In a time where the global economy has nearly collapsed, leaving every investor, business, and employee under enormous pressure, it is the most important thing to have a safe and steady income. Globally, the gross domestic product (GDP), industrial production, and retail sales are on their way south while, at the same time, unemployment rates are rising fast. Within the security market, we are still in very good shape and luckily enough we are not hurt too bad so far. Most organizations haven’t cut their security budgets and they have not planned to do so in the near future. Many IT specialists have recognized this already and have started to focus more and more on this knowledge area. With this trend, there are more and more people fighting for the same amount of jobs in the market. What do you need to do to be prepared for that? What differentiates the specialist from the beginner and how can an enterprise organization evaluate qualifications?

Expertise and Knowledge

Let me start with the debate around the background knowledge of an ideal candidate. The last couple of years, it became a nearly religious debate if the right IT security candidate must have a solid technology background or if a business-oriented person with an MBA would be the better fit. At the end, it’s all about the ability to speak the language of the business, right? With this, it highly depends on the company. Within an organization where a lot of IT services are outsourced, the IT security specialist needs to have a strong service management orientation. Within a technology company, the customers are technologists and the perfect IT security person needs to have a strong technology background. If there is one thing I would recommend to you in this space, it is to carefully look at the company and business to which you are applying. If you are coming from a pure technology background, you will have a hard time in a business environment where technology is not the main topic. To have a seat at the customer’s table, and to be trusted, you need to earn it and you need to be able to speak the language used at the table. A security and risk professional needs o be able to differentiate between a vulnerability, a threat, and the resulting risk. If you are already in security and you want to develop yourself into a more risk-oriented job, then start working on your business skills ASAP.

Certification

Another area of discussion is the topic of certification. Certification within the IT is big business and the variety of offers is just enormous. It is extremely hard to filter out the ones that are really adding value from the ones just stealing money from you. I have done my CISA and CISSP certification once to learn hands on about the value of such common bodies of knowledge. From what I have learned, I must tell you that having a certification in the field of security proves only that there is a baseline of certain special knowledge. It doesn’t prove to me that somebody is up-to-date.  I personally always prefer real life experience to certification. Depending on the position we are hiring for, several years of experience in a similar role in an international environment are a must. Again, be aware of the company to which you are applying.

Communication Skills

A large part of the security role is communication. A good and experienced security specialist is known for being an enabler in a way of saying “Yes, but with …” instead of starting with “No” all the time. Why do we engineer big brakes into fast sport cars? Risk and business-oriented security specialists will answer, “To be able to go faster with the car as we could with smaller brakes.” Only an old-fashioned specialist would answer, “To be able to stop.” It’s about being risk focused and being able to communicate the enablement part. Every security specialist who wants to work within my team needs to be able to speak clearly and communicate well to technical teams, business managers, and management in general.

Ongoing Education and Industry Knowledge

To be a real partner, up-to-date knowledge is essential and ongoing education is a must. One of the main criteria for every security and risk person I hire is how she/he keeps their knowledge current. Using real-life topics, I will ask the candidate for his/her thoughts and suggestions on a possible solution. Additionally, sharing knowledge and experience helps every organization prevent certain mistakes; and being part of a trusted global network of security and risk specialists helps each of us stay up to date. You might use questions like the following:

• What magazines or Web sources do you follow?
• What are the burning topics of the industry for the next 36 months to come?

No security specialist has every piece of information at her/his disposal. The question is: how would they find the missing pieces?

Good Under Pressure

One attribute of working in security is the guarantee of surprises from time to time. Perhaps your organization falls under attack from outsiders, or people within the organization are doing things they shouldn’t be doing, or a top manager loses his mobile device with all kinds of business-critical information on it. The list is endless; and whenever something big happens, many people tend to panic. Panic and high emotions are the worst partners you can have working in the security field. The best security specialists I know are becoming brilliant when under fire. To be able to stay calm in hot situations, to be able to stay focused on results and solutions, to make fast but solid decisions, and to clearly instruct and manage other people are criteria that differentiate winners from losers in moments of crisis. I’m normally testing candidates for such abilities. HOW?

Trustworthy

People working in security will have, by nature access, to many sensitive information and information that most organizations don’t want to see in public. For me, values and trustworthy behavior are absolutely essential for every security candidate. Depending on the country (not every country allows a full background check within their local laws), a solid background test needs to happen to ensure that there are no doubts about the integrity of a candidate. I wouldn’t hire the best candidate with the best résumé if I had doubts about his or her integrity. Trust is very important for me.

Conclusion

It is clear that a good candidate for a security and risk position needs to fulfill some basic requirements depending on the organization they are applying for, and the focus of the position job focus they will fill. No organization wants to reinvent the wheel and therefore it is essential that a security candidate has:

• A solid understanding of high-level international security standards like ISO 27001/2
• A solid knowledge of security technologies and process to ensure data security
• Basic business administration skills to be able to judge cost versus value
• The ability to participate in all kind of meetings “selling” the security value with founded arguments
• The willingness to constantly develop and educate herself or himself
• The ability to keep relationships alive
• The ability to get into a new topic very quick
• The ability to understand the different requirements of every business unit

I’m absolutely thrilled to work in the field of IT security and, with all the changes going on right now in the economic world around us, I’m sure that jobs in this field will not become boring very soon. I can only encourage everyone to keep their knowledge and skills up-to-date and to work closely with their main stakeholders to ensure a close relationship. IT is a service unit that produces services which should support the business, allowing them to do a better job. There are not many companies out there where IT is the main competence. With this I wish you all the best for your professional and personal future.