Thread by @AlyssaM_InfoSec

April 17, 1997 - $35,000/yr

No joke I still remember the exact details. That was the day I started my first salaried job as a programmer. I had no degree (I was enrolled in a Computer Science program at Marquette University), no real documented dev experience.

/1

All of what I knew of programming was self-taught and a little theory from my course work that I had only just begun that semester. BASIC, Visual C++, and a little bit of VB.

I got hired to write code for a home banking and billpay application. It was the dot com era.

/2

Programmers were in high demand. The company that hired me provided banking software as a service (we called it a service bureau back then) to banks across the country. Consumers nationwide relied on the systems I maintained to manage their accounts and to pay their bills.

/3

We processed billions of dollars in payments each year. System failures could result in massive financial chaos.

I was never asked to complete a practical programming exercise to get hired. No certifications were demanded of me. As an entry level programmer, I wasn't

/4

expected to have detailed understanding of SDLCs, organizational politics, etc. No, instead they saw I had some knowledge, a desire to learn and grow, and they had the confidence in their own ability to develop my skills for both the org's benefit and my own.

/5

We sit right now, in the #cybersecurity industry, in the same position we were back then with developers. A seemingly insurmountable need for skilled humans, implications that range from localized to highly critical. But look how few orgs are willing to take the same hiring

/6

approach. We say we want candidates with passion, yet it's only a cursory consideration in our hiring decisions. We force arbitrary requirements for certs, degrees, etc. Entry level positions are few and far between and those touted as entry level often have requirements that

/7

are anything but entry level. We aren't willing to grow grassroots talent and instead insist that cyber security is so critical that everyone we hire must be highly experienced. Ignoring the fact that without incubating talent, this is unsustainable.

/8

And we pay people horribly. Seeing "entry level" security analyst roles offering only $5-15K more than I got in my first programming role 25 years ago!!

This is why we have a talent disconnect. There's no shortage, it's cavernous divide. And as much as we bemoan

/9

and blame recruiters/HR, we as hiring managers are EVERY BIT as culpable. We don't train in how to effectively recruit and hire. We ignore the fact that interviewing is a skill in and of itself and assume our job knowledge qualifies us as expert interviewers.

/10

It's time for all of us in #infosec, to stop blaming and take responsibility. To look at hiring differently. To take risks on people. To focus on growing grassroots talent. And ultimately to #DoBetterBeBetter.

I am so thankful every day for all the leaders in my past

/11

who took a chance on me and put me in the position I am today. I'm dedicating my book to one of them.

Be the kind of leader that someone remembers for life. Rob G., Tim P., Donna B., Aaron S., and Patrick F. I'll never forget them and what they've done for me.

/FIN