Breaking into Cybersecurity with Brad Rager

Chris: 00:00:13

Welcome to another episode of breaking into cybersecurity

2

: 00:00:17

leadership, where we talk to different

cybersecurity leaders about what we

3

: 00:00:22

could do to develop the next generation

of cybersecurity professionals.

4

: 00:00:27

Today, we have with us, Brad Rager, who

will be sharing About recruiting the next

5

: 00:00:36

level of cyber security professionals and.

6

: 00:00:40

I'll let him introduce himself.

7

: 00:00:42

Brad, do you want to introduce

8

: 00:00:44

Brad Rager: yourself to the crowd?

9

: 00:00:45

Sure.

10

: 00:00:46

Hey, thanks for having me on Chris.

11

: 00:00:47

Great to be here.

12

: 00:00:47

So yeah, I I run a startup

recruiting business called Crux.

13

: 00:00:52

We are building the first talent

platform for cybersecurity.

14

: 00:00:57

So you can think about us as both a

traditional cybersecurity recruiting

15

: 00:01:01

business and a marketplace.

16

: 00:01:03

So if you hop on Crux, you'll

be able to see the first version

17

: 00:01:06

of our talent marketplace.

18

: 00:01:07

I got started in cybersecurity

from the business side about five

19

: 00:01:12

years ago when I joined Optiv

where I ran corporate strategy and

20

: 00:01:16

was CMO for a few years as well.

21

: 00:01:18

So it gave me firsthand way to

view some of the challenges and

22

: 00:01:22

opportunities in this space.

23

: 00:01:24

And it led me to where I am today.

24

: 00:01:26

Chris: So speaking of some of the

challenges and opportunities, what

25

: 00:01:29

were some of the challenges and

opportunities that you first saw that

26

: 00:01:33

you now wanted to tackle on your own?

27

: 00:01:36

Brad Rager: I Think the first thing to

keep into perspective, and the reason

28

: 00:01:41

there are so many people that want to

be in cybersecurity is it's a field

29

: 00:01:47

that is, most industries go through

this S curve and we're still in the

30

: 00:01:51

really early stages of cybersecurity.

31

: 00:01:55

As more data moves online, as more of

the company's value is in their IP, their

32

: 00:02:02

data and their assets, the criticality of

security is only going to increase, right?

33

: 00:02:07

And we operate in this world where

it's this cat and mouse game.

34

: 00:02:11

You constantly have an adversary

that's trying to best the defenses.

35

: 00:02:15

So It means that the economic importance

and the risk associated with the risk

36

: 00:02:22

of poor cyber security hygiene, but the

economic value of protecting a company's

37

: 00:02:27

assets and data is only going to be more

important and it requires innovation.

38

: 00:02:32

It requires new talent, it requires

creative thinking, and it's

39

: 00:02:34

going to be driving growth for.

40

: 00:02:37

The foreseeable future.

41

: 00:02:38

So as an industry, it's an amazing

and dynamic industry to be in.

42

: 00:02:43

That also means there's lots

of challenges and things to

43

: 00:02:46

figure out along the way, right?

44

: 00:02:48

So I think we as an industry

have had so much coming at us.

45

: 00:02:53

Oftentimes it's been hard

to do things like build.

46

: 00:02:56

Training and development programs for

companies to bring people into and

47

: 00:03:01

build people's cyber security skills up.

48

: 00:03:04

We have just an incredible amount

of technologies that are out there.

49

: 00:03:08

Companies really struggle to integrate

those technologies and bring them

50

: 00:03:11

together and fuse kind of the people

dimension and the technology dimension.

51

: 00:03:16

I saw, a lot of that when I was at Optiv.

52

: 00:03:18

And one thing that I heard from the

folks that I worked with, CISOs and

53

: 00:03:22

practitioners, Was that a lot of the

pain points that they had and a lot of

54

: 00:03:27

the things that just weren't getting

done from a security program standpoint

55

: 00:03:31

wasn't because they didn't have the tools.

56

: 00:03:33

It was because they didn't have the

people to run the tools and follow

57

: 00:03:39

the processes and frankly, in many

cases, build the processes for

58

: 00:03:43

a robust cyber security program.

59

: 00:03:45

So we have a.

60

: 00:03:46

Significant people

challenge in this industry.

61

: 00:03:49

And my goal was to bring some, fresh

approaches to help customers solve

62

: 00:03:54

clients, solve those people challenges

and help us as an industry bring

63

: 00:03:58

more people into cybersecurity.

64

: 00:04:00

So as.

65

: 00:04:02

As a country, as an economy, and it's

the civilization we can be secure in what

66

: 00:04:07

we do online and with our businesses.

67

: 00:04:09

Chris: Now you've said a whole lot there.

68

: 00:04:11

Let's talk about how

you do things different.

69

: 00:04:14

So you mentioned preparing the talent

for all these new technologies.

70

: 00:04:18

What are some of the things that you're

doing on the front end to help prepare

71

: 00:04:23

Brad Rager: for that?

72

: 00:04:24

I.

73

: 00:04:24

I'm going to go to one of my pet

peeves in this industry, which is

74

: 00:04:30

the way job descriptions are written.

75

: 00:04:31

And there are so many job descriptions

that say, Hey, I've got an identity

76

: 00:04:37

and access management engineering

role, and they need to have.

77

: 00:04:41

Eight years of ForgeRock

experience, right?

78

: 00:04:43

And I don't know how many years ForgeRock

has been around, but it's probably

79

: 00:04:48

something around eight years, right?

80

: 00:04:49

I think there's a lot of unrealistic

expectations where people are only looking

81

: 00:04:55

for folks that have X number of years

experience with technology X, Y, and Z.

82

: 00:05:00

But the irony of all of this is

while those job descriptions are

83

: 00:05:05

everywhere that you look online.

84

: 00:05:07

Most hiring managers, when you sit down

and talk to them, would say something

85

: 00:05:11

along the lines of actually what I

really need is somebody who understands

86

: 00:05:16

the principles of IAM has a good

degree of engineering experience is a

87

: 00:05:20

great problem solver is hardworking.

88

: 00:05:22

And as if maybe they know

paying, maybe they know Octa,

89

: 00:05:24

maybe they know savvy, but.

90

: 00:05:27

That's okay.

91

: 00:05:28

We can teach them the ins and

outs of this particular tool.

92

: 00:05:31

That's not a problem, right?

93

: 00:05:32

And it's why don't you write

your job descriptions that way?

94

: 00:05:35

So I draw a few categories.

95

: 00:05:39

And as you think about fitting somebody

with a role, you want to balance

96

: 00:05:43

things across these categories.

97

: 00:05:45

One is what's their kind of core innate.

98

: 00:05:48

What are they good at?

99

: 00:05:49

Are they good problem solvers?

100

: 00:05:50

Are they good communicators?

101

: 00:05:52

Do they learn well?

102

: 00:05:52

Do they learn quickly?

103

: 00:05:53

Were they interested in doing

the second is what do they know?

104

: 00:05:57

What's their kind of knowledge base

and domain expertise, which can be

105

: 00:06:02

associated with the experiences that

they've had and what they've done.

106

: 00:06:06

And then the third set is what are

the teachable things on the job?

107

: 00:06:10

And in my mind, there's many tech.

108

: 00:06:12

knowledges, specific technologies can

fall into things that are teachable.

109

: 00:06:18

If you give somebody training

and time to do it, and there's

110

: 00:06:21

levels and degrees to that, right?

111

: 00:06:23

You're not going to teach somebody,

cloud infrastructure and in three months

112

: 00:06:28

or a month on the job, but can they

move from AWS to GCP may not be the

113

: 00:06:35

easiest thing in the world, but yeah,

probably most people can do that, right?

114

: 00:06:37

If they understand the underlying skills.

115

: 00:06:40

So I think there's a degree of.

116

: 00:06:42

flexibility and thinking that we as

an industry need to introduce into

117

: 00:06:46

our processes, really look more at

people's skills and not rely so heavily

118

: 00:06:52

on how many boxes of technologies

can I check on the job description.

119

: 00:06:56

And

120

: 00:06:57

Chris: that's, that seems like a

really hard challenge because you

121

: 00:07:01

have to convince hiring managers

that they have to go away from this.

122

: 00:07:07

Checkbox certification degree thing to

go into, Hey, these people have skills

123

: 00:07:17

and the skills are that they know how

to run foundational cloud technology.

124

: 00:07:22

They know how to run foundational

identity and access management

125

: 00:07:26

technology, and they just need to learn

this new one that this employer has.

126

: 00:07:32

How do you get them?

127

: 00:07:33

out of that safety net to be able to open

themselves up to hire this true talent.

128

: 00:07:41

Brad Rager: Yeah.

129

: 00:07:41

Yeah.

130

: 00:07:42

I think the first thing hiring managers

want is somebody who's done this

131

: 00:07:48

job before somewhere else, right?

132

: 00:07:50

That tends to be the easy button

request that you'll often get.

133

: 00:07:55

I actually think what happens in

the job description creation process

134

: 00:08:00

is a little bit more laziness than

it is malicious thinking, right?

135

: 00:08:06

Or not flexible thinking because so often

what happens is You don't actually find

136

: 00:08:13

the humans that check all of the boxes

in that job description when there's,

137

: 00:08:17

15 things in the required column.

138

: 00:08:20

And the compensation is, maybe at

or below average for the level.

139

: 00:08:26

Somebody ends up finding that

job or getting in that job.

140

: 00:08:29

That's person who finds their way in there

probably didn't check all of those boxes.

141

: 00:08:35

So it's a fallacy to think that there are

all of these people that are living in

142

: 00:08:40

these jobs that check all those boxes.

143

: 00:08:41

That's not happening today.

144

: 00:08:43

Anyways, the question is, are you going

to do that on the back end of the hiring

145

: 00:08:47

process in kind of a haphazard way?

146

: 00:08:49

Because, it's taken four months, but then

we finally went back to the well and we

147

: 00:08:53

found this person and okay, they're good

enough or are you going to do it at the

148

: 00:08:57

front end and not find somebody who's

good enough, but think strategically

149

: 00:09:02

about a combination of what people are

going to be able to do out of the gate.

150

: 00:09:07

And the potential that they

have to bring into the equation.

151

: 00:09:10

So from my experience, it's not

necessarily been particularly

152

: 00:09:15

contentious conversation.

153

: 00:09:17

It just requires a little bit more

thinking up front as to the problem

154

: 00:09:21

you're really trying to solve and what

truly is critical to have in that person.

155

: 00:09:25

Chris: From my perspective,

there seems to be two problems.

156

: 00:09:29

One forcing the site, the hiring managers

to be able to think strategically.

157

: 00:09:36

And then for you, Brad, having

them to do that at scale so that

158

: 00:09:41

you can hire at scale and help

them do those hires at scale.

159

: 00:09:46

How do you do that?

160

: 00:09:47

Brad Rager: We haven't reached

scale yet, so you'll have to ask

161

: 00:09:50

me in nine months or a year, Chris.

162

: 00:09:52

But, the concept that I go to is

Identification of people's skills, both

163

: 00:09:59

technical skills and non technical skills.

164

: 00:10:02

And if you can change the conversation

from, I want somebody who has done

165

: 00:10:08

XYZ for two years, five years, seven

years, eight years to, I want somebody

166

: 00:10:14

who knows and understands X, Y,

and Z to a certain level of depth.

167

: 00:10:20

And brings to the table interpersonal

communication skills, critical thinking,

168

: 00:10:25

they're, highly analytical, they have

a passion for understanding how things

169

: 00:10:30

work and breaking it apart, whatever

those things are, if you can reduce

170

: 00:10:34

the conversation to that level, you

will find better matches between.

171

: 00:10:40

People in the jobs that

are out there to be filled.

172

: 00:10:42

So it's just changing the conversation

of it and taking it down to the

173

: 00:10:48

idea of skills and saying are there

ways of assessing skills that are

174

: 00:10:52

a little bit more thoughtful than

yeah you say you did that before,

175

: 00:10:56

so you must be good at it, right?

176

: 00:10:58

Cause that, that oftentimes

isn't actually the case, right?

177

: 00:11:02

And to think about which skills

are teachable and which ones are.

178

: 00:11:06

Chris: And how do you help managers

with determining which skills are

179

: 00:11:11

teachable and which skills are not

teachable so that they can help find

180

: 00:11:17

those nuggets in a haystack in a resume?

181

: 00:11:20

Brad Rager: Yeah, I think that on

the technical side, there are great

182

: 00:11:26

programs and pathways out there

and certifications to take a base

183

: 00:11:30

level of knowledge up to more.

184

: 00:11:33

Advanced sets of knowledge, right?

185

: 00:11:34

So you can think about pick

your domain of cybersecurity.

186

: 00:11:38

There's sort of the one on one one oh

two one oh three one oh five version.

187

: 00:11:41

And there's learning both that happens

and can happen through certifications and

188

: 00:11:48

coursework and online programs and study,

and there's work that happens on the

189

: 00:11:53

job, most people learn best on the job.

190

: 00:11:57

So the question is.

191

: 00:11:58

on the technical side, what's the

level of proficiency and depth that

192

: 00:12:03

you need and what can they learn on

the job and what training resources

193

: 00:12:07

can you surround that person with to

get to the level that you want, right?

194

: 00:12:11

So you think about pen testing rather

than saying, I need somebody who has five

195

: 00:12:15

years of pen testing experience, let's,

let's see where they are on, some of the.

196

: 00:12:20

Tools that are out there and boards that

are out there and how they're doing and

197

: 00:12:24

oftentimes most pentest hiring managers

are pretty good at assessing their

198

: 00:12:28

kind of technical depth of knowledge.

199

: 00:12:31

And then you pair that with.

200

: 00:12:33

The things that make great pen

testers, and you can assess those

201

: 00:12:39

personality attributes, right?

202

: 00:12:41

Do they have a strong

technical inclination?

203

: 00:12:43

Do they have a passion to break

things down and understand

204

: 00:12:48

how things work, right?

205

: 00:12:50

Don't give me a job description

that requires that they

206

: 00:12:53

have a bachelor's degree.

207

: 00:12:54

Let's get rid of that

right out of the gate.

208

: 00:12:57

But let's look at the innate

personality characteristics that

209

: 00:13:00

tend to fit well with that role.

210

: 00:13:03

if You have somebody that doesn't

demonstrate that through their

211

: 00:13:07

passions, their history, their action

or communication, it's probably less

212

: 00:13:12

likely that they're going to grow

into that path that sort of fits well

213

: 00:13:16

with a certain type of personality.

214

: 00:13:18

If that makes sense.

215

: 00:13:20

I do think there are

things in general that.

216

: 00:13:23

are more coachable and more capable of

developing than things that are not right.

217

: 00:13:29

You it's difficult to take somebody who

just doesn't have a lot of curiosity and

218

: 00:13:35

make them a curious person, for instance.

219

: 00:13:38

That, those are the kinds of things

you really want to talk through.

220

: 00:13:40

Chris: You brought up.

221

: 00:13:41

How do you test for curiosity or

how do you pull curiosity out of

222

: 00:13:48

a candidate during a conversation?

223

: 00:13:51

Yeah.

224

: 00:13:52

Brad Rager: There's, with anything,

there's multiple ways to get at it.

225

: 00:13:56

There's one method, which is A

little bit more quantifiable.

226

: 00:14:00

So we use personality inventories and

assessments that give a general dynamic

227

: 00:14:06

of, Hey, does, where does this person

fall on introversion, extroversion, where

228

: 00:14:10

do they fall on, somebody who loves to

go by the rules versus break the rules.

229

: 00:14:16

There's a bunch of

different elements to that.

230

: 00:14:18

So you can get.

231

: 00:14:19

One read from personality assessments,

but you can't necessarily take

232

: 00:14:23

that as gospel, so to speak.

233

: 00:14:25

Then you really get at

it through conversation.

234

: 00:14:27

So if you're testing for curiosity

and if you're testing for somebody

235

: 00:14:31

who really wants to understand

the guts of things, then.

236

: 00:14:35

You ask them what their passions are.

237

: 00:14:36

You ask them what they're interested in.

238

: 00:14:38

You ask them what they

do in their spare time.

239

: 00:14:39

That's when the hobbies

actually are very relevant.

240

: 00:14:42

You look and see if they have a

portfolio, if you will, of things

241

: 00:14:46

that they've done to demonstrate

that passion and that interest.

242

: 00:14:49

And just that simple idea of a

passion around a given area, that.

243

: 00:14:55

Can take you miles, right?

244

: 00:14:57

Most good hiring managers that I know,

many of them will look for that as their

245

: 00:15:02

first and foremost thing and say, if

I can find somebody who is hungry and

246

: 00:15:07

curious and eager to learn and spends

their time building their own knowledge

247

: 00:15:13

in this space, rather than somebody who's

just looking for a paycheck or saying,

248

: 00:15:17

Hey, I'm getting in this field because I

hear there's a lot of money to be made.

249

: 00:15:21

Most people are looking for that

person that really loves the topic

250

: 00:15:26

and is hungry and, is putting

themselves out in that community.

251

: 00:15:30

And by the way, that's like the best

way to get a job too, because it is

252

: 00:15:35

tough in this current market to just.

253

: 00:15:37

Click through job boards and apply to jobs

if you have a passion around a given topic

254

: 00:15:42

if you put yourself into that Community of

interest if you engage and contribute not

255

: 00:15:48

only does that help build your knowledge

base But it gives you opportunity to meet

256

: 00:15:53

people and some of those people might

need to hire somebody or know somebody

257

: 00:15:57

that might need to hire Somebody so

positioned you really well for finding

258

: 00:16:01

a job to you in this current market

259

: 00:16:02

How do you

260

: 00:16:03

Chris: test for that drive that someone

that's really hungry versus someone

261

: 00:16:09

that is just looking for it on paper?

262

: 00:16:12

What sort of off screen tests or

questions do you drive into to find those

263

: 00:16:20

Brad Rager: answers?

264

: 00:16:21

Yeah, drive is something that is a

little bit more difficult to measure

265

: 00:16:25

through an assessment or a test.

266

: 00:16:27

In my mind, you really dig into it

starts with something as simple as Tell

267

: 00:16:33

me why you want to go into the space

or tell me about your career path.

268

: 00:16:37

Tell me about the decisions

that you've made and the choices

269

: 00:16:40

that you've made along the way.

270

: 00:16:41

And then you can dig into it and

ask why questions underneath that.

271

: 00:16:46

And what you're trying to get at is what

is the motivation and the driver and

272

: 00:16:53

Individuals level of self awareness in

their journey of self discovery, right?

273

: 00:16:59

I don't expect everybody, and I think

it's just human nature to people don't

274

: 00:17:03

always know exactly what they want to do.

275

: 00:17:07

And I think that's fine to me.

276

: 00:17:10

What matters.

277

: 00:17:11

More almost is are you actively part

of a journey of self discovery where

278

: 00:17:18

you are trying things and you are

finding things that you love and

279

: 00:17:22

that you're good at and then you're

doubling down in those areas, right?

280

: 00:17:25

And if you can form a story and

demonstrate that with things that

281

: 00:17:29

you've done or things that you've

learned or where you're spending your

282

: 00:17:33

time in those areas that you love.

283

: 00:17:36

That's great, right?

284

: 00:17:37

So to me, that comes out through

storytelling and through unpacking

285

: 00:17:42

a person's career path, decision

making, and the things that they

286

: 00:17:47

do to build their own career.

287

: 00:17:49

Chris: Any frameworks that you would

recommend for candidates to use to

288

: 00:17:53

really be able to pull that out?

289

: 00:17:56

Brad Rager: That's a great question.

290

: 00:17:57

I don't think I have any.

291

: 00:17:58

Frameworks offhand.

292

: 00:18:00

The, when we kind of classify

folks by their areas of expertise

293

: 00:18:07

within cybersecurity, we'll use

the, this nice framework, which

294

: 00:18:11

is a great framework, but it has.

295

: 00:18:14

I think 140 different job types.

296

: 00:18:16

So in some ways it's almost too

detailed, but you can roll that up to

297

: 00:18:21

the major domains or disciplines within

security, GRC, pen testing, IR cloud

298

: 00:18:26

security app stack, things like that.

299

: 00:18:29

And that kind of, to me sits at the level

of a good spot where you can really drive.

300

: 00:18:35

Domain expertise.

301

: 00:18:37

It in many ways aligns with a lot of

the certifications that are out there,

302

: 00:18:41

but I think it's also okay to build

skills across domains, not just within

303

: 00:18:47

domains, because the more senior you

have this kind of paradox, right?

304

: 00:18:51

As a junior person or a

person in a smaller company.

305

: 00:18:55

As a security expert, you're

gonna be doing everything right

306

: 00:18:58

or a lot of different things.

307

: 00:18:59

You go to a big company

as a junior person.

308

: 00:19:01

You may be very specialized.

309

: 00:19:03

Then as you get more senior once again,

you really have to have a generalist

310

: 00:19:07

perspective on security and be able

to operate across domains, identify

311

: 00:19:11

relative risk in various domains and

work across a business to make sure

312

: 00:19:16

that security hygiene is embedded.

313

: 00:19:18

Across all the stakeholders

in the company.

314

: 00:19:20

So moving across domains and disciplines

and building generous knowledge and

315

: 00:19:26

CISSP type broad knowledge of security.

316

: 00:19:30

That's great, too.

317

: 00:19:31

What I would ask an individual is

where do they feel comfortable?

318

: 00:19:36

What do they want to do?

319

: 00:19:37

Are you a person that wants to go super

deep and build really, strong domain

320

: 00:19:43

expertise in one particular area?

321

: 00:19:45

And bring that potentially to multiple

companies over the course of your career.

322

: 00:19:50

Or are you a person who likes to see

things from a bigger picture, operate

323

: 00:19:54

at a more strategic level or build a lot

of variety and build a, just a really

324

: 00:19:59

strong set of experiences across things.

325

: 00:20:01

There's a need for both types of people,

but I would encourage somebody to think

326

: 00:20:06

about who they are and what makes them

tick and what do they enjoy doing.

327

: 00:20:11

And then it built career

experiences that align with that

328

: 00:20:14

philosophy for that approach.

329

: 00:20:16

Chris: Yeah one of the frameworks that

I was hinting to was like the STAR

330

: 00:20:22

format with situation, task, action,

reaction to try to pull out what

331

: 00:20:29

exactly they did within a situation.

332

: 00:20:32

And I know that's a great

one, but there's others.

333

: 00:20:36

Yes.

334

: 00:20:36

Brad Rager: To your point, I think

that when you're going through

335

: 00:20:39

somebody's experience in the

background, you can't just be content

336

: 00:20:43

to take a thing at face value.

337

: 00:20:46

I like to dig in and say, all

right, what was the context?

338

: 00:20:49

What was the problem you

were trying to solve?

339

: 00:20:52

That question can get to ability

to see context and bigger

340

: 00:20:56

picture and strategic thinking.

341

: 00:20:58

And then to understand as part of a team

or as an individual, what did you do?

342

: 00:21:03

What did you contribute?

343

: 00:21:04

What value did you bring to the table?

344

: 00:21:06

Cause let's be honest, people will

embellish on their resumes and oftentimes

345

: 00:21:09

a lot of team accomplishments get, get

tasked as an individual accomplishment.

346

: 00:21:14

So you're also trying to assess for

that and really understand how did

347

: 00:21:17

you contribute within this team?

348

: 00:21:19

What did you bring to the table?

349

: 00:21:21

And we know that it's always a team

game, but you have to you have to

350

: 00:21:26

dig in to really understand that.

351

: 00:21:27

And it doesn't always pop out.

352

: 00:21:29

That's a good framework.

353

: 00:21:30

Chris: Now, for those that don't

understand the difference between

354

: 00:21:34

recruiters, hiring managers,

internal recruiters, sourcers,

355

: 00:21:39

things like that would you want

to describe how you're structured

356

: 00:21:44

and how they might be different?

357

: 00:21:46

Brad Rager: Yeah, absolutely.

358

: 00:21:46

Recruiter tends to be the person on

the front end who is bringing a person

359

: 00:21:52

into a situation or an opportunity.

360

: 00:21:54

There are external recruiters and

there are internal recruiters.

361

: 00:21:57

External recruiters are engaged by a

company to find talent on their behalf.

362

: 00:22:03

That could be contract talent.

363

: 00:22:05

It could be.

364

: 00:22:05

Full time talent.

365

: 00:22:06

It depends on the nature of the

opportunity, but you're basically

366

: 00:22:09

acting as a representative

or an agent for that company.

367

: 00:22:13

And you're trying to find

somebody who's a great man.

368

: 00:22:16

Companies will look to external folks

because they can bring a network.

369

: 00:22:21

They can bring particular

domain expertise, really from

370

: 00:22:24

a hiring manager's perspective.

371

: 00:22:26

They want to help finding

great people and finding them.

372

: 00:22:28

quickly.

373

: 00:22:29

So that's the value proposition

of an external recruiter.

374

: 00:22:33

Internal recruiters work

on behalf of a company.

375

: 00:22:36

What you tend to find in our industry

is the quality and the strength of

376

: 00:22:40

those internal recruiters, whether they

really understand the job to be done

377

: 00:22:45

will vary and it tends to vary where.

378

: 00:22:49

If the company is a cybersecurity company,

a tech company, or cybersecurity services

379

: 00:22:53

company, typically those recruiters have

a pretty good understanding of the job and

380

: 00:22:57

the job to be done, and they can represent

that well when talking to a candidate.

381

: 00:23:02

In enterprise, that's often

tougher because you may have a.

382

: 00:23:05

Food manufacturing company or an

aerospace company or a hospital

383

: 00:23:11

hiring a cybersecurity person.

384

: 00:23:13

And that's where the conversations can

get a little bit challenging because

385

: 00:23:18

that recruiter will struggle to play

the translation layer between the

386

: 00:23:22

candidates and the hiring managers.

387

: 00:23:24

And so in, in my line of

business, we mostly work with

388

: 00:23:27

enterprises to help solve that gap.

389

: 00:23:29

And.

390

: 00:23:30

Bring that expertise into the hiring

equation, but then really the decision

391

: 00:23:34

making at the end of the day is with

the hiring manager, because that's

392

: 00:23:37

going to be the person who is the

boss and who is building the team.

393

: 00:23:41

And so I think a good

recruiter works both ways.

394

: 00:23:44

They work with the hiring manager.

395

: 00:23:46

The front end of our conversation,

Chris, to say, what's the

396

: 00:23:49

problem you're trying to solve?

397

: 00:23:50

What are the skills that you really need?

398

: 00:23:52

What's the type of person who's going to

be really successful, not just in this

399

: 00:23:56

role, but in this company, who what's the

culture like, and then you can go out and

400

: 00:24:02

you may know that person who would be a

great fit already within your network.

401

: 00:24:07

Or you can help find that

person on behalf of a client.

402

: 00:24:09

And that's really the job of,

403

: 00:24:11

Chris: and with regards to your

experience of how efficient

404

: 00:24:17

one is in each of those roles.

405

: 00:24:20

I know that each served their own

purpose, but, if I were a client,

406

: 00:24:25

would I look out for those external

recruiters, those internal recruiters?

407

: 00:24:31

Who do I try to reach out to if I'm

doing an outbound campaign looking

408

: 00:24:37

for a recruiter that might be able to

fill a spot that I'm looking to fill?

409

: 00:24:43

Brad Rager: Yeah great question.

410

: 00:24:44

I think if you're a hiring

manager and you've got a great

411

: 00:24:48

recruiting team internally in your

company, that's fantastic, right?

412

: 00:24:51

And that's gonna be the most cost

efficient route from an individual,

413

: 00:24:56

hire basis most of the time,

if you've got a good recruiter.

414

: 00:24:59

Now, if you're struggling to find people,

actually not having good recruiting

415

: 00:25:05

capabilities can be very costly because

the cost of a bad hire, Is really high.

416

: 00:25:11

You think about the time that is lost

getting the work done or the cultural

417

: 00:25:17

issues that happen when you make a

hiring mistake, that's really the value

418

: 00:25:22

proposition of having a good recruiter.

419

: 00:25:25

So I think it starts

with an assessment of.

420

: 00:25:28

Do I know people and network?

421

: 00:25:29

How long?

422

: 00:25:30

How hard will this be to find

a great person for our team?

423

: 00:25:34

And then from there you want to think

about, okay if, if the principal

424

: 00:25:38

criteria are finding a great person

and finding them quickly, you want

425

: 00:25:43

to go with companies or recruiters

that understand the space, understand

426

: 00:25:48

the nature of the job to be done.

427

: 00:25:50

We'll take the time to work with you

and understand exactly what you're

428

: 00:25:53

looking for and what you need so that.

429

: 00:25:56

You don't have to spend a lot of time

saying, yes, this person needs this.

430

: 00:26:01

No, this person doesn't.

431

: 00:26:02

And that's where I think.

432

: 00:26:03

Our industry and there's a lot of

recruiters out there that look at this

433

: 00:26:10

very transactionally and they'll say,

give me a job description and I will go,

434

: 00:26:14

spam 1000 people on linked in and try and

check as many of these boxes as possible.

435

: 00:26:19

And then I'll flip it back over to you.

436

: 00:26:21

To me, that's totally.

437

: 00:26:22

Totally the wrong framework.

438

: 00:26:24

This is about people and

this is about relationships.

439

: 00:26:27

And there are there's brand to

be built on both sides, right?

440

: 00:26:33

As a recruiter, the best thing

you can do for a client is help

441

: 00:26:36

them with their people strategy,

help them find great people.

442

: 00:26:39

And the best thing you can do for

candidates is help them find a place

443

: 00:26:43

that they are going to thrive and grow.

444

: 00:26:45

And that is in line with what they want.

445

: 00:26:47

So I think you got to take.

446

: 00:26:48

A long term perspective as you think

about those relationships, and that's

447

: 00:26:52

why, the quality of the experience

on both sides really matters.

448

: 00:26:58

And in the poor behavior around

hosting and stuff like that, it just

449

: 00:27:03

it gives our industry a bad name.

450

: 00:27:05

And it.

451

: 00:27:05

It's a shame that it's right.

452

: 00:27:07

We shouldn't treat folks like numbers.

453

: 00:27:09

Everybody's special, everybody's

individual, and it's our

454

: 00:27:12

job to get to know people.

455

: 00:27:13

Chris: And as we wrap up, any final

advice you'd give to candidates that are

456

: 00:27:18

hunting for a role in this job market?

457

: 00:27:21

Brad Rager: Yeah.

458

: 00:27:21

Yeah.

459

: 00:27:22

Look, I think this job market is the most

challenging that the cybersecurity job

460

: 00:27:28

market has been at least in the past 5

to 10 years where you used to see jobs

461

: 00:27:33

going up that would get 5 applicants.

462

: 00:27:36

Now the same job is going

to get 100 or 100 to 50.

463

: 00:27:40

So it's a challenging market and Yeah.

464

: 00:27:43

What I've seen is a number of

people that have been able to

465

: 00:27:46

go from job to job in the past.

466

: 00:27:48

Maybe they got recruited out of a

company and now they're saying, okay.

467

: 00:27:52

I've got to go do this job search and

I've almost got to run it like a job.

468

: 00:27:56

And we posted a few blogs on my

website recently just to give some

469

: 00:28:01

tactical guidance around this.

470

: 00:28:03

But the best thing I would say is in this

sounds cliche, but it really is true.

471

: 00:28:08

Network is super important, but there is

a methodology that you can apply towards.

472

: 00:28:15

Leaning on your network and growing

your network in such a way that

473

: 00:28:18

it is maximally likely to help

you land a job that you like.

474

: 00:28:23

And that really involves engaging

people that you know, having a very

475

: 00:28:27

crisp story on what you want to do,

so you can help people help you.

476

: 00:28:33

And then people make introductions.

477

: 00:28:35

And so if you go into the

process with a really crisp.

478

: 00:28:40

Narrative on what you're good at, what

you want to do, and you understand

479

: 00:28:44

the types of companies or specific

companies that you would want to work at.

480

: 00:28:48

You can build a network and help find

your way to get to meet people that

481

: 00:28:55

are inside those companies or that

are likely to be hiring managers.

482

: 00:28:59

And then just knowing somebody

totally flips the odds of you

483

: 00:29:03

being able to get an interview.

484

: 00:29:05

And then from there, run the process

and do what you're good at and

485

: 00:29:08

trying to bring out your strengths.

486

: 00:29:10

But that's the challenge that

so many people are having is.

487

: 00:29:14

They're dropping applications online.

488

: 00:29:16

They're getting rejections.

489

: 00:29:17

They don't understand why it's

happening over and over again, even

490

: 00:29:20

for jobs that are qualified with.

491

: 00:29:22

So in this market, if you're seeking

and you're hunting, it does require

492

: 00:29:26

that extra above and beyond effort.

493

: 00:29:29

To build network and get

referred into those jobs.

494

: 00:29:32

Chris: Well, Brad,

thank you for coming on.

495

: 00:29:34

Thank you for sharing

your tips and tricks.

496

: 00:29:37

Really appreciate it.

497

: 00:29:38

We'll definitely have you back on again

in the near future and maybe we'll

498

: 00:29:42

have some of your success candidates

come on and share their journey

499

: 00:29:47

and share their Brad experience.

500

: 00:29:49

Getting through this market,

but all thank you for joining.

501

: 00:29:53

Thank you for all the

questions and comments.

502

: 00:29:55

We really appreciate it.

503

: 00:29:56

Feel free to share this with others that

might be interested because that's the

504

: 00:30:00

whole point of these episodes is to share

it with those that are also looking to

505

: 00:30:06

break in and are looking to learn from the

tips and tricks of individuals like Brad.

506

: 00:30:12

Brad Rager: Thanks so much, Chris.

507

: 00:30:13

Great chat with you.

508

: 00:30:14

Thank you all.