CISOs rethink hiring to emphasize skills over degrees and experience – Source: www.csoonline.com

For decades security chiefs have trained their sights on job applicants with university degrees.

But ongoing skills shortages and experiences with highly talented security pros who do not hold college degrees are spurring some CISOs to rethink their hiring strategies, favoring a skills-based approach to filling cybersecurity roles.

It’s a big shift in how professionals get hired, says Jon France, who, when he became CISO at ISC2 in early 2022, inherited a security team that had a mix of workers with and without college degrees.

That mix of talent produced a valuable range of experiences and skills, France found. Seeking to build on that dynamic, France decided to remove the requirement for a college degree for jobs in his department, and removed certification requirements for some positions as well.

“Previously a college degree was what we used as an indicator of quality, but now we’re accepting many more indicators of quality, not just a degree. Because while a degree is an indicator, it is not the only indicator and, arguably, it is not the best indicator,” France says.

Under France, ISC2’s security department looks for candidates who can solve problems, demonstrate good communication capabilities, and show curiosity. It also asks candidates to prove they’re up to snuff on the specific technical tasks they’ll be performing if they land the job.

“Those are the things I’d look for in someone over a degree and even certifications,” France adds.

Skills-based hiring: Hard work, mixed results

France is part of a growing movement to implement skills-based hiring, which, as the name suggests, awards job offers to candidates who can demonstrate they have a good percentage of the skills required to do the work required in the role, regardless of educational background or experience.

Like others, France believes a skills-first focus is the best way to bring together diverse talents to create a cohesive, high-performing team. He also recognizes that many talented workers don’t have degrees, having opted for military service or other opportunities before seeking a career in cybersecurity. Moreover, he knows there just aren’t enough existing cybersecurity professionals to fill open positions.

But shifting to skills-based hiring takes a lot more work than dropping “degree required” from job postings to be successful. Many organizations, in fact, are failing in their attempts.

According to a 2024 report from Burning Glass Institute and Harvard Business School, skills-based hiring is gaining momentum, but, “for all its fanfare,” the report authors write, “the increased opportunity promised by Skills-Based Hiring has borne out in not even 1 in 700 hires last year.”

Some 45% of organizations studied as part of the report are implementing skills-based hiring in name only, having made no substantial changes to how they recruit and screen for talent. Another 20% or so made progress toward a skills-based approach but their efforts didn’t stick, despite short-term gains.

“Successful adoption of Skills-Based Hiring involves more than simply stripping language from job postings,” according to the report. “To hire for skills, firms will need to implement robust and intentional changes in their hiring practices — and change is hard.”

‘Hire differently’

France and ISC2 are among the 37% of leaders and organizations who have put in the work to make skills-based hiring an effective strategy, not just an empty promise.

To improve outcomes, France works with the HR team to review job descriptions for open positions and then crafts them based on the organization’s current needs, detailing the tasks that the position would handle when filled and the skills required to tackle those tasks.

In some cases France lists nontechnical skills and attributes such as “must be able to solve complex problems” first in job postings. “We favor more trait-based things rather than the hard skilling” in such cases, he says.

Such work helps hiring teams know how to evaluate resumes without falling back on degrees as the default indicator of needed capabilities, he explains.

He also has tweaked the interview process, so candidates are asked to work through scenarios to test their technical, personal, and intellectual skills.

“You test facets of a person,” he says.

Such moves, France says, does not preclude him from asking candidates about their education. Nor does it preclude him from requiring certifications for some jobs; France, like others, says certifications can indicate specific skills and aptitudes — often better than a degree.

In fact, France will also require some new hires to earn specific certifications within a specified time period after being hired, which he believes shows the new hire’s willingness and ability to learn.

All this, he says, has helped him “hire differently.”

“I’ve gotten candidates I wouldn’t have had before by doing this, and I’ve gotten a better group of candidates as well. It’s given me diversity in its truest sense, and that diversity gives you the best candidate pool,” he adds.

‘Matching the work that needs to be done’

The principle of skills-based hiring does have a whiff of everything-old-is-new-again, as employers have always sought workers with demonstrable skills. Moreover, the technology ranks have long been populated with highly accomplished professionals without college degrees.

Still, more employers are making the shift, and by emphasizing skills in their job listings and assessments, many are improving the hiring process. According to LinkedIn’s The Future of Recruiting 2025 report, “companies with the most skills-based searches are +12% more likely to make a quality hire.”

CyberSN founder and CEO Deidre Diamond has found that to be the case.

Diamond adopted a skills-first approach at her staffing solutions firm, which places full-time permanent hires and uses a taxonomy created by her firm to write candidate requirements that “reflects what the person will do day to day.”

This helps her team and their clients move away from ambiguous job titles such as security engineer and correspondingly vague job descriptions — both of which can force hiring managers to fall back to searching for candidates with relevant degrees as badges of professional competency.

In addition to looking for candidates with well-regarded certifications that demonstrate they have desired skills, Diamond also uses written and verbal tests to determine whether candidates, particularly ones new to the profession, have the skills needed for posted positions.

“It’s all about matching the work that needs to be done to the work [a candidate has] done recently,” explains Diamond, who is also a board member at Cyversity, a nonprofit promoting diversity in the cybersecurity field.

Executives at Immersive are likewise having a good run with a skills-based approach for hiring cyber talent, overcoming challenges along the way.

The company, which makes a cybersecurity training and exercise platform, doesn’t mandate degrees or certifications but evaluates candidates on competencies, says Dan Potter, Immersive’s senior director of resilience.

It uses its own platform for recruiting, advancing candidates for some cyber jobs through specific learning content. The company considers each candidate’s performance, including their problem-solving accuracy and processing time, to identify “people [who can] make quick but well-informed decisions,” Potter says.

Candidates brought in for interviews are presented challenges to assess their problem-solving and collaboration skills, he adds.

“Cybersecurity is fast paced, with new challenges every day, so we want to know if [candidates] have a drive, have that mindset where they want to solve problems,” he says.

Like ISC2’s France, Potter says succeeding with this approach means working with HR, in part to ensure pay scales don’t favor workers with degrees over others. He also says it requires changing the typical enterprise mindset that degrees automatically signal competency.

Immersive’s process has yielded hires who might not standout in more traditional recruiting settings but are nonetheless valuable employees, Potter says.

“Individuals might not look the best on paper, but they’re showing they’re excellent at what they do,” he adds.