Partnering with Human Resources does not have to be a Challenge

Security Operations Centers face unique hiring challenges that can cause pain points for SOC leadership. There are many myths and misunderstandings that can lead to undesired results when recruiting to fill key roles in your SOC. But, there is hope. By engaging with your recruitment team, you can build a successful hiring strategy.

One key challenge that makes our space unique, is that we are often working with a human resources team that does not typically recruit for security roles. From the creation of the job description, to compensation decisions, and even when it comes to interviews certain myths about what your SOC does on a daily basis may lead to poor hiring decisions. Your HR team may immediately think of your roles as the same as a guard. Or wrongly assume that that the role involves simply watching cameras all day. They will over simplify the role to their basic understanding of what security does. The opposite can also be true. They could base their idea of the job on their latest binge watching spree of spy movies, resulting in an over complication of what the job does. This will result in incorrect job descriptions, poor application reviews, interviews that miss the mark, and missing out on quality talent. Depending on your company’s processes, partner with your HR team to complete these tasks.

The first thing you need to do is review your job titles. Job titles are like the title of a book. If they are not attractive to the reader, they will not even read the job description. Take a look at each role and determine if the job is titled correctly. Remove the words “Guard” and “Officer” from your SOC job descriptions. These provide an immediate false representation of what your team does. Ensure the job title represents their work in some way. Also, your job title should include some indication of the SOC they will be working in. Job titles like “SOC Analyst” and “GSOC Operator” will both explain the job, but define the GSOC space as the work location. Many people look for these roles in their job search, and if your title doesn’t reflect this you will miss some candidates. Finally ensure leadership positions are clearly defined with titles that include “supervisor”, “manager”, and even “lead”.

The job description is the story of what the job does on a regular basis. It can be easy to get bogged down in the minutia of all the things that are possible in the job. But remember that classic line “other duties as assigned.” Instead focus your job description on the daily life in that role. What will day do every day? For example, my team has four main areas of focus: Alarm Monitoring, Access Management, Customer Service, and Incident Intake. From there I crafted a job description that reflects those main core responsibilities in a few bullet points. A long winded job description is not helpful, and most candidates will skip over a job description that makes the job seem overly complicated.

Qualifications are equally important. My company, and many others, divide qualifications into two categories: Minimum and Desired. Ensure your minimum qualifications are just that, the absolute fewest qualifications some needs to be hired for the job. For some roles, that could be no experience required at all. However, for most GSOC roles there will be some baseline skills you know are needed to be able to teach someone the job. Typing skills, computer skills, customer service skills, and such should all be considered. Leadership roles should examine years of leadership experience needed to be an effective leader. Your HR team may hold you to this and will not allow you to hire someone without the minimum qualifications. Once you set the minimum, you can start to think about your dream candidate, that is where your desired qualifications come in.

Once you have revised your job descriptions the topic of compensation comes into play. In most companies with GSOCs there is likely someone in HR that is deciding compensation. For my company, roles are assigned a pay grade by our compensation team. And later we must justify a pay rate within that range when we hire a candidate, typically based on their qualifications. In a recent evaluation of our positions, based on my newly drafted job descriptions, the compensation team was easily able to identify that the role would not fit into their market report for Security Guards, but they also had trouble finding a market report for GSOC roles. This is where doing your own research comes into play. Use your network peers, look at job postings in your area, and determine what the fair market wages are for your role. Even if you are not asked for this information upfront, it will become valuable if you need to negotiate with your compensation team if the rates they propose are not aligned with the market.

Recruiting is where things get very challenging for many GSOCs. Companies often require that HR conduct all screenings and interviews. They might not allow GSOC leadership to take responsibility for the hiring and recruitment, but that does not mean you have to be completely excluded. The more involved you get in the hiring process the better candidates you will get.

Get a seat at the hiring table. If you are able, see if you can get in at the ground level with application review. Many HR teams are okay with leadership reviewing resumes before interviews are offered. They will welcome the chance to see what you see when you look at these applications. Ask to have representation on the interview panel, even if HR insists are leading the process they may be willing to have you listen in at the least. Offer up suggested interview questions that your experience shows are valuable in determining qualifications. Final hiring decisions should be up to the GSOC leadership, but some companies do not allow that.

If your HR does not welcome your involvement in the hiring process, that does not mean that all hope is lost. Instead, you need to educate your HR team on what you need. First and foremost, invite them to spend a day in your GSOC. Ensure they spend time with the different roles you have so that they can learn what they do. After each hiring session, follow up with HR in about 60 to 90 days and share the good and bad about the candidate they hired. But also, listen to their feedback. The HR team may also have valuable insight on what they saw in the candidates they chose and the candidates they passed on.

Hiring is not an exact science, and it will not always go to plan, but that does not mean you cannot work together with your HR team to minimize these challenges. While your GSOC roles may not be the types of positions your company is most familiar with hiring, you can still take some key steps for success. Building a solid recruiting process by partnering with your human resources team will create a foundation for talent acquisition in your GSOC.