Overcoming Workforce Retention & Recruitment Challenges in Cybersecurity

besides DC would like to thank all of our sponsors and a special thank you to all of our speakers volunteers and organizers good morning everyone thank you so much for getting here on a rainy early Sunday morning and welcome to everyone who's watching this on livestream my name is Kathleen Smith I am the chief marketing officer of two job boards the first is cyber sex jobs calm the second is clear jobs dotnet but I'm most known for my volunteering within this community I am on the Planning Committee for several of the B sides including besides Las Vegas I run a 2-day career track there called higher ground but in my volunteering in the community I kept hearing something which was I'm

having difficulty finding a job and I was like wait a minute why am i hearing from people in the community who have lots of experience that they're having difficulty finding a job when we're hearing about this shortage and then I was also noticing that a lot of people who I was working alongside and volunteering in the community they were moving on within their careers so they would be a reg lead and then from reg lead they would move on to somewhere on the board of the organization and I would watch the parallel development of someone's professional career and their volunteering career so I decided to do two studies last year one was to ask volunteers in the community what were

some of the things that gave them purpose as far as volunteering how did they engage their employers what did they find as far as skills that they had learned the other one was a survey on job search challenges we hear so many of the surveys that are out there that always taught from the employers standpoint but not from the job seeker standpoint what are those challenges so this morning I'm sharing the data from two of those those two surveys that really focus on what employers may want to include in their overall toolkit when they're looking at recruitment and retention so as I said we can here any time we turn on the news any time we look on you know

Twitter or something that there is another gap there is another talent crisis if someone wants to have a really great soundbite they'll tell you that there's 3.5 million jobs that will be open in cybersecurity by 2021 but those are sound bites that's not going to help us solve the problem so when we went into asking the community what were some of the job search challenges we came back with some really interesting statistics so the first was 65% of the people in the survey we're currently looking for a job actively or passively so if we have more than half of the community looking for a job why aren't we not getting them those jobs that they

want we also asked some other key questions such as do you know how to find a job now more than 45% said that they didn't know how to find a job but we all know we don't like to tell someone that we don't know how to do something so I'm pretty sure that this number is underreported because of course someone is going to say well you know it's easy to find a job I didn't find a job you know there's this shortage going on I should have no problem finding a job we went a little bit deeper and sort of asked what were the top three strategies that people in the community we're going to be using or

had been using as far as finding a job the first was asking their friends so this looks very similar to employee referral programs but you have to remember they're asking their friends they're probably asking the same group of friends time in and time out and we have to also make sure that you know who their friends are and that's not as easy as we all think the other was applying to jobs or looking at jobs of companies they know and when I talk to job seekers I say can you right now tell me three companies off the top of your head that you would want to go work for most cannot do that because they don't

know that you exist in the community and what you do and third was that they went to online job listings now what's interesting is we've seen a lot of morphing in the community of job listings they can be anything from indeed they can be LinkedIn they can be a staffing firm who's put up a job board just so that they can get candidates so it's interesting that they are looking at job postings there wasn't any one job board that they were looking at but they do look at job listings we also ask them who did they like to work with and we've seen in the community sort of this uptick in the number of staffing firms

and how having companies that are out there and that's really great but by and large people in this community want to talk to the direct recruiter they really want to talk to someone who sits at the desk that understands the culture and understands what's going on within that company unfortunately in this community too many recruiters who work either for a company or staffing firm or a headhunter have really created sort of a bad blood with recruiters in this community I mean how many of you know the Twitter handle ship recruiters say or all of the various different YouTube videos that talk trash about recruiters so it's interesting they want to work with recruiters but we have to make sure

that the recruiters are really treating people well we further asked what were the job search trouble areas so what was really stumping people when they were trying to find a job the first and most important was they didn't know which companies hire for their skill set so this is really interesting this goes back in my mind this goes back to the job descriptions that we put out but it also is making sure that we're talking about what kind of work we do in the community rather than just saying we are a cybersecurity services company that means everything are you a pen tester are you crypto are you forensics being a lot more clear with the community as to what you do the

second one really important and one that I hear a lot in a lot of conversations is determining the next step in their career we tend to take someone who is a pen tester and another company and put them in as being a pen tester at our company and then when they leave they go be a pen tester at another company rather than playing the role of being career coach you've done this skill for 10 years what about growing into another another skillset let's grow you into another job or also helping them understand you did something in one industry you can take that experience you can take those certifications and you can apply it in another industry a lot of the career

coaching I do people are saying they're working in compliance gaming compliance healthcare finance compliance and they want to get out of it because they don't see a career path and I'm like please don't leave compliance because we need so many more people who understand the regulations and understand compliance go and take that into another step within your career I'm finally finding the recruiters to work with they want to work with recruiters they don't know necessarily how to find them and that's why I'm really excited when I see so many recruiters who are out in the community not going hi I'm a recruiter I'm gonna hire you like hey I want to get to know your community I want to get

to know what you're working on I want to get to know the the things that you're passionate about because we talked about that law in this community passion and not just putting someone into a job slot because it fills our racks but Pyne finding someone who is passionate about a particular kind of challenge and making them part of your team we ask some of the questions of oh that really doesn't show up well I'm sorry things that companies can do to recruit professionals so two things that really stood out unlike my slide not standing out the first is provide remote work you will hear this time and time again on social media that more and more people

want remote work and there's this conundrum we have the technology why are we not letting people do remote work and a lot of people are saying I can't get my management to approve remote work let's just talk about a day a month two days a month let's let's see if we can incorporate just a little bit of time each month not necessarily it overall policy but hey you know let's let's find one or two days let's take baby steps to incorporating more remote work and the other is make your hiring process more clear more attainable for a job seeker I can't tell you how many times people are saying they called me for the tech

interview I have the job not necessarily you need to be very clear about the various different steps that are in your overall hiring process that there's going to be the phone screen that there is going to be the TUC interview there is going to be the panel interview if you're in the cleared space that the resume is going to have to be presented to the customer that this is going to be somewhere between a four to eight week process we are in a society that expects everything to happen immediately you need to set the expectations of your candidates of exactly how many steps they are going to have to go through to be called for that

final interview that gets them the job and what's interesting is a lot of people are saying I can't put that on my website I don't have a relationship with the website director to be able to do that in every single one of your emails when you're talking to the candidate be sure you outline you have something if it has to get approved get it approved but the step by step process that that candidate is going to have to go through for your overall hiring process and be sure that it is some steps that is shared in the initial phone screen we're going to be talking to you today we're going to be talking to you again in a

few weeks this is how you're going to go through the process because we have a lot of people in the community that deal with anxiety and they never know what the next step is if you want to build a really get great candidate experience and engage that talent set their expectations up ahead of time most of the ranting that I'm hearing social media is because someone was called for a phone screen and then nothing happened after that and they then say well you know they're just a jerk they're not going to get back to me they don't understand your hiring process let them know that there are specific steps and that you're going to follow through on each one of those

steps we asked some of the questions as far as what are the things that people are looking for we hear time and time and time again about the fact that it's people are looking for Rockstar six-figure salaries that people are looking for a lot of money but if you were walking around this conference this weekend I hope you noticed how many children were here how many families are here people in this community are not automated they have families they you I come to several of these conferences and you see several generations three generations of people these are people who not only want good pay they want a good work environment they don't want to be burned out they want to feel safe

make sure that they are working alongside people who respect them for the skills that they bring make sure that they get work-life balance - I mean everyone in this room that's doing the crypto challenge with kids they also have a soccer they want to get off early to be able to do carpool don't treat them any differently than you treat the rest of your employees give them a good safe work environment and give them a good work-life balance so many of you know that I'm involved in the community so of course my solution to our recruitment and retention challenge is of course community involvement and this is really important to me because I have not seen this in any other industry as

far as the value of being involved in the community in overall retention and recruitment of hard to find talent so when we went through our community volunteering survey this was amazing to me over 50% of the people found volunteering stressful talking about anxiety we're talking about neck pain back pain standing on your feet you know getting sick everyone gets con crud but these are the people who are also working full time and have families they can all say 98% said that they found volunteering fulfilling how many of us in the room can say that our job is fulfilling it is not necessarily the job of the employer to provide fulfilment it is the job of

the candidate or the employee to find fulfillment they're not necessarily going to find it in your workplace but finding a place where they can find fulfillment in volunteering is one more step of you retaining your really great talent the other thing that we found within the industry was that when we look at our industry we look at the fact that it is breaches negativity anxiety burnout suicide dark dark things going on in this community however all of the volunteers said that they felt that their volunteering was having a positive impact on the overall industry there are not many industries that can say hey there is something happening in our industry that is being driven by our

participants to make things different to make it better more often than not people are saying well you know we're getting new compliance or we're getting something like that the volunteering is making a positive difference within our community when we looked at the skills that people were gaining through volunteering there is an interesting correlation between the skills that they said that they were learning and several of the LinkedIn talent surveys that have been out saying the top skills that employers are looking for the top soft skills that they're looking for our teamwork planning communication and these are the same skills that people were finding that they learned when they were volunteering and there are not many

places with the day-to-day workforce of day-to-day workplace that people can say that they are going to gain their non technical skills we've primarily used them for their technical skills but we don't give them a place to work on communication to work on planning to work on organizing and these are the actual numbers for this is that eighty one percent said they became better team players by being part of volunteering they were able to say that they were part of teams that build the sock build the NOC they handled the registration they handled conflict resolution and those are things that you're not necessarily going to find within the workplace because you're already putting them part of teams that

they don't want to be part of but if you're looking to create a better team environment you may want to make sure your employees are working on that in another place organizing anyone who puts on one of these conferences knows that it takes a lot of organizational skills and everyone organizes differently so this goes back to the teamwork I want to do things a specific way you want to do things as another way let's work this out conflict resolution communication how many of us are looking for our technical teams and asking for them to be better communicators both written and oral so it's interesting is that we all think well they're just talking at the

workplace they're able to work on their communication skills within the office not necessarily just think about the come the communications the talks that you do at work and the people that you're having conversations with you already know how that conversation is going to go you already have set in your mind the different steps that conversation is going to go through but you throw somebody in the middle of a crowd of 75 volunteers trying to put on a conference for 1,400 people you're gonna start working on communication skills because everyone communicates very differently and that really needs to be fine-tuned especially if you want to create a career path for your employees within your company you're going to want to make sure that

they're working on these non-technical skills we went a little deeper and asked about sort of employer support for volunteering and I was very happy to see this that nearly 60 percent said that they stayed with their current employer because they their employers supported their volunteering and what do I mean by supporting the volunteering it is a wide range it is everything from my employer sponsors a cumference my employer pays paid time off to for me to volunteer at the conference there are several large companies in our space who figured this out a long time ago and you'll notice at you know hacker summer camp or a variety of other large conferences you'll notice that all the employees are from several

two or three companies and that's because they figured out a long time ago if they make sure that they support their teams going to hacker summer camp or a conference to give them paid time off so that they can do the volunteering and this is paid time off outside of sick leave and vacation leave if you're have someone who is a really great technical lead you may want to consider talking with them about presenting at a conference because one of the things that people are really looking for when they're going to work for a new company is what is the technical street-cred on that team well you're not going to be able to go in an interview and tell

someone yeah we got the really coolest people out there know you want to get them presenting at a conference you want to get their followers their kin their people understanding what they do and I can tell you how many times I go and I listen to a presentation and no one knows who the company is that sent them because no one is engaging their employer to say hey I've been accepted at three or four conferences this next year you know would you mind paying my travel would you mind paying you know giving me some time off for it it is a constant gripe within the community that people are really great at what they do they get

out and they present but they have to set aside their own personal budget to fly stay at a hotel and go and present at a conference you are missing out on a phenomenal opportunity to have your employment brand out there in the technical community by supporting your technical teams that getting out and presenting but you're going to have to work with them to make sure that they understand hey there might be some rules that we have as far as communication is concerned and they can make the choice if they want to play by those rules or not I can tell you a lot of the people who are out there speaking they don't follow the rules of their company but

they're very passionate about what they're presenting about and they're gonna go and present it anyway we also asked how much does an employer need to support volunteering in the community to make a difference for someone to move from one company to the next and they said supporting 25 percent of my time would be enough to encourage me to leave one employer and go to another and when you think about that 25 percent realize that you're going to be able to take it from a variety of different budgets you have a recruitment budget you have a retention budget you also have a training budget you have a marketing and communications budget I'm not giving you a solution here that is going to cost

you several hundred thousand dollars it is something that already exists within your budgets you just have to have a strategy of laying out okay there are three conferences coming up in 2020 who do we want to send who do we want to sponsor how do we get our employees out there volunteering it is something that already exists within your company so these are my suggestions as far as following the whole community involvement and solving the challenge together so the things to improve your recruitment be sure that your job descriptions and I I will beat this one to death and so will everyone in the room really take a look at your job descriptions if you're in the government

contracting space I realize that you have to cut and paste from the government award but in the commercial space we can all do a lot better about writing job descriptions and jobs descriptions have been the bane of the candidates experience for over 30 years so this is not a new problem this is something that we all need to work on the second is being really clear about the skills needed to be successful in this position so once you've rewritten that job description take it to the people on the team that are going to work alongside that person and make them flush it out is this person need to you know have passion about crypto does this person

have to manage a variety of teams is this person going to be put in crisis situations what are the things that this person really needs to know about being successful in that position outlining your hiring process being very clear on your careers page and you don't have to have a fancy video and you don't have to have fancy graphics five points what are the steps that that person has to go through when they're contacted about a position at your company and what are their expectations because you also have to hold yourself accountable to the fact that you've contacted a candidate and they're sitting there waiting and if you're not getting back to them that on

you make sure that you have internally agreed that this is going to be our hiring process and these are the things that we are going to commit to the candidate that we're going to do we're going to get back to them we are going to let them know that they didn't get the job they're not going to be left out there hanging you're gonna let them know that there are some things that they could do to improve getting that job because feedback this is one thing I love about the military if you move from one position to the next within the military and you don't make it to the next step they're gonna sit down with you and tell

you why you didn't do that and what you need to work on but we don't do that in the civilian life we don't get back to our candidates and say you know you were great you just didn't have this certification or you're great but you know the the technical interview you sort of got a little nerve Hasaan maybe work on that doing that step to build your employment brand with the candidate community to stay you're giving back you're helping if you can't get out there and sponsor if you can't do that at least get back to the candidates and let them know what's going on in the hiring process and what they can do to be better

hireable talent for you and you really have to get out in the community and I promised I wouldn't call on him but you know like Kevin Kevin is here all the time in the community we have several we have Kirsten runner who's out in the community we have Matt durin people who have not only been in the community just today but they're going to the user groups they're going to the meetups they're actually buying the pizza for the meetups they're getting out there they're not going and hiring they're listening they're listening to the current tech challenges that are out there you want to find someone who's going to solve a critical problem within your company go to a meet-up and find

out who's solving that on their own at their own home lab or find the person who is really curious about the new solutions for that but that requires you listening and that requires you building your brand within that community like hey I'm just here to help out I'm not here to poach I'm here to coach and what's interesting is that it is a constant activity to be in the community not just when you're needing a job filled because what's fascinating to me is that just like job seekers who start working on their resume the day after they quit their job we go and try to find the candidate the day that our boss is complaining to us that

we need to have that position filled pipeline is six months it's 12 months get to be known in this community get to be known as the person that is willing to do a resume review like Kevin did yesterday like anyone who answers any of my calls that I put out for resume review I'll have eight opportunities in 2020 to volunteer in the community to be a recruiter resume review being known being someone who follows them on being the one that answers their frustrations on social media now you may leave yourself open to be ranted on and and that does happen I'm sorry that's the way our society is but being the one that gives back and help on retention if

you're not involved with recruiting but you really want to get better at retaining your talent that may be dripping out that bucket that we keep hearing about understanding what pathways can happen within your company for your technical talent I was thrilled when I was doing a workshop two years ago and there was someone in the room that had absolutely no security experience but had been working at a financial institution for 17 years I knew everything about financial regulations government regulations backwards and forwards and his management went to him and said we think you're great you know about compliance can we create a new career for you to learn security so that you can help us

develop the strategies that we need to do to help mitigate any of the risk for our financial institution and also stay compliant so they were opening a new door for talent that was already inside sending them through the certification process sending them through the education and saying hey and they were giving him about eight months to sort of investigate this industry and see if that's something in what coaching your managers so they understand that there are other opportunities within your company for your tech talent don't keep churning and burning the same tech talent make sure they have someplace else to go just like you don't want to go out and have to recruit a new person

they sure as hell don't want to have to go out and find a new job can you find them another area of the company that they want to be part of are they ready to go up into management are they ready to go into managing teams hey if they're managing a team at a conference do you know what it's like to manage all of these volunteers they can certainly manage all the technical talents you have give them that opportunity a lot of people don't understand what their tech talent does they know they fill the job posting they know that they feel the requirement that's out there but they don't necessarily know what the passion is of

their tech talent and the same thing that I say for veteran recruiting when I tell people do you even know if you have army or Navy or Marines on your staff can you take the time to go and survey your staff and say what organizations are you're part of who do you want what volunteer Oregon what volunteer opportunities do you want to do what are the top three conferences you go to every year I can tell you if you sort of have nobody on your staff the first week of August I can tell you where they're going why aren't you there why aren't you supporting them hey maybe interview them afterwards you know what was their trip report what did

they learn what was new out there making sure that you understand where your talent goes to satisfy their passion are they going to the CTF are they part of the crypto challenges these are things that can not only help you support them and retain them as talent that can be taken over to your biz del development crew that can be taken over to your marketing group they can say you know we're paying all this money on advertising but we're not getting any you know traction well how about where everyone in the company already is and they can be the walking embodiment of your company rather than spending hundreds of thousands of dollars on advertising and

coming up with an across the company program to support volunteering in the community taking from that training budget taking from that retention budget taking from the communications budget making sure that you're incorporating the community volunteering across the board as a way to retain your talent recruit your talent but also make sure that you have a bigger presence within the community and since I heard the applause over there I'm figuring out that we're almost done any questions we do have a microphone well you know we we are videotaping this and we do have people live-streaming so I work for a very small start-up there's all of seven of us right now we're out of Pittsburgh and our main challenge

right now for recruiting people is we need people that they are able to hit the ground running because you know we're small we're constantly busy but we also kind of have to be able to manage our costs so we try to present it as could you take a pick up now for a higher up side later so we need to recruit those kinds of people and we're having a very hard time do you have any tips for a small company like us to attract talent like that so there are a lot of people who are looking for that kind of opportunity and they're usually people who have a lot of experience so but they're usually going to be people

who don't have other financial obligations so that is a very specific niche in Pittsburgh there are several meetups low user groups there's besides Pittsburgh you know yes I'm a walking commercial for b-sides definitely go to the security besides wiki and find out the calendar of all of the b-sides and I would really get more of your staff in volunteering in the community I'm sorry I'm not trying to pair it what I just presented but being able to talk about passionately why you're a startup and the challenge that you are trying to solve with your startup because a lot of people want to work with other passionate people and passion does attract the talent that's looking for

that and it's just what's interesting is that too many people in this community here start up and they hear crash and burn because too many of them have been you know they've taken that risk and they've done it and they've been burned and if you are an entrepreneur that has a start-up really look at the fact of okay don't pull that plug too late and you've burned everyone I just heard of someone who is in our space who you know thought that they were on this great trajectory and all of a sudden they were losing you know forty thousand dollars a month and they sort of said okay we've got to stop this so they stopped it and they made

sure everyone had a severance versus what most happens in this community which is people run into the ground then they leave town and that is what most startups have to fight against is that so many people have already gotten burned but being very clear this is when we expect to have the upside this is you know be sure you have that window of when they're going to have that upside rather than leaving them out there like you know I've been here five years and I've never seen an upside you know so you all have to have an expectation of when you're upside is and being clear with people hope that's helpful yeah another question you're just stretching

in the back come on you've got to have you know burning questions I mean does this sound hard to people is this too too simple did you want me to tell you you had to buy one of my products and spend a half a million dollars on it most people don't want me to speak because they think I'm going to speak about my products but I haven't in mmm ten years so realize that we're right now here at the end of the year survey your team's and find out which conferences they want to go to in 2020 is it Gurgaon is it shmoocon is it DEFCON what is it okay you then know the top three that

you want to go to that your team wants to go to next question who wants to volunteer at that at those three conferences what is it going to take is it travel budget is it time off are they working on a project that has a deadline that's a week before that conference that might not work who on your technical team did wants to get out and present believe me if you're working on someone on your technical team who is filling out the call for proposals they're learning on their writing skills they're learning on you know how to do a short abstract a long abstract and the key takeaways that that presentations is going to be

to me that also signifies someone who's ready for management because they know how to write and they know how to convey their thoughts to an audience that may not be familiar with the topic but you need to work with them because I can't tell you how many times they say okay the deadline for the CFP is tonight I'm gonna start working on my abstract so maybe hold a brown-bag and say who wants to present at a conference this year this let's help you with the timeline most of the abstracts are very easy to write I did a workshop for getting more women in the community to present and we had one woman who I had to drag kicking

and screaming into the workshop because you didn't want to present oh I'm running over yeah okay and what's interesting is once she sound in the workshop she got very excited about presenting and she went home and wrote four abstracts and made a commitment to herself that she was going to present twelve times that next year now I present at least twelve or fourteen times a year but that's my job this woman actually then sat down with her manager and explained her professional development goal of getting out and presenting in the community on four different topics that manager then went to corporate communications and said how does this fit they nearly died in happiness because they had a woman with

lots of ink and pink hair who is going out talking about the neat technical stuff that they were doing and she got accepted to twelve presentations yes she ended up going to Brazil she ended up going to Spain she ended up going to ten or twelve different conferences without the country and she was a great brand ambassador for this very large tech giant that really doesn't have a good brand so you've surveyed your teams you've made sure that you found the top two or three conferences that they want to be part of you've then found the tech talent you then have to make sure that your recruiting team knows there's going to be some weekends you're going to be

giving up and you're gonna get out and you're not going to be out there with a pamphlet you're going to be there listening and you're going to have really cool schwag and people are like okay what is the really cool schwag it is not the fancy t-shirts t-shirts are great I went to Michael's and spent five dollars on stickers and 22 dollars on baby shark on Amazon do you know how many people I've collected emails and resumes from in the first day it was over a hundred and fifty okay I'm not talking about expensive things I'm talking about understanding what makes this community tick and being part of it any other questions before I get really passionate

about this topic okay round of applause for me because I'm done