Hiring capable cybersecurity analysts without requiring a college degree can be a strategic move for security leaders. Just last week, Security Week published an article about how the National Cyber Director, Harry Coker, has made the decision to remove the four-year degree requirement in federal IT contracts and will push agencies to hire based on experience, certifications, and aptitude tests to help fill more than half a million open cyber jobs in the United States. When we look across the world the challenge is even bigger with many credible outlets reporting more than 4 million open cybersecurity positions as of today.
Cybersecurity is constantly evolving so hands-on experience and practical skills can often outweigh formal education. Security leaders may want to take a novel approach and consider tapping into diverse talent pools that bring creativity and even a hacker mindset to solving security challenges. Here’s some thoughts on how to get started:
Focus on Skills, Not Credentials
When screening candidates, focus on technical competencies, certifications, and practical experience. Look for evidence of proficiency in key areas such as network security, vulnerability management, and incident response. Certifications like CompTIA Security+, Certified Ethical Hacker (CEH), or GIAC provide a foundation of knowledge and show commitment to learning. Additionally, candidates who have contributed to open-source security projects or have real-world experience through internships, freelance gigs, or bug bounty programs are likely to bring a hands-on, problem-solving approach to your team.
Look for Problem-Solving and Analytical Abilities
Effective cybersecurity analysts are excellent problem solvers. Instead of focusing on theoretical knowledge, prioritize candidates who have demonstrated their ability to think critically and creatively about security challenges. During interviews, present them with real-world scenarios where they need to articulate how they would identify vulnerabilities or respond to an incident. This will help you assess their approach to troubleshooting and response under pressure, which is far more revealing than merely reviewing their educational background.
Value Hands-on Experience
Hands-on experience in cybersecurity can be gained in various ways, such as participating in Capture The Flag (CTF) competitions, contributing to GitHub projects, or engaging with platforms like Hack The Box. Candidates who engage in these activities tend to have strong practical knowledge and are accustomed to tackling complex security problems. Reviewing portfolios or asking for demonstrations of past work or contributions in these areas will give you a solid understanding of their skills and initiative.
Create Apprenticeship and Training Programs
Developing apprenticeships or in-house training programs is another way to find and nurture talent without the need for formal degrees. Offer opportunities for entry-level employees to work alongside seasoned cybersecurity experts and provide them with a structured learning path. These programs can help bridge the skills gap by offering practical experience and continuous education, ensuring that your team is always evolving with the latest security trends.
By focusing on practical skills, hands-on experience, and a candidate’s potential to grow, security leaders can build strong cybersecurity teams and culture without requiring a traditional college degree. This approach also promotes diversity in hiring, bringing in fresh perspectives to tackle emerging threats.
Technology Can Help Fill the Skills Gap Challenge
In the meantime, technology can help augment what your team is able to achieve. Solutions like CodeHunter can help address the need by delivering automated malware identification and analysis.
As the demand for skilled cybersecurity professionals outpaces supply, CodeHunter’s automated threat identification platform can perform complex analysis functions in minutes so teams can focus on remediating threats. By automating labor-intensive processes such as static and dynamic code analysis, CodeHunter enhances efficiency and reduces the time it takes to identify vulnerabilities, helping organizations stay ahead of evolving threats despite the skills shortage. To find out how CodeHunter's patented threat hunting engine can bolster the existing power of your security team and reduce threat detection time to better protect your organization here.
