Recruitment Hacks From The Dark (Agency) Side - Rosie Anderson

I've not spoken for a long time in public so this might be a little bit Rusty I'll just put that out there now um so who am I I don't know how to use this so I think I'll give up in a minute no no give me one second I'm Suddenly at the end I'm going to present via memes uh I can't get this can I have a oh I told you I was going to be rusty how do I get so I can moveth my slides I've just gone straight to the end oh have you all right okay I don't know what you're using oh yeah go can I them that way oh even better

perfect right okay sorry who am I I'm Rosie Anderson I do not work in Tech I work in Recruitment and I've been doing that for two decades despite my slightly hunger over baby face um the last 7 years I've worked in cyber security recruitment so over the past two decades I've helped hundreds of people get jobs in either Tech or cyber I'm head of Industry mentoring for capslock which I volunteer to do uh capslock is a boot camp I'll talk about that a bit more in a bit I'm a working parent I've got two kids um so I'm an advocate advocate for flexible working for people not just parents but for everybody and I'm a

retired party girl so last night I might have been a party girl but not today um so I'm going to do this talk in two Hales I'm going to talk about hacking your career for 10 minutes and as you can then ask questions and then I'm going to talk about how to hire and how to hack that recruitment process um so feel free to ask me questions so you want to work in cyber so I'm going to aim this at people who are new to the industry so saying you want to work in cyber is like saying you want to work in science the field is so broad so if that's what you want to do you think

right I do want to find out what this sexy cyber security is all about you need to start thinking about what areas of cyber you want to work in and there's what's your motivations what you kind of enjoy so you can find the right path um there's so much free resources out there if you go on to YouTube and watch the crest day in a life you can watch the day and life of a pentester the day and life of a red teamer and you can get some insights as to all the different types of roles in cyber so before you um kind of go out networking with people have a bit of an idea so you can really

help people pinpoint the advice that they give to you there's so much more to life than just being a pentester or being a sock analyst there's so many roles in cyber security if risk is your space there's so like so many different opportunities and pths that can go down uh there really is a role for everybody so there's Dev set Ops there's risk management there's identity access management there's building secure systems we need so many different people in cyber you can bring transferable skills from anywhere um so like I said it's really broad these is just I'm sure it's probably some more stems since then so if you're trying to start out in a career and you think okay there's a lots

of people trying to get into cyber security if you look at something like identity access management or Cloud security it's somewhere that you can um really sort of it's not as competitive oh there's not as many people saying I want to work in that area so I'm going to have a drink okay so you've decided what you want to do and where you want to work or you've narrowed it down a little bit so now we're going to build some technical skills um if you're coming in from a a starting point of zero in terms of Technology like me um you're going to have to start building some technical skills to prove your interest shall we

say um there's so many different opportunities here I've mentioned Security Plus network plus these are you can do some of the professor Messa training in for free um to kind of start building that knowledge and it is something we see on job specs for entry level candidates you can go on to try hackme and then as you get a little bit more technical you can go on tack the box and build out those kind of um technical skills there are boot camps so caps lock is a boot camp um and there's fantastic opportunities to learn in that environment if you want uh a training obviously you can go and get a degree for me I would look at a boot camp um

you can do so with capot you can do it as a student loan so you don't actually pay anything back until you're earning more than x amount um there's Discord channels and places where you can start to meet other techies like yourself so digital overdose capture the talent these are discords for rookies with experienced people in as well I've put simply cyber there they've got a really good um entry I think it's Master risk analyst where you pay what you can um and it's really really good content to start building upon that knowledge the advantage with all of these sort of labs that you can do on Range force and you get a shiny certificate and with

that shiny certificate that's something that you can put on your CV so when you're applying for a job they can see that you are actually doing some self study on your own and you like to learn so we've built some technical skills and then we're going to build some professional skills so what I would recommend doing um so is I'm going to start again any good pentester knows that you compone the box and get domain admin but actually now you've got to write a report so these are the professional skills that everybody's sort of going to need so if you want to be a pentester when you've hacked the box or whatever you've pwned you then

need to do a write up about that um you if you do that sort of write up as though you're describing what you've done with a walkth through you're practicing those technical skills and then if you do a write up as a executive summary of what you've done these are things that you can put in your portfolio and you can share on social media share on LinkedIn that shows your knowledge and your passion it's again something that's showing that although you don't necessarily have technical experience already this is what you've been doing um I think one of the really good things with the rise of discords and things like that is you can find a community like like here like

at bsides I don't know if bsides has a Discord but you can find a community of people who want to help you learn learn and build upon those technical skills and start writing that blog um that is one of the ways that you're going to get a role um an entry level role and make yourself sort of known now I know some for some people they don't really like LinkedIn or they feel a bit scared about sharing your first things I would say you know you're at bsid here now you're networking networking on LinkedIn is not scary it's it's way less scary than speaking to strangers in in person so let's hack your career you've

done all these things um you see a job advertised on LinkedIn or wherever don't just apply for that job that's what everybody's doing contact the hiring manager figure out who's going to be the hiring manager there figure out if you know somebody who works for that company so if company X if National Grid is hiring for a sock analyist go and speak to somebody that you know at National Grid ask them about the culture ask them why they're a great place to work you're socially engineering your way into speaking to that person um who's potentially the hiring manager network with people at all levels network with people who are doing the job that you want to do and ask them you know how how

did you start how what would you do if you were back in that position um these are the sorts of things like I say if you don't if you're networking on LinkedIn before that job's advertised and you're doing all these posts of what you're learning and the journey that you're on you should then get notified about opportunities before you even um before they go live to Market this is how I would get my first job if I was in that situation I am obviously a recruiter chances are you're not going to get your first job through a recruiter like me um because and a business won't necessarily want to pay a fee because they pay fees to recruitment

agencies for hiring Talent now the only thing I will say is if you want to be a soan list go and speak with Renee and Tazo that's all he does that's all he recruits for and he helps lots of people of BU bued socks um any questions sorry it's very hot up

here oh sorry yeah do you find any offering apprenticeships for 6 ucation yes um there's a level four apprenticeship I think in cyber so one of the people um that I placed without a degree in a consultancy actually she' done that apprenticeship and I think apprenticeships yeah we we do see it they don't necessarily come to recruitment agency and it's one of the things I recommend to customers and say when you're hiring Talent it shouldn't just be experienced Talent it should be all these different routs what we also find is I think where um the thing with apprenticeships even apprenticeships are heavily competitive so I'm pretty sure there was a guy at an automotive Finance

Company shared they wanted to hire an apprentice but even people coming out of un of a school um or university they're not get being given this advice they're just applying for jobs and I think even at that sort of level you need to be doing something to make yourself stand out and not necessarily you don't have to have technical experience but even apprenticeships are really heavily competed I think competed is that the word in cyber any other questions cuz I fixed the

mate yeah yeah um you always get the best teams when you get a diverse Workforce how do we encourage people from nontraditional backgrounds to apply for for jobs in cyber oh tough one um Pizza yeah I think a lot of companies will allow or should be allowing their staff to go out and do stem Outreach so there's plenty of stem events I actually think we are getting more diversity in terms of D diges degrees I think that's starting to turn the corner but actually going out and hunting for that Talent where if you want to hire apprentices going out to the colleges and saying hey we're hiring or going out on on LinkedIn you know so many jobs are found on

LinkedIn and saying does anybody have a uh teenager or child or can anybody recommend and normally it is those sort of networks I think what B sides uh do fantastic is they have careers tracks for kids and they have you know it's a friendly environment steelon does the same don't they but it shouldn't just be about kids it should be about everybody and there's a big push to reskilled Workforce so caplock again um they're reskilling people in cyber and that's what we need but if you're hiring if your company X I'm going to use National Grid again CU you um if you're National Grid you should be going out to people within your business to say the IT team

is crying out or the Cyber team is crying out for people is anybody interested doing meetups um like meetups I know ladi's hacking Society is fantastic to get uh with meetups and things like that but just sharing the knowledge like that again this is why bides are fantastic sharing the knowledge of what we're doing and it's not just you know it Network room and it's not cyber with the hoodie um sort of bringing the people alive of what we're doing I hope that answered it I'm regretting drinking last night Ju Just one comment on the last one sponsor a table at a bsides and have your team there saying they're recruiting I've done it at two events some really good

candidates from diverse backgrounds yeah and it doesn't cost a lot and I'm sure bsides definitely always need more sponsors indeed all all conferences not just bsides yes uh yeah lots of people need extra bodies and this is a nice way to meet people so remember introduce yourself to the people sitting next to you yeah and it's easier it's easier on LinkedIn right I'm going to do the second half now so this is for people who are hiring and my advice and what I've learned um so again I've been hiring for two decades I've been here for a long time doing this um yeah I'll just start that let's start with your job description your job

description should be what you want from the candidate and what they need to do um what they're going to be doing dayto day what's a typical day look like um what we see with job descriptions in recruitment is we get a job description and it's normally got a date stamp and it's about four years old now let's be honest the role will have changed in the last four years so the hiring manager should write the job description and fair enough then give it to HR to put whatever tools that they do to make it HR um but then go and speak to the people in your teams and say is this right so we had this once in recruitment

where people were coming in and thinking this was a previous company I went that people were coming in thinking the job was going out meeting people and all of this which it is the more senior you get but when you start you're on the phone speaking to people there's no face Toof face contact but it was in the job description that that's what it was so there was a alignment um your job description try and take out all of the things you know really question do I need a degree that's my first question to a hiring manager if they they put a degree on there degree or equivalent there's plenty of other equivalent experience than having a degree does it

have to be x amount of years of this and I see all of the time and we place people all of the time that don't match all those things on the job spec if it's on there you're going to be putting people off now your job description is not your job advert your job advert is why they should come and work for you so why are you a great employer why do your Workforce love working for you why um you know why should somebody come and pick your job don't put on your job advert desirable skills because it will put people off as a female the statistics that back this up I will only apply if if I hit 70% of that criteria

now I will also say apply if you hit 30% as a man you'll apply if you hit 40 to 50% there's some statistics around the back of that so think about when you're advertising definitely don't advertise any desirable skills you can use that as part of your interviewing process um if you ask your current staff why do you like working here and they can't answer recruitment's going to be in your future so these are things to sort of what look at um now stop asking for X when you mean why so if we see a job spec that says um trying to think of a perfect example had one in I'm going to go through some good

job specs in a second we see a job description this massive wish list let's just call it what it is do you really need that technical skill do you need this scene tool or can it be any seam tool but let's wise out to try and make a job specs actually reflect the job so many times I see a job spec that's got I look at it it's like it's that's two jobs that's three jobs like let's really narrow down what we're hiring for and then show the salary and if you say to me we can't advertise the salary because our current staff will get upset again I'm probably going to be speaking to them staff soon

um advertise your salary or put a range now I do get some people can't do this for whatever reason you'll get 76% more applicants if you advertise the salary many a time I speak to a candidate who says oh I saw that job advert but didn't know what the salary was so I wasn't going to apply but yeah I'll apply through you Rosie as a recruiter because I can advertise salaries same for benefits what are the benefits what are the real benefits don't just say you get a pension what's the percentage you get a bonus what does it look like please do this and it will help it will help you so much so some really good job adverts so

what you should be doing as well with your job adverts like this guy did he he's the ciso this is a live role he's hiring um he's shared it to say no anybody who interested now what I love about this we're not looking for certifications or years of experience hooray and remote or at one of our office or a mixture you choose he has massively increased his talent p because he's put that now when I clicked on the job the salary is on the job it's not put it on his post and the benefits are there and that's actually quite a decent benefit thing he not saying you get 20 days holiday that's the minimum you can

give somebody so many different things and he's talked about maternity and paternity pay so again he's showing that a really good company that's got some decent benefits now this one is sh a so this is Glenn at skybet sent me this this isn't a live job but again he's got a salary banding which is quite a wide banding and he's got some really good benefits but he also talks about the team's goal is lots of decent things in there which isn't just a list of technical skills and doesn't bring it to life I also again love the flexibility it opens up your talent pool now interviewing any body that you interview you should give feedback to if

they're giving up their time to come and interview with you even if it's a no you should give some constructive feedback because that person say it isn't newbie and the person you had um you did a really good interview we thought your skills in X Y Z were excellent but the person we hired we felt was a better fit where I think you could develop in the future if you focus on learning more about Linux or active directory then come back to me in six month time that's constructive feedback you should have taken notes during an interview anyway so you should be able to give them something or at least very least tell them it's a no and the amount of people

that I speak to that don't get interview feedback that person will never come and work for you again and when they get that first job you might want to hire them in six month's time so anything you can do to show that it's you're you're a decent person to be honest will help you when you're coming to recruit now you've interviewed your person I told you there was some good memes you've interviewed your person and they've got a 12we notice period which is normal uh for a senior person you need to be speaking to them really regularly because just because you've offered them doesn't mean that all the other interviews they had aren't still hounding them doesn't mean that their

current employer is not going oh we're going to lose this person let's offer him 10 grand more or that promotion that they wanted and all the way through through that process all the way through that onboarding period before they actually start with your company one of things you could do is get somebody within the team to start reaching out to them invite them to any socials that you do invite them to meet the team come for lunch with the team because that's a long period for you to still lose somebody it's not a done deal until they start um so that onboarding process and sometimes it does feel like it can take two years think about what you can do to

already make them feel like they're within your business any questions sorry can't see

y oh mic problems okay questions question question question three it's really bright up here yeah um hi um just when wondering what what you seeing in the industry at the moment you keep hearing that it's um hard to recruit or it's an employees um environmental moments and employees market and stuff yeah what what are you seeing so it is wild um I'm seeing on boarding um what's the word sign on bonuses I'm saying particularly for experienced staff there is a war on talent I do have some data if anyone wants salary data just message me with how much the salaries are rising so for example network security salaries in the last 6 months have risen 25% of what

people are advertising and it's it's different in different locations but I've got those sort starts and things and I think we are whether or not we're heading into a recession let's probably won't get political um I don't think that's going to make a problem at all with cyber staff people there's there's still more threats there's still that struggle to get good people what I see is there are lots of jobs out there but there's lots of processes that make it difficult to hire and if you are a if you're already in work and which is talent that people come to meet to find you're not out there looking for a job so if if you are

hiring it should be down to you and your recruitment Partners to be in the industry and finding the best people for the job now the best person for the job might not even know about you um and that's where you do need head hunters for experienced staff I think there's so much good going on to get more people in and like besides ladies hacking Society there's so much to get the interest and these community events need help if you can volunteer or give some time or speak at these sorts of things or like caps slog we have people who come and talk to us as mentors um or come be a guest speaker and then they can go and hire

from that diverse talent pool um it's not easy uh that's why um I think I've done this talk before and I've called it Talent attraction it's not hard is it it is hard hard it's easy to drop the ball somewhere which is where you have to think about it it's not just stick an advert out and that's hope for the best kind of thing everybody who goes through that experience with your company who's who's has a touch point at some point with your company through that recruitment process that's your impression you're giving in the market and it's very easy to get a bad name against your yourself if you're not nice to candidates or you're not a great

place to work I think what I am seeing one of the first things I do say to people is if you are looking to leave oh so with recruitment one of the things I see is the reason people are looking to leave is because they're not getting promotion opportunities or experience with the experience that they want within their current company and actually I think that's a mistake that companies make you need to be looking at your current staff and saying okay let's let's the pandemic has reset everybody's expectations what was right before isn't now how can we keep you what can we give you as like a promotion opportunity so can you give somebody help can you get

them to help in the recruitment process can they budy with somebody to get some experience before they're ready to be a team leader and the companies that invest well and do bring in junior Talent you can see how fast they grow because they are investing in people Rosie do you know want people to like have terrible job or like experiences so they want to then move and contact you no um one more question over here for I'll move into the light so you can see me sorry I sneaked in at the end of the session but one thing I was wondering you may have covered it already but do you think that recruiters um put in place

enough uh support to deal and cater for the ne Divergent Community yet because that's quite prevalent within our industry so uh I think in cyber I feel there are there are there is a lot of support um out there there's resources there's lots of information out there to how how to hire and how to attract neuro Divergent Talent it's not one siiz fits all uh if you're working with a recruitment agency you should let them know if there's any adjustments you need um and I think where we get like CTF events and things like that if we want to hone in on people who've got technical skills that's something that you can do as a way to assess people's

Talent without the CV um I feel with like auton and mfil pots company um can't think what it's called at the aasi might be me U there there is support and there's ways that you can tap into that talent but I think neurodiversity is a superpower it's one of those if you put sort of two different neurod Divergent types of people in a team together they can complement each other with the different skills but I think with if you want to hire that type of talent maybe look at technical assessments rather than face-to-face interviews um eye contact can sometimes be a struggle for people um there's things that you can do to make your recruitment process more tailored if

that's the T talent that you want to tap into yeah we go have I gone over probably no no there is there is there is so here we go cheers hi um a few of us were talking yesterday and we were saying how um you know one of the things we sometimes prioritize is team fit over skills cuz you can teach skills so yeah do you have any tips on providing feedback to somebody you don't think is going to fit well with your team cuz sometimes that can be a struggle how to positively give them feedback of you know don't be too full of yourself whatever you know what I mean um you I do I do sometimes get you might

need to give some p a person some pointers on this this and this I think what you're better off doing is giving that message in a positive way um you you can say the person um the person that we hired had this this and this something to work on for your next interview be this um or if you've got a recruitment partner get get them to deliver the message I think it's better to be honest with a person you know like you turn up late for the interview the amount of people that we have to say that to or you didn't put your camera on on a video call or a video interview that sometimes actually if they don't

know they're doing something wrong how can they fix it and they're better off having that message then because that will help them in the long run they might be a little bit pissed off at getting that message but temporary pissed offness but you get a job later on when you take on board the their positive criticism um I I would say deliver the message or get your HR or recruiter to deliver the message yeah don't just say oh it's not a good fit cuz that doesn't help anyone and it's a wory way of getting out of it [Music] yeah how are you seeing things change towards remote work or away from remote work is what I'm starting to see I think

we must have you in X days in the office yeah and must be within X distance I used to see that all the time and the pandemic has really reset things um there is no one- siiz fits all and you shouldn't do like the same with inside I35 blanket assessments you shouldn't just go this is what we're doing um we are seeing more hybrid working and clients requesting that and I will say to them okay do they need to be in the office one day a week has it got to be a certain day how flexible it is but I also say particularly so we do Tech and cyber with software developers company X has now mandated that you've

got to be in the office company X's employees are all replying to my messages that they've not replied to for however long um so it is a risk but if you actually approach it as a sensible conversation with with your staff and say right it team do you want to be in the office what works for you right that's you sales team accounts team shouldn't just be the whole company now does this because it's like anything you approach a a blanket assessment to it all you're going to alienate and you're going to shrink that Talent [Music] Port it's hot up here so I noticed if we coordinate the order in which we put our hands up

someone has to run quite a lot is that is that something you're doing on purpose um you you mentioned how much more interest you get from a um a posting when the salary is listed yeah um what conversation what conversations can you have within an organization when that's something that um your talent acquisition folks are resistant to are are there ways of having that conversation that you know of um I I understand sometimes why people don't do it they don't want the salary bandings known because you know I hear regular Arguments for not doing it but the evidence is there with how many more applications you get and I think it it depends who owns the recruitment

process is it HR is it the hiring manager if you keep having the same conversation and keep talking and communicating hopefully you can get to the bottom as to why and if it is about internal salaries people know it anyway um what you can do if it is a problem so we have one customer who will say to us um you're not allowed to advertise salaries and I'll kind of go back and go really I know what I'm doing okay well we won't advertise the salary but talk to us about it if you have a conversation with us we'll then discuss the salary banding so that's one way you can potentially get it around but yeah

um just keep having that conversation and keep trying to B batter them into submission any oh could someone further away ask a question just can run a bit further I am going to be around after as well if nobody gets time or you want to come and speak to me afterwards hi um just a question about any advice like you say being a working parent and if you're seeing um more accommodation from businesses with flexible work and just think how it is tough to either reduce your hours as a working parent or makeup hours and even though lots of especially in Tech it's quite F can be flexible work and not time pressured sometimes um

it's still tough this like like oldfashioned view of you've got your eight hours a day yeah um because you say about sometimes like working school hours and stuff didn't you say so just any advice or if you're seeing anything so we companies that do it really well will kind of go look you're the professional as long as the deliverables are here I don't care how you do it and if you have that type of organization or or team where you're trusting your team to get the job done doesn't matter what hours they do now obviously it's not going to work in a sock or in a 24/7 environment but if that's a benefit that is a massive benefit that should be on

your job adverts when you're going out because you will open up the talent pool 100% And it's not just working parents it's people with caring responsibilities it it's anybody if somebody says to you I don't care what hours you do as long as you do eight hours at some point over the day or 40 hours over the week or whatever it is that is a massive perk so I am probably unemployable which is now why I work for myself because I work school hours and then I work in the evening now that doesn't suit everybody if you've got um if you have Asia stakeholders you're probably going to work at 700 in the morning till 3: don't sort of think

about your environment and then think about the benefits of that and again if you if you speak to your staff and they say I love working here because you don't give a if I'm not online at 9:00 or that's a perk that you need to go out into your job adverts with to say we're the type of environment where you can do this you we trust you to get your job done it's not about presenteeism which is why we don't care if you're in the office but so many times I see a job advert and when I speak to them it's like oh yeah you don't have to be in the office why have you advertise it as

London then like it's it's these sorts of things that you can do to massively open up that Talent p and flexible working is something that's here to stay and will open up for you different types of people thank you um I was just wondering what do you find most frustrating about the recruitment industry I do love it I do love it um job offers so when you're offering a candidate and you've been through that process and say they want 50k as an example and you offer them 40 5 the first thing I will say to you is really if you offer them 45 and they say no and we going to go back to 50 youve

put a seed of doubt in that person's mind who's changing jobs that seed of doubt if somebody el else offers them 50 that you've eventually got to they're going to go there don't low ball just to try and save a couple of grand offer people what they want and what they're worth if you say I'm going to offer you 45 but if you do this and this and this sir which I'll pay for then you can get to here do it that way but don't just lowall to save like a couple of grand on the agency spend or whatever any other oh you did actually have a question thank you for waiting until I was across the site

though um everybody gets disappointed when they don't get a job MH but what's the flags that go they've actually had a lucky Escape for not getting the job in your opinion oh oh so many um they don't get any feedback um like if if you get if you get offered a job um and you think I've only had one interview I want to speak to some a team um you there's no reason why you can't say can I have an have can I have like an informal chat with who I'm going to work with and if they won't do that or they're not very accommodating through that process that's a red flag for me um

we do hear of places where there's toxic cultures toxic management you can normally start to gleam if you're going to get on with the person who's interviewing you in that interview and if if there's no time for you to ask questions or it's like a one-sided thing it's they're taking the box for if you fit with them that that for me is a red flag it needs to be you know changing jobs is a career decision it's a big decision so many times we hear I need to speak to my partner and it's because it can be a life-changing decision to to move if you're going to move um for a different role different things it it affects so many parts of

your life so if if you're not getting an opportunity to ask those sorts of questions or there's something normally in that interview which will give you a sign that this might not be great go on glass door um you know have a look at companies there is there's quite it's not really funny but it makes me smile there's a company on glass door and I think one of the reviews is the management is like a cancor in this company and I'm like there more than one of them um and speak to people like have a look on LinkedIn and look at leave recent levers you know if there's if all of the sock team have suddenly left

they' probably like made up and go back in the office or things like that hiring managers you should always have a meet the team part of the interview process because like this person's going have to work with them so yeah yeah definitely if oh oh I did that yesterday off not off okay you're fired um one more yeah there's lots of organizations that need to do significant change with their it systems at the moment and you know the ransomware threat isn't going away any time soon because of the people higher up the organization um and their inability to fundamentally change what they've had for years how do you sell the people into the job that they know is going to be

arduous horribleness I don't do it needs to actually be different oh okay so be honest um okay we need to change culture in this team we're hiring obviously maybe not put that all of that in the job advert but we're hiring somebody who can come in and real make real change that will be an interesting challenge for somebody if it's a we need to rip out a system and you can't you can't polish a turd um you get a contract to come to come in and do it um there's you just need to be honest about what it is because if you catfish a candidate to come and work in an environment and it's not what you say

then not going to last for long um you're better off looking at well there's multiple different types of talent there's contractors there's there's people who enjoy coming in and dealing with conflict and sorting things out that's a different skill set to a technical person who needs to deal with security architecture and design something brand new in critical National infrastructure just be honest about what you actually need i' be my advice there okay thank you a round of applause for Rosie wo f