Why You're Not Getting Hired in Cybersecurity (And What to Do About It)

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:02

Welcome to Hacking Your Cyber Career, Episode 10. Why you're not getting hired in cybersecurity and what to do about it. You've got the skills, you've polished the resume, and you're still not getting the offer. What's really going on? Here's Steve.

SPEAKER_01 0:21

You're qualified. You've studied, you've polished your CV until it practically shines. You've applied for cybersecurity roles and maybe even got an interview. And then, thank you for your interest, but we've decided to proceed with another candidate. Again. It's tempting to conclude that cybersecurity hiring is broken. Sometimes it is. Job adverts ask for junior people with senior experience, recruiters search for keywords rather than capability, and companies occasionally seem to be recruiting a mythical creature with 15 certifications and a willingness to work for pocket money. But that's not the entire story. I've spent years hiring and leading cybersecurity teams, and I want to talk about what actually makes me say yes or no. Often it's not the most technical answer or the longest list of qualifications. It's whether I can understand how you think, what motivates you, whether you can work with others, and whether this role is genuinely right for you. Today we'll discuss resumes, communication, bluffing, preparation, transferable experience, team fit, and the interview as a two-way conversation. I'll also share a slightly embarrassing story about the one interview I didn't get through because apparently I was once convinced that researching the company was optional. Spoiler, it wasn't. I'm Steve, and this is Hacking Your Cyber Career. Let's talk about getting hired. First, the resume. People treat it like a magic document. Add enough keywords, optimise the layout, and a job offer will apparently appear. I wish it were that simple. A resume is useful, but it gives me a very rough idea of a person. It tells me what they've done, or at least what they say they've done, and which parts might connect to the job. It does not tell me what makes them tick. I've seen resumes full of impressive projects that were only tangentially relevant. That's not necessarily dishonesty, it may simply be someone sending the same document to every opening. My advice is to tailor your resume to the role where you can. If the job is about incident response, explain the relevant investigations, technical learning, and decision making. If it's a GRC role, highlight risk assessments, controls, stakeholder work, and evidence gathering. Don't invent experience. Translate the experience you genuinely have. And don't just list a tool. Tell me what problem you used it to solve, what your contribution was, and what happened. If you supported a project rather than led it, say so. There's nothing wrong with being part of a team. The problem comes when the resume implies you personally invented the internet. Keep it readable, specific, and truthful. The resume's job is to open a door. Once you're in the room, the conversation matters much more. Communication is one of the most underestimated cybersecurity skills. I have rejected candidates who seem to have the necessary knowledge but were extremely difficult to engage with in an interview. Not because they were quiet, introverted, or nervous, those are different things. I'm not recruiting a television presenter. I'm trying to understand what they know, how they approach problems, and whether we'll be able to work together. If every question produces a one-word answer or a 10-minute technical monologue that never actually addresses the question, that becomes difficult. In security, you need to communicate with people who have different backgrounds and priorities. An analyst must explain an incident. An engineer needs to justify a design. A risk professional needs to make a recommendation understandable to the business. And sometimes you need to tell somebody their favorite new technology is a terrible idea without making an enemy for life. In an interview, listen carefully. Answer the question first. Then give an example. Explain what you did, why you did it, and what you learned. If you need a moment to think, take it. If you don't understand the question, ask for clarification. That's a strength, not a weakness. You don't have to be the loudest person in the room. You do have to help the person opposite you understand the value you bring. Here's a reliable way to damage an interview. Bluff. Claim you've led a major security transformation, built an entire detection program, and mastered every platform known to humanity. Then hope nobody asks a follow-up question. I do ask follow-up questions. Not to catch people out for sport, but because I want to understand what they actually contributed. If you tell me you designed an architecture, I may ask what trade-offs you considered. If you say you led an incident, I may ask how you decided what to do first. If you say you're an expert in a technology, I may ask you to explain a basic concept. The issue isn't that you might not know an answer. Nobody knows everything. The issue is pretending. I'd much rather hear, I haven't worked directly with that, but here's how I'd approach learning it. Or, I supported that program. My part was identity controls and testing. That gives me something real to evaluate. A little confidence is good. Inflating your contribution until it's unrecognizable is not. Technical capability can develop with training and experience. Trust is harder to repair. And trust matters enormously in cybersecurity, where people may depend on your judgment when things are going wrong. So know your own story. Own your actual contribution, and don't mistake honesty for underselling yourself. Can you get hired into cybersecurity without having held a cybersecurity job? Yes, I've hired people who came from adjacent areas. What I want to see is a credible connection between what they know, what they enjoy, and the role they're applying for. Someone from infrastructure might understand networks, systems, and troubleshooting. Someone from audit or finance may understand controls, evidence, risk, and process. Someone with strong communication skills might have real potential in security awareness or stakeholder-facing roles. These aren't second-class entry routes, they're useful starting points. But enthusiasm matters. I want to know why cybersecurity interests you and what you've done to explore it. Have you learned the fundamentals? Spoken to people in the field? Tried a safe hands-on lab? Taken responsibility for a security-related task in your current job? You don't need to manufacture a heroic backstory. Tell me the honest one. And employers need to do their part here. If we insist every junior candidate already has several years of specialist security experience, we're not building a talent pipeline. We're just recycling the same people. A thoughtful hiring manager should be able to recognize potential, not only previous job titles. Your task as a candidate is to make that potential visible. Now for a lesson I learned personally. Over my career, I've been fortunate in interviews, but there was one job interview I didn't get through, and I know exactly what I did wrong. I hadn't done my homework on the company. I was too cocky. I assumed my background and experience would carry the conversation, and I turned up without really understanding the organization I wanted to join. It was a mistake, and a useful one. Because if you don't know what a company does, what matters to its customers, or why the role exists, how can you explain the value you'd bring? You don't need to memorize the annual report or pretend you've completed a forensic investigation of the chief executive's LinkedIn profile, but know the basics. Understand the business. Read the job description properly. Look at recent company information. Find out who you're meeting if that's reasonably possible. Prepare a few examples from your own experience that relate to the challenges they might face. And prepare questions. What would success look like in the first six months? What problems does the team need help solving? How does security work with the wider business? Preparation signals respect and genuine interest. It also helps you decide whether you want the job. I learned that the hard way. You can borrow the lesson without repeating the mistake. Let's talk about cultural fit, a phrase that can mean something useful or something rather unhelpful. When I say fit, I mean whether someone can work effectively with the existing team, communicate, collaborate, respect other people, take feedback, and contribute. I do not mean everyone should look alike, think alike, have the same background, or share the same personality. A team made up entirely of people who agree with the boss isn't a high-performing team. It's an echo chamber with a payroll. Cybersecurity benefits from different perspectives. We need methodical thinkers, creative problem solvers, technical specialists, risk professionals, and people who can connect all those groups. Some are outgoing, others are quiet. Both can be excellent. What worries me is behavior that suggests a person won't listen, won't cooperate, or treats colleagues with contempt. Hiring is also imperfect. Interviewers have biases. Teams can mistake familiarity for suitability. Good employers should use consistent, job-related criteria and make room for people with different communication styles and experiences. As a candidate, demonstrate how you work with others. Talk about a disagreement you handled constructively, feedback you acted on, or a colleague you helped. Show me that you can be part of a team without losing what makes you different. I want to understand what interests you, what you've learned, and what you want to do next. I want to see enough knowledge for the role, or a credible foundation and willingness to learn for a junior position. I want examples rather than slogans. If you tell me you're a problem solver, tell me about a problem. If you say you're collaborative, describe a time collaboration was difficult. I also look for ownership. Can you admit a mistake and explain what changed because of it? Can you ask for help without pretending everything is under control? And I want to know how you'd contribute to the team, not merely how impressive you are on paper. None of this means every interview is fair. I've seen recruitment processes with unrealistic expectations, vague roles, and poor feedback. Employers should do better. But there are things you can control. Be prepared. Be truthful. Be curious. Explain your thinking. And remember that the person interviewing you is often trying to solve a problem for their team. Help them see how you could contribute to that solution. Don't arrive determined to perform a character called the perfect cybersecurity candidate. Arrive ready to have an honest, professional conversation. There's another side to this that candidates sometimes forget. You are interviewing the employer as well. I know that's easy to say when you really need a job, and much harder when you've been searching for months, but it's still important. You might be offered the title you've always wanted, a generous salary, and the opportunity to work with exciting technology. None of that guarantees you'll be happy or effective in the organization. Ask how decisions get made. Ask what support and development look like. Ask how the team handles incidents and disagreements. Ask why the position is open and what challenges the previous person faced, where appropriate. Listen to how people answer. Do they describe colleagues respectfully? Can they explain what success looks like? Are expectations realistic? The goal isn't to interrogate the hiring manager as if they've committed a crime, it's to understand the environment you're considering joining. And if you don't get an offer, remember that rejection isn't a verdict on your worth. You may be talented and well qualified, yet not the right match for that particular role at that moment. Equally, you may decide the company isn't right for you. A good career decision works in both directions. Better to recognize a poor fit before you accept than to spend the next year wondering why Monday mornings feel like a punishment. Your next move. Before your next cybersecurity interview, do five things. 1. Choose a real vacancy and tailor your resume so the relevant experience is obvious, without exaggerating it. 2. Prepare three short examples that show how you solve problems, work with others, and learn from mistakes. Be specific about your own contribution. 3. Practice explaining one technical or risk concept in plain English. Imagine you're speaking to a colleague who doesn't work in cybersecurity. 4. Research the organization and prepare two thoughtful questions about the role, team, or business. Trust me on this one. I learned it the hard way. 5. Decide what you need from an employer. What kind of support, culture, and opportunity would help you do your best work? Then take those questions into the interview. If you're moving into cybersecurity from another field, add one more task. Identify the adjacent experience you already have and connect it honestly to the role. And if you're rejected, review what you can improve without assuming every decision was entirely in your control. Hiring isn't a perfect science. Sometimes the process is poor. Sometimes another candidate is a better match. Sometimes the role changes halfway through. Keep learning, keep applying, and keep refining how you tell your story. Remember, the objective isn't to convince absolutely everyone to hire you. It's to find an organization where your abilities, potential, and values can genuinely contribute. I'm Steve, and this has been Hacking Your Cyber Career. See you next time.