'm going to go for it.
Oh, wait.
I also have to wear the governance risk and compliance hat,
manage vulnerabilities and be the help desk
and access control manager.
I don't even know what this job is anymore,
but what I do know is that it's not for me.
End scene.
Let's break character and review.
This job description is a classic example
of an organization that is unclear
on where entry level talent fits within their organization.
An easy way to fix this description is to prioritize
the skills that are required for the role.
Then list the others as nice to haves.
As written, this description comes across
as a company that wants too much
from a cybersecurity newcomer.
And if they want too much on paper, it's highly likely
they'll also want too much in practice.
Exhibit number two.
All right, I'm back into character.
All right, we're off to a great start.
I just completed my bachelor's degree.
So glad that was worth it.
I'm good on the experience requirements
and this is right up my alley
since I currently work for my local electric company.
Wow, this job is so me.
I learned all about leading cyber security programs
as part of my degree program.
I'm always up for learning new things
and team collaboration is my jam.
Okay. Where do I sign up?
Oh, no, I don't have any of these certifications.
I'm pretty sure I haven't even been
in the industry long enough to get certified
even if I were to pass these exams.
Ah, bummer, guess I'll keep looking.
End scene.
(groans) We were so close on that one.
This is an unfortunate, but very common mistake.
The CISA and CISSP both require five years
of industry experience.
The CRISC is slightly less,
requiring a minimum of three years, but that's the top end
of the required experience listed in job description.
If we take a look at the list of technical requirements,
it appears that the role is more hands-on
and technical in nature.
Certifications like Security+, Network+
or any other certification that would validate
some of the technical skills listed here
would've been more appropriate.
Whew, we've covered a lot and you're still with me.
That's a big deal.
Hang in there because now that we've got
the pipeline engine started,
we're going to move on to the next section
and dig into how we keep our pipelines healthy.