WARNING: This page contains pie graphs. Proceed at your own risk.
Embedded Files
The Q&A
The Q&A
Q: How would you do the "flexible" interview style in a regulated environment where you are required to ask the same questions of each candidate?
Q: How would you do the "flexible" interview style in a regulated environment where you are required to ask the same questions of each candidate?
Context: during the interviews, I had two set strategies. First, reduce the impact of the power relationship by opening with a small personal vulnerability. Second, to ask them all a question they have definitely rehearsed (what do you do in conflict?) and then walk them forward into a question they most likely had never rehearsed (what do you do with total agreement?)
I am glad that this question came up, and I am disappointed that I missed an opportunity to practice saying "I really don't know, I'll have to think on it more." When the audience member asked the question, I nervous talked my way through a halfhearted, half-baked idea of something, and I hope that audience member makes their way back here sometime to learn from the conversation I shared with MN State's Chris Luhman and Tim McGuire after the session.
The result of that conversation was rather than trying to deliver static interview questions in a creative way, revisit the questions themselves and examine them using an anti-racist lens. Similarly, revisit team policies, organizational policies, and be an advocate for change if you are in a position to decide and be a squeaky dang wheel about change if not.
Q: Would you change your interview style for a full time position?
Q: Would you change your interview style for a full time position?
Context: this is a case study of an internship hiring process. The strategies we used to build in accessibility and equity showed up in interview questions and job posts that had the luxury of being very open on experience and skill set because this is purposefully a teaching role.
When we're hiring knowing that the relationship is short-term and intentionally created for learning, we can be open to just about any student with an interest in cybersecurity. That being said, we knew that students would gain ground faster if they came from a background of working with or studying technology. However, we didn't include "knowing computer stuff" as a skill requirement, we said under "What you bring":
Preference for and enjoyment from working with computers and systems on many different levels, from hardware and software to policy and procedure to the behavioral intersections where humans and computers meet
We chose this language to highlight recommended skills in a way that takes the position of the reader. If I were applying for this internship, I would read "What I bring: I have a preference for and [get] enjoyment from working with computers...". I can say this out loud and see myself in it.
Framing more advanced technical skills can take this same form. If we were hiring for a full time Purple Team Engineer position, we may say:
Drive to automate the world around you
Curiosity about or time with hands-on-keyboard in Security Orchestration Automation and Response (SOAR) platforms
Again, a candidate reads "I bring a drive to automate the world around me. I bring hands-on-keyboard time with SOAR." Notice how the candidate gets to put themselves in the job posting, literally seeing themselves there.
As demonstrated by SAP's research, our job posts are bad and they should feel bad (check out the section on Job Posts), and we are all completely capable of choosing a different path forward.
Gratitude
Gratitude
As I researched this presentation, I learned just how much I do not know.
Creating hiring practices that reach outside the often insular pool of cybersecurity talent is just one of many concurrent steps an organization can take to create an environment that creates opportunity for all people. The more I researched, the more I became convinced that I am both the wrong and the right person to speak on this subject.
I am the wrong person because I feel there is so much more work for me to do regarding my own racism, sexism, ableism, and negative discrimination based on religion, ethnicity, and sexuality.
I am the right person because I have work to do. Any person at the talk or reading this page found their way here to do that same work.
I am deeply grateful to the Secure360 selection board for creating space for this discussion and to you for choosing the courage to attend and participate. I am also grateful to my team, with whom I grow daily.
My Why
My Why
Early on in my life, I didn't think a whole lot about discrimination, inclusion, or exclusion. The systems that be reinforced that things like racism and sexism were historical and abstract constructs that were "going away" if not "gone", despite now obvious contrary evidence.
I became particularly aware of the impact my gender identity would play in my career nearly from the start. After a cross-department technology event, a male-presenting colleague posed a question to me that I am still answering today: why are there so few women in technology?
The curious person I strive always to be saw this as an opportunity to learn. From this small question posed so many years ago, I have participated in affinity/employee resource groups; I have taken time in my personal life to understand privilege, racism, sexism, ableism, and negative discrimination based on religion, ethnicity, and sexuality.
When it came time to hire, I brought these values, my knowledge, and experiences to the hiring process to create an environment in which all candidates could shine, be challenged, and have the courage to show up as they are.
Industry Why
Industry Why
Diversity demographics in the tech industry and technical roles have long skewed white and male, and the same pattern applies in cybersecurity. At the same time, the number and diversity of jobs available in the cybersecurity industry has been outpacing talent availability for years, with only 60% of available jobs occupied as recently as June 2022 according to NIST's National Initiative for Cyber Security Education.
A fascinating, though imperfect, study by Trend Micro found that up to 36% of users in cyber criminal forums were women. In contrast, women made up only 25% of the 2022 cybersecurity workforce, according to Cybercrime Magazine. It makes sense, in a way. Anonymity is key in cybercrime, which means that individuals are primarily judged on skill rather than identity or characteristics. Cyber crime is likely more lucrative and safer than other underground hustles for folks who identify as women.
In all adversity there is opportunity, and for the cybersecurity community, our opportunity lies in encouraging cyber employment among young people and people transitioning jobs by designing jobs and interview processes that demonstrate to them what it is to be an adaptable lifetime learner; the fundamental requirement of any cybersecurity career.
It is clear from the vast body of commentary in articles, blogs, and social media like LinkedIn that those of us in the industry as well as those striving to join are of the same mind -- we want to get these workforce pipelines flowing!
So why isn't it happening?
Magnetism
Magnetism
Positive Action
Positive Action
Updated 06/01/2023
A lesson that I am reminded of over and over is that the ideas that I explore and share are made better through collaboration. This section has been updated and transforms "positive discrimination" into the more accurate "positive action". Positive actions are actions that employers take to improve equity in the workplace, whereas positive discrimination is more strongly aligned with "affirmative action".
Positive actions that Code42 takes throughout the hiring process include salary transparency, sourcing candidates through professional networks that reach underrepresented humans, and providing candidates an option to request to speak to individuals not included in interviews, such as employee resource/affinity group leaders.
I am grateful to my People Team Partner, Kate Kupcho, for sharing her expertise in exact meaning and for sharing the many positive actions Code42 takes to ensure positive and supportive experiences throughout the employee lifecycle.
Job Posts
Job Posts
At RSA 2023, SAP's Peter Dornheim and Dr. Thorsten Weber presented their research regarding the cybersecurity skills gap and how the way the industry writes job posts scares away young talent.
They asked 10 candidates to review 12 job descriptions and state whether they would apply. Due to several reasons, the top of which were experience and certifications, 82/120 (68.3%) possible applications would not have been submitted by the candidates.
They also asked hiring managers to describe their selection process and measured their actual selection. In the qualitative analysis, the majority of hiring managers indicate that certifications are not baseline requirements. They are perhaps a way to gain a foothold over an otherwise equivalent candidate, but otherwise are described as "overrated" or of less value to the ease of getting one.
Additionally, they asked managers to select resumes from a pool that contained actual resumes of people who would not have applied as well as a control group of automatically generated resumes with sufficiently distributed skills and experience. The hiring team selected 2 resumes for 11 cybersecurity positions and selected a candidate who would not have applied for all except one role. For many roles, they both candidates were folks whose resumes would never have hit the hiring manager's desk!
Code42 Purple Team Internship: Would you apply?
Code42 Purple Team Internship: Would you apply?
THE INTERNSHIP:
THE INTERNSHIP:
True entry-level cyber security roles are rare gems, and this internship may just be a diamond in the rough.
As a Purple Team Intern, you will first receive education about Code42’s technology infrastructure from experts who work with those systems every day. To secure a thing, you must know a thing.
This education will run in parallel with attaining and applying knowledge and skills in security operations by shadowing our Purple Team Analysts and Engineers on red (offensive), blue (defensive), and purple (bit of both) team activities, such as:
Tactic, Technique, and Procedure (TTP) exercises and regression tests
Threat hunts in which we use threat intelligence to identify suspicious activity in the Code42 environment
Security Event and Incident Response
Security Orchestration, Automation, and Response (SOAR) engineering, development, and management
Security Information and Event Management (SIEM) engineering, development, and management
Endpoint Detection and Response (EDR) assisted investigation, detection, and response
Collaboration with and contribution to Security Awareness efforts
At the end of the internship, our goal is to have you operating independently as a Purple Team Intern with as many guide rails as you need. It is also our goal for you to feel that you have been a contributor to securing the collaboration culture at Code42 through your work.
WHAT YOU’LL BE DOING:
WHAT YOU’LL BE DOING:
Each day, you will be exposed to a new way of looking at the world; your primary job duties are to develop a security mindset, learn as much as you can, and find a role in security where you can thrive.
Other Duties*
Investigate and respond to daily security events
Participate in and lead TTP exercises or regression tests
Participate in threat hunts using security monitoring tools
Develop SIEM queries
Contribute to SOAR playbooks and automation
* These are the plans of folks who don't yet understand how you learn, think, or know in this world. These duties are examples of our ideas, but there’s space to explore other areas of security based on what you prefer or preferences you discover during the internship.
WHAT YOU BRING:
WHAT YOU BRING:
Curiosity - asking questions about the world around you, especially when you are asking because you do not know and wish to learn
Willingness or enthusiasm to work closely with a small group of security practitioners
Interest in or existing knowledge of information security as a profession and practice
Interest in or existing knowledge of modern security tools and what they are used for
Preference for and enjoyment from working with computers and systems on many different levels, from hardware and software to policy and procedure to the behavioral intersections where humans and computers meet
Pool Demographics
Pool Demographics
I am including this section to highlight the skill the Code42 recruiting team has in attracting diverse candidates as well as demonstrating that clear, intentional, and focused positive discrimination policies have visible effect.
Even as I prepared the visuals, I was impressed by the range of experience we saw in our candidates, from no experience and even limited awareness of cybersecurity, to several security internships.
True entry-level cyber security roles are rare gems, and this internship may just be a diamond in the rough.
You me, Me you
You me, Me you
Interviews
Interviews
The interview process involved two 30 minute interviews; one with me as the hiring manager, and one with the two other members of the Sec Ops team. Upon reflection, I would have included a third interview with our senior director, and I would have likely turned the two to one interview into a one to one. But, I am getting ahead of myself!
Interviewer
Interviewer
In preparation for the interview, I considered the power dynamics that live inside an interview, particularly in tech. My goal was to create an environment for each candidate in which they felt safe enough to be vulnerable. Safe enough to let down modern perfectionistic defenses and join me in the process of thinking and problem solving together.
Vulnerable by Design
In each interview, I opened with a demonstration of vulnerability. I know that this is a loaded word at a cybersecurity conference, but bear with me :)
Experience has shown me that the security practitioners and humans I most admire and learn from are those who allow themselves to be vulnerable. They allow themselves to not know, to make mistakes, to be wrong. Above all, they do not allow themselves to use emotions to manipulate others when they face the discomfort that finds us in those moments.
I brought a light-touch vulnerability to the table: this is my first time hiring someone who will report to me directly. The delivery was a little different each time, depending on the candidate, but the core message was the same. "If you're a little nervous, you're in good company. I'm new too."
One of the distinguishing features of the candidate I most preferred was that they led with vulnerability, sharing that they felt nervous in response to my programmed, polite "how are you?"
Think with Me
In our conversations, it was clear that each of these candidates had been through interviews before. Each had the canned, practiced responses to commonly asked interview questions. Each was different, unique in their choices of stories to share, but ultimately something they could have recited without much thought or effort in a series of interviews.
The ultimate reason behind starting with vulnerability was to create an environment in which the candidate had the courage to get uncomfortable; the courage to face a question they had never answered before and think through their response.
The path I chose will sound familiar: what is a time that you experienced conflict?
The bitter stories of group project planning reigned, and each of our candidates was the savior who came to the rescue. I knew the story well; I am certain I shared more than one exactly like it myself!
After their planned answer had played out, I asked them to then step forward with me and consider: what do you do with complete agreement?
I asked the question without answering it myself in detail. I didn't want to bias myself towards any answers any more than I already was from my own practice and experience.
No candidate had an immediate answer. In some cases, the candidate practiced problem solving by probing to see what answers I might be looking for. When one candidate came up empty, I encouraged them and offered to think it through together.
The candidate I favored thought through their response. They took the space they needed to think through their answer, and they shared that they would ask whether there were any biases we hadn't considered. It is a moment that I still think on to this day; I am confident that young person will be a valuable addition to any team they join. I didn't deeply consider answers to this question, but this is one that I will never forget.
The Story
The Story
TL;DR (Too Long; Didn't Read): When the interviews wrapped, we discovered that my favored candidate was my colleague's least preferred! In the end, we selected a different candidate, the right candidate, and the first woman in cybersecurity I have hired.
Technology
Before the first round, I read the notes our recruiter left and did due diligence reading each candidate's resumes and cover letters, if submitted. After the round, I decided to pass each candidate through to my colleagues. I had a favored candidate, but I thought each was capable of and would benefit from joining our team and wanted their take.
For the first round of interviews, I took notes for each candidate and made sure to provide specific topics or areas that I wanted the team to investigate further in the summaries. Only later did I learn that they could not see my notes in the same way that I saw the recruiter's.
Our first lesson was know thy hiring tech. We reflected that it made sense that we couldn't see one another's notes, as it could introduce bias in the interview and selection process. However, it also means that information I would otherwise have communicated had not reached them.
Accommodation by Up Front
In our reflection conversation while preparing for Secure360, we also established that the candidate I favored from round one had joined from what seemed to be a mobile device looking straight up. While the candidate chose to join in this less than ideal fashion, we also realized that perhaps life had simply come up and that what had once been a good time for an interview was now not so great.
Our second lesson was that going forward, if a candidate joins a virtual meeting in a less than ideal way (poor internet, mobile device, etc.) confirm whether the time still works and offer to reschedule the interview, reassuring if necessary that it will have no impact on their candidacy.
Limit People
I admit that I was in the habit of this style of interview rounds from my previous institution. Hiring rounds oscillated between one to one and two to one styles, up to panel interviews for some roles. I thought that be designing a process with a low number of rounds that included the primary "hands on keyboard" team with whom they would work, we'd be efficient with our time and respectful of candidate time.
While those things may have happened, by choosing a short-time two to one interview, I left no time for my colleagues to really get to know the candidate. The dynamics of two are very different than the dynamics of three in interpersonal relationships, and in the future I plan to be much more mindful when it comes to panel style interviews, even with only two interviewers.
The Right Person
The right person became clear during our reflection. The candidate demonstrated curiosity, interpersonal skills in communication, leadership, and drive to get it done. They were a candidate with no previous internship or cybersecurity experience. We chose this candidate because they met all of our most important criteria.
I am deeply grateful that this candidate is also the first woman in cybersecurity that I have hired, and I know she will be the first of many.
Behind the Scenes
Learning from my team that my favored candidate was their least preferred actually inspired the submission of this story to Secure360. I was certain that it was a brilliant case study example of how inclusive hiring practices impact candidate choice. Upon reflection, it's clear that I was valuing myself as a person practicing positive discrimination and inclusion and not considering the same of my white male colleagues. This was not a good look; in fact it was blindly, negatively discriminatory against humans that I trust and value as allies and friends.
After having this realization, I took ownership of my actions and unconscious biases, and I invited them to a conversation about their experience in internship hiring. We processed together, shared the ways that we had each sought to reduce bias, and learned from one another through the course of the conversation.
For example, we all agreed that it was important to avoid the "right/wrong" binary questions that some interview processes use. As Jeremy pointed out, "if you need to know the service associated with a port, you're going to Google it until you know it." Rote knowledge can be handy, but thinking through is the Swiss army knife of cybersecurity.
Zach, who was hired full time after his internship at Code42, shared fresh perspective on the process informed by equitable hiring courses he'd taken in college. He also knows several young people entering the workforce, and he emphasized the importance of being realistic with the interview process. Some of his friends had gone to four or five hour-long interviews with a company that did not pan out, in some cases affecting their financial standing due to missed work.
Designing interview processes that respect the lives and livelihoods of candidates is an equitable and positively discriminatory practice.
Secure Attachment
Secure Attachment
Everything, Everywhere, All at Once
Everything, Everywhere, All at Once
When it comes to encouraging, embracing, and growing a diverse workforce in cybersecurity, I think we all can acknowledge that hiring practices are the small drop in a much larger bucket of workplace culture, about which we could spend another 45 minutes or very scrollable webpage.
What this means is that even with hiring practices that strive to create equity, an organization may not have similarly considered and changed policies to ensure retention of diverse talent. It can feel overwhelming sometimes to face all that needs to change to challenge well established workplaces, but through each small action, momentum builds. Those who see what we do and we choose to change may choose to join us in our journey.
Consider your workplace, hiring practices, and most importantly post-hiring policies. Is is possible that there are negatively discriminatory policies that can be changed? And can you be the one to change them?
Google Sites
Report abuse