Redefining the Role of a Cybersecurity Professional

The cybersecurity industry has been around for more than 30 years and undergone exponential growth, but in many ways it is still defining itself in the face of evolving threats. Technology and process are predictably playing a role. But diversity of talent has also become increasingly important to the success of security organizations and is redefining the role of a cybersecurity professional.

The Changing Faces of Cybersecurity Professionals

The words "computer engineer," "security researcher" or even "hacker" tend to evoke the quintessential image of a young male wearing a hoodie typing on his laptop. However, anyone who has worked in cybersecurity would know differently. Today’s average cybersecurity incident, for example, certainly involves computer engineers and the like, but also lawyers, writers, communicators, investigators and a varietal of other expertises based on the nature of the cyber incident. If an attack was state-sponsored and involved journalists, maybe a business and human rights professional was required. Or if an attack involved a criminal operation running a business email compromise scam, perhaps an expert in internal employee communications is needed.

Day-to-day work also shows breadth of new talent in security organizations. For every security bug found in an app, there is a team of people involved in triaging and resolving that bug. This certainly includes the software developer of the app, but also the security team with knowledge of attack vectors, the organizational leaders budgeting the operation, internal engagement teams developing awareness campaigns, and generally people who may think differently about problem solving. In other words, for every bug, imagine 100 people working to fix that bug, with each person bringing unique value toward reducing risk.

The Ideal Cybersecurity Professional

Skill sets like coding and legal analysis can be taught. Instincts and strategic sensibilities, however, can be much more difficult to come by. In a cybersecurity context, both skill sets and instinct are important. An ideal cybersecurity professional will possess both, which has put greater demand on diverse talent pools.

Companies and organizations with cybersecurity teams are increasingly seeking candidates that meet a baseline of skill sets but then also exhibit other valuable characteristics. For example, a lawyer may be a quick learner proving valuable when she needs to understand new technology. Similarly, a communicator may be detail-oriented or a project manager may adapt well to change.

Applying this lens to talent pools expands them as well. For example, by exclusively hiring software engineer candidates, we might only think about the threats that said engineer would consider; we might miss the threats that an HR or marketing professional could see. Hiring candidates from different regions can be of value too as they could possess different cultural or political insights.

The Skills Gap Persists

Like most STEM fields, security workforces often lag other industries in terms of drawing from a broad talent base. Research has long-illuminated the barriers to STEM jobs for many underrepresented groups, including cultural norms perpetuated by media, college affordability and feelings of exclusion in the workplace. The nature of security is also at odds with inclusivity as more often than not security organizations operate secretively. The result has been a gulf between talent pools and a burgeoning technological field in need of diverse talent. Left behind are not only the underrepresented racial, gender and ethnic groups, but also multi-disciplinary talent, such as psychologists, teachers, communicators and artists. As cybersecurity roles are being redefined, this societal trend must change too.

We Need Everyone

To the cybersecurity professionals out there: We need to grow, adapt, and diversify as an industry and to do that, we need everyone. And we need to approach our recruiting with this perspective in mind.

To the uninitiated: we need you. A cybersecurity career provides a dynamic and global career path. It’s at once exciting and complicated, and demands well-rounded individuals. Whether you want to fight malware or cybercrime, innovate data privacy, challenge assumptions or educate your peers about keeping data safe at work and at home, there is opportunity.

Manju Mude is an industry security leader with nearly 20 years of experience in building information security, risk management, security investigations and vulnerability reduction programs. She is a “Paranoid” Security Leader at Oath, where she helps lead an essential security team defend against adversaries to protect a billion of users. At Oath, she has launched "Paranoids University," an internal training program that teaches all employees on building secure code and systems. Prior to joining Oath, Manju held several leadership positions, including Chief Security Officer of Splunk, Security Leader at Apple, RSA, and Bank of America.