Boosting Cyber Resilience with Effective Staffing Strategies

Navigating the complexities of cybersecurity management, training, and recruitment requires innovative strategies and a deep understanding of the evolving landscape. In the 2024 SANS/GIAC Research Report, Dr. Austin Cusak, a Technical Leadership Program Manager at the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA), shares his perspectives on overcoming key challenges in the field.

Understanding the Challenges

Cybersecurity is an ever-expanding domain critical to protecting a wide range of sensitive information. Dr. Cusak identifies several major challenges in advancing cybersecurity within the United States.

Recruitment Issues

The disconnect between HR and cybersecurity managers in understanding and defining staffing needs leads to prolonged hiring processes. This gap often results from the misuse of technical terms and outdated recruitment practices imposed by HR, which can delay the hiring of qualified cybersecurity professionals by several months. Dr. Cusak suggests using the NICE Framework to standardize the recruitment process and improve communication between HR and cybersecurity teams.

Training Gaps

The rapidly evolving nature of cybersecurity demands a diverse and dynamic training ecosystem. While there are numerous training options available, ranging from traditional degrees to certificate-based programs, the lack of standardization creates confusion among hiring managers, HR, and candidates. Dr. Cusak criticizes the over-reliance on superficial certifications that measure knowledge rather than aptitude. He advocates for more experiential, hands-on training to develop practical skills and true leadership capabilities.

Career Advancement

A clear pathway for career advancement from technical roles to leadership positions is lacking in cybersecurity. This absence hinders effective workforce management, leading to employee dissatisfaction and higher turnover rates. Dr. Cusak emphasizes the need for mentors and role models within management who possess genuine cybersecurity expertise to guide and inspire technical staff toward leadership roles.

Proposed Solutions

1. Innovative Recruitment Strategies

Dr. Cusak promotes unconventional recruitment approaches, such as participating in hacking competitions to identify promising talent. Encouraging young individuals to experiment with cybersecurity tools like Kali Linux and Snort in controlled environments can foster a new generation of skilled professionals. Additionally, standardizing cybersecurity terminology and adopting the NIST NICE Framework can enhance communication and streamline the recruitment process.

2. Enhanced Training Programs

Experiential-based leadership courses, such as those offered by the U.S. Office of Personnel Management (OPM), are crucial for preparing cybersecurity leaders. These courses should include mentor feedback and practical skill-building activities. Dr. Cusak also highlights the importance of hands-on, immersive training from reputable organizations like the SANS Institute, which can transform concepts into actionable skills and produce high-quality certifications.

3. Mentorship and Leadership Development

Effective cybersecurity managers should act as coaches and mentors, guiding technical staff through self-reflection and personal growth. This approach helps build self-awareness and interpersonal skills, essential for leadership roles. Dr. Cusak advocates for promoting mentorship throughout the industry to help junior staff transition into management positions, ultimately fostering a more professional and cohesive cybersecurity workforce.

The cybersecurity field faces significant challenges in recruitment, training, and career advancement. However, by adopting innovative strategies and emphasizing experiential learning and mentorship, the industry can overcome these obstacles. Dr. Cusak's insights offer valuable guidance for developing a robust and effective cybersecurity workforce, ensuring better protection against emerging threats.

More Insight into Cyber Workforce Trends and Challenges

The 2024 SANS | GIAC Cyber Workforce Report includes six unique case studies from top cybersecurity leaders from leading organizations across the US. In addition, the report paints a full picture of the challenges and opportunities for building cybersecurity teams that are backed by successful hiring and development practices. To read the report in full, download it now.