CYBERSECURITY REVIEW 9 JULY 2025I've spent the last 14 years in my current company. Throughout that time, I have always believed in having a "pool" of employees in Entry Level roles learning foundational cybersecurity skills. This has allowed us to quickly move an employee up into a more sophisticated role as the need emerges. Over the years I've had a dozen or more employees make the transition from non-traditional skillsets like accountants, bank tellers, call center reps, and help desk staff into cybersecurity professionals. Some of these employees have stayed with the company and are among our most senior/skilled staff. Others have left and become recognized leaders in the broader security community or had extremely successful careers at major companies (Microsoft, Oracle, Splunk, and Mandiant to name a few). Both paths are excellent outcomes, both for my company and the security community as a whole. True Entry Level positions can be extremely successful, and I've seen time and again that when passionate person is given the chance to grow, they can exceed your expectations. Creating successful Entry Level roles doesn't happen by accident, it requires careful planning and consideration. I'd strongly encourage employers to truly get comfortable with considering non-traditional backgrounds as relevant experience. Other disciplines require many of the same core competencies required for security roles. Medical professionals for example live and breathe process and policy. Financial professionals are experienced with separation of duties, dual control, and the principle of least privilege. Any profession where writing and communication skills are emphasized can be a huge win for a Security Team. A significant percentage of senior security professionals struggle with writing for a business stakeholder and clearly communicating complex concepts. Start your program by opening yourself up to considering other types of relevant experience. Then design the roles in your teams to accommodate an Entry Level skill set. Security Operations Centers can be an excellent place for new employee to cut their teeth. Every SOC has lower-risk alerts triggering in their systems that still need to be worked on. Take a risk-based approach to assign those alerts to more junior staff and implement a peer review system. While it adds some overhead to existing staff, the impact is short-lived, especially when your entry-level staff is passionate and excited to learn. Similar opportunities exist in research-focused roles and Threat Hunting roles. The role itself doesn't matter too much, as long as you have a supporting structure surrounding it. Take a risk-based approach to assign projects and tasks, and ensure it is OK that mistakes are made, and a feedback loop is in place. When new employees are given the right level of training and exposure, allowing them to build foundational skills, they can grow into and excel quickly in new roles. It means that when you have to fill a more senior role, you can tap that Entry Level of an employee, to take on a bigger challenge. They know your culture already, they have the right foundation of skills, and bring excitement and passion when given the opportunity for a larger challenge. As a result, in my experience, they can be effective in a more sophisticated role in a matter of months. Ultimately saving you money and time on hiring, recruiters, and integrating employees into your culture. It's a clear win for both your organization and the employees you help grow. Today the Entry Level roles that get posted on job forums are rarely suitable for someone new to the discipline. Hiring smart/passionate people and creating an environment in which they can learn is a huge opportunity. Take the time to design roles that will build the skills of entry-level candidates. You will find that those same candidates, accelerate incredibly quickly into more sophisticated roles when you need them to. It's still going to be a challenging hiring climate, but by truly supporting Entry Level roles you can improve both your program and the broader industry.
< Page 8 | Page 10 >