PERSPECTIVES FROM THE CAMPUS
One of the strengths of Indiana is that we bring together a variety of perspectives from the plethora of areas that touch the field of cyber, especially through the colleges, universities, and other institutions of higher education throughout our state. Hence the name, “Perspectives from the Campus”, we invite experts – immersed in the pursuit of educating their students – to offer their knowledge for finding solutions in cybersecurity that benefit all Hoosiers.
In the latest installment of this series, David Dungan, who serves as the co-founder of the Indiana Cyber Network (ICN), offers his thoughts on the benefits of changing the way people are hired for a career in cybersecurity and why finding a solution is something that could help us – as a society – stay better protected from online threats.
Housed at Anderson University, ICN is a nonprofit public-private partnership and consortium of academic institutions building the state's cybersecurity workforce and defense capabilities.
By David Dungan
The cybersecurity industry still has a “workforce development” problem.
According to Cyberseek, there are 514,359 job postings for cybersecurity-related positions in the U.S.; a figure that includes more than 5,300, here in Indiana. Of course, as with any problem we decide on, there comes the realization that it’s not just about the numbers.
To fill those gaps, every sector within the industry is going to need to rethink its approach on not only how we hire people in cybersecurity, but who we hire, along with the process we use to make those decisions. Most important of all, we have to recognize the benefits we – as a society – can gain by doing nearly ALL of this, using methods that we choose to fully invest in; something we haven’t done until now.
First up, we need to greatly expand the places we look for talent to fill these openings.
Fully 15 to 20 percent of all adults are neurodivergent. Their brain chemistry is wired differently, largely due to the fact that they’ve been diagnosed with a developmental disability, such as autism, ADHD, or dyslexia, but they also possess a set of distinct cognitive strengths; skills that make them exceptionally well-suited for high-demand roles in cybersecurity.
Unfortunately, when it comes to interviewing for a job, the industry has relied on traditional hiring practices that focus on social nuances and standard interviews over actual technical skill. These “one-size-fits-all” approaches, which often value things like eye contact and networking over problem-solving, inadvertently weed out most neurodivergent candidates before they ever get a chance to genuinely demonstrate their skills and experience.
What is it that we really need in this industry?
- Pattern recognition.
- Endurance under stressful conditions.
- Persistence when tracking a threat through a network.
- Out-of-the-box problem solving
To be clear, these things are not “nice-to-haves”, but rather they’re “need-to-haves”, and they're all traits that are commonly found among people in the neurodivergent community.
Several large corporations have embraced this – as part of their hiring practices – and are experiencing some success, including:
- SAP has been utilizing their Autism at Work initiative since 2013, with 240 neurodivergent employees in 16 countries, with 90 percent retention rates in fields including cybersecurity.
- Microsoft has been operating their Neurodiversity Hiring Program since 2015, placing individuals on teams that are working on projects such as Azure cloud security and Windows development.
- EY's Neurodiverse Center of Excellence is focused specifically on data analytics and cybersecurity jobs, and their model is now being replicated by other organizations.
What is the common thread between these organizations? They have eliminated the traditional interview process, which is a major impediment for neurodivergent individuals, in favor of skills tests and tryouts.
A recent study by the ISC2 Cybersecurity Workforce Study discovered that 73 percent of neurodivergent individuals believe that the field of cybersecurity is well suited for people like them. This is good news indeed! However, the study also discovered that only 44 percent of these individuals believed that they could be their true selves at work, as opposed to their neurotypical colleagues.
What can Hoosiers do with this information? If you are a manager, consider the hiring process in place at your company. If you are neurodivergent and interested in a career in cybersecurity, know that organizations like SANS are creating a community designed specifically for people like you.
And if you are someone who’s concerned about the security of Indiana's digital assets, consider supporting the organizations and the educators in the state of Indiana who are working hard to create a welcoming environment in the field of cybersecurity.
Different brains are not the problem; they represent a solution that can benefit all of us.