Security Leadership Master Class 5 : Getting hired and doing hiring

This is part 5 of a 7 part series grouping together sets of prior posts into a particular theme. 

1. Security Leadership Master Class 1 : Leveling up your leadership
   

2. Security Leadership Master Class 2 : Dealing with the board and other executives
   

3. Security Leadership Master Class 3 : Building a security program
   

4. Security Leadership Master Class 4 : Enhancing/refreshing a security program
   

5. Security Leadership Master Class 5 : Getting hired and doing hiring
   

6. Security Leadership Master Class 6 : When disaster strikes
   

7. Security Leadership Master Class 7 : Contrarian takes

A successful career in cybersecurity relies on rigorous preparation, strategic hiring, continuous development, and intentional management of work/life balance. Here is a summary of critical advice distilled into four key areas:

Handling the Interview and Landing the Job

1. Conduct Deep Contextual Research: Go beyond the organization's standard website, researching its mission, strategy, and current challenges by utilizing resources such as financial industry reports and public incident disclosures. Additionally, research the interviewer's background to anticipate questions and understand the formal objective of the specific interview session.

2. Frame Your Experience for Relevance: Cast your skills and experience directly into the context of the organization's goals. For example, if the company is migrating to the cloud or expanding into regulated sectors, highlight your relevant experience efficiently assuring compliance or managing that technology.

3. Articulate Your Specific Impact: During the interview, clearly state when you were the instrumental force, catalyst, or leader behind a major change, avoiding the overly humble tendency to share credit that can sow doubt about your personal contribution. But also remind the interviewers of how you then developed and harnessed the team. 

4. Demonstrate Critical Thinking and Problem Solving: If you are asked a complex question for which you don't know the precise answer, use the opportunity to showcase critical thinking by stating your assumptions and hypothesizing how you might approach the problem.

5. Be Positive: Always portray yourself as running toward a new opportunity for growth rather than complaining about or running away from a current role. Conclude interviews by asking thoughtful questions that demonstrate curiosity and connect discussions across different interviews or inquire about Board and executive priorities.

Selecting and Interviewing Candidates for Roles

1. Prioritize Intrinsic Aptitudes over Simple Skills: When selecting security leaders, look beyond expected technical/role proficiency and focus on essential intrinsic attributes, including curiosity, the depth of which a candidate probes root causes, the ability to build influence, and persistence in driving long-term change.

2. Test Critical Thinking and Assess Depth of Curiosity Depth: Use questions that invite candidates to articulate their assumptions and hypothesize approaches, as the goal is often to test critical thinking and the ability to deal with ambiguity, rather than just checking for precise knowledge. Specifically, probe for evidence that the candidate examines the "root cause of the root cause" and can break down complex situations into tractable components, and identifying high-leverage (80/20) control opportunities.

3. Evaluate the Candidate’s Source of Influence: Determine whether a candidate relies primarily on "role power" (positional authority) or actively builds long-term networks and influence with internal stakeholders and external partners, noting that sole reliance on role power is often temporarily useful at best. Ask them to explain how they advocate for significant change and manage resources incrementally.

4. Demand Honesty and Assess Resilience: Ask candidates for examples of what they have learned from failures in crisis or incident management, as no one manages all crises perfectly. This reveals moral courage and a commitment to learning. Additionally, look for evidence of persistence, the "relentless grind" required for incremental, multi-year change, and inquire how they maintained personal and team morale during such efforts.

5. Determine Strategic Outlook and Cultural Fit: Assess the candidate's strategic mindset by asking how they develop strategies, question assumptions, and align security goals with the overall business strategy. It is crucial to determine if they possess the cultural compatibility necessary for the role, recognizing that for some positions a leader might be needed who is expected to intentionally change the culture.

Managing Leadership Transitions

1. Prioritize Learning vs. Too Rapid Change: Do not make quick decisions immediately upon arrival. Instead, spend time absorbing the culture, learning the business, and understanding the people and the essential core elements of the function. While visibility is important, meeting teams and internal/external stakeholders, aiming for a complete reorganization or new strategy within the first 90 days can be dangerous unless the situation is truly urgent.

2. Be Patient and Actively Listen: When taking on a new position, prioritize listening to people rather than immediately explaining your vision. If you listen actively, you can rephrase concerns back to people to ensure understanding before explaining how your vision might address their underlying issues. If the role is significantly new to you, set up an education program to quickly understand the organization’s specific technical complexities and nuances.

3. Over-communicate Vision and Strategy Consistently: To motivate and gain commitment from the team, you must over-communicate your vision and strategy. Communicate more even when you think you have communicated enough. Your strategy and principles should be constantly repeated and contextualized within daily decisions, presentations, project updates, and announcements, such as leadership changes or promotions (e.g. when announcing a promotion explain what that person did to support the vision). 

4. Embrace Transparency and Directness in Management: Tell people clearly why certain actions are necessary, explaining how the current situation warrants any strategic changes you introduce. Being transparent, even brutally so, fosters respect and support, even if people initially disagree with the proposed approaches. This transparency is essential for resolving ambiguities in organization structure, roles, responsibilities, and reporting lines.

5. Let Go of the Past and Adapt Your Approach: When transitioning, you must let go of your old role and allow your replacement space to put their own imprint on things. Furthermore, avoid simply running your prior "play-book" word-for-word in the new organization. Instead, view your career experiences as a "toolbox" of skills that need to be used in different combinations and ways, adapting to the nuances of the new environment.

Managing Work / Life Balance

1. Adopt Career Stage-Specific Commitment Strategies: For senior leaders facing many high-quality choices, practice essentialism by only pursuing opportunities that evoke an unquestionable "Hell Yes, or No" response. Conversely, for those starting out or changing roles, adopt the "Soft Yes, and Fast Quit" approach to gain broad experience and identify the few opportunities that then warrant intense focus.
   

2. Focus on Long-Term, Episodic Balance: Avoid the compound stress of attempting to achieve a perfect, equal balance between work and life every day. Instead, view balance as something achieved over the long run, over weeks or months, allowing you to put in crazy hours during crunch times, provided you intentionally claw that personal time back later.
   

3. Schedule Time for Work and Personal Priorities: To ensure things get done, schedule specific work tasks and personal activities (like family time) on your calendar. A major part of maintaining balance is the discipline to design your life.
   

4. Practice Smart Prioritization with Effort Grades: Avoid over-working by distinguishing which tasks require an "A-grade" level of effort versus those that only require a simple "Pass" to be deemed good enough. This allows you to focus supreme effort on the most critical activities while avoiding time-consuming perfectionism on the rest.
   

5. Conduct Regular Time Audits: Recognize that you may habitually accumulate commitments that spread you too thin. Periodically (e.g. quarterly), conduct a time audit to review what you actually spent your time on versus your stated priorities, using this self-correction process to drive meaningful improvements year on year. As they say, your calendar knows your true priorities.

Here’s a short video (thanks to NotebookLM) covering all of this.

The blog posts used to build this video and summary are here:

• Acing the security job interview.
  

• Conducting the security job interview.
  

• Hell Yes, or No - a more nuanced take on career choices.
  

• Keys to career success.
  

• Using the security community to advance your career.
  

• Leadership transitions.
  

• Career development - Part 1
  

• Career development - Part 2
  

• Work and life balance.