Ep 817: The Human Bias Fueling Talent Shortages

0:00Talent shortages get talked about constantly in hard-to-fill markets like cybersecurity. Some of that scarcity is real, and some of it is qualified people who never get seen. Telling these two problems apart changes what you do about hiring. So which one are you dealing with? Keep listening to find out. Support for this podcast comes from Cyber, the professional network for cybersecurity. If you're hiring for cybersecurity roles, you'll know that they are more complicated and time-consuming than more generic requisitions. The briefs are full of acronyms. Filtering through candidate pools is incredibly complex, and outbound response rates are a fraction of what you see elsewhere.

0:45Specialist agencies will take away the burden, but at a high cost. And every week a role stays open, your organisation is at heightened risk. Cyber Recruiter is built to close that gap, saving you time, effort and money in the process. Every Cyber Member profile carries a trust score. Certifications are validated through Credly and identity is verified at sign up. Through their custom search agent, CIRA, your team brief in a role in plain language and get a qualified shortlist within minutes. You can find out more by going to cyber.ai slash hire. And cyber is spelt C-Y-B-E-R-R. That's cyber.ai.hier.

1:34There's been more of scientific discovery, more of technical advancement and material progress in your lifetime and mine than in all the ages of history.

1:48Hi there, welcome to episode 817 of Recruiting Future with me, Matt Alder. Cybersecurity is one of the hardest markets to hire in, and a lot of the difficulty comes from how companies approach the process. Candidates are still being filtered on degrees, previous employers and years of experience. signals that are particularly weak in a field where the best work is confidential and skills need updating constantly. Good people are getting screened out, and what looks like a talent shortage can often be a matching problem. So what changes when companies stop filtering on the usual proxies and start hiring on what candidates can actually do?

2:32My guest this week is Laurent Halimi, CEO and founder of Cyber, a professional network for cybersecurity professionals. In our conversation, Laurent explains why the skills shortage in cybersecurity is only half the truth, where the bias in hiring really comes from, and what it takes to judge candidates on skills that you can actually verify. Hi Laurent, and welcome to the podcast. Hi, how are you? I'm very well, thank you. And it's a pleasure to have you on the show. Please could you introduce yourself and tell everyone what you do? Of course. So my name is Laurent. I'm the CEO of Cyber. the simplest way to describe us.

3:11We are the first LinkedIn for cybersecurity. Fantastic. And cybersecurity, I mean, it seems like a sort of a fascinating industry to be in, particularly sort of from a hiring perspective. With everything that's going on with AI, I could see that that's sort of reshaping your industry in sort of several directions. How's it changing what cybersecurity professionals do? And what's that throwing off in terms of demand for specific roles in hiring? Sure, but it's actually a very big one. So let me break it into three simple pieces. First, AI is a new thing attackers used and a new thing defenders to worry about.

3:51So there is an actual new job, new jobs being created. People whose whole job is making sure the company's AI system can be tricked or hacked. That job barely existed three years ago. Secondly, AI is becoming a tool that security teams use pretty much every single day now. A lot of the boring, repetitive work, staring at alerts, checking logs, it's starting to get done by AI first and a human checked after. So instead of hiring someone to sit and watch a screen all day, companies now want someone who can supervise the AI, catch his mistake and make the final call. Thirdly, because of that shift, the skills companies are hiring for are changing as well.

4:33Lots of new software you will see on the market have a component in AI now. So it's less, can you do this repetitive task and more, can you think clearly and make good judgment call when something looks off? So the role are shifting away from pure manual work and towards oversight and judgment. It's not that AI is taking a cyber-scruted job. The job actually turning into something a bit more senior, a bit more thoughtful. I mean, that's really interesting because for a long time, there's always been a lot of conversation about the shortage of the talent shortages in this industry. Is that still the right way to read that market or are things kind of more complicated with these new roles and the changes in the way the work is done?

5:18I've heard about the talent shortage for many years as well. Honestly, it's true, but it's not the whole truth anymore. And I think people should hear that. Yes, there is a real shortage at the top. If you need someone senior who really understands cloud security or AI security specifically, those people are generally hard to find and everyone's fighting over them. But underneath, something else is going on. There are plenty of good qualified people applying for jobs and getting completely ignored, not because they're not good enough, but because the way companies filter candidates is actually broken.

5:54Resume gets scanned for keywords, good people get skipped over, and it just looks like nobody's out there. But when actually the person is right in front of you. So I would put it in this way. It's not just a shortage of people. It's a shortage of good matching, I would say. There is a real skill gap at the senior level and real matching problem everywhere else. Yeah, that's really interesting. I want to kind of dive into that in a bit more detail in a second. But before we do, I suppose just in a bigger picture, you sort of kind of alluded to this before. Is AI massively increasing the need for cybersecurity?

6:29Is it something that's like really sort of driving the market or is it just another technology to think about? No, I think AI is like everything. You know, AI comes with pros and cons. In cybersecurity, we certainly saw, especially in the last six months, you probably heard about Anthropic as well. completely changing the face of the market. I think even the community, the cyber community, is kind of overwhelmed with what's happening. The certification, you know, it's very certification driven. So we see a lot of people trying to get as many certifications as we can, which kind of become sort of unrelevant for the jobs companies are hiring for at the minute.

7:08This is exactly what we built that platform, is to help navigate all of the changes and help the community to get the skills that they need for the next role they're looking for. And does the way that cybersecurity professionals are hired, is that different from other technical fields? And what happens when people sort of try and hire them the way that they sort of hire other technology professionals? I think so, yeah. I think there is a few reasons, and they actually all matter. One, the most important one, is trust. You generally cannot fake your way into cybersecurity. someone lies about their skills and you hire them anyway it's not just an awkward slide conversation that's a company which with a security role in it so verifying someone's actual real skills matter more here than almost anywhere else two i think the skills go still fast something you learned two or three years ago in this field might already be out of date today A certificate from a few years back doesn't tell you much about whether someone can handle what's happening right now.

8:16So years of experience on its own is a pretty weak signal in cybersecurity. And a lot of the best work is invisible as well. A software engineer can show you their codes or GitHub. A cybersecurity person usually can't show you the breach they stopped or the system they secured. It's confidential. Or it would be actually a security risk to talk about it publicly. So you can't just look at someone's portfolio the way you can in over tech jobs. That's the way we put it. And is that what's kind of really fueling the matching problem here? Because there's a sort of a matching problem across recruiting in general.

8:50But I can see that a lot of the things that you mentioned there would make, you know, matching people to jobs just using resumes, CVs, really challenging. Yeah, I think it's important to say plainly. people love to worry about the algorithm is bs but also every bs hiring algorithm out there learn it it's bs from human in the first place so someone at some point decided what a good long what a good candidate looks like and often that meant favoring people from certain universities 10 of which would be previous employers people who just felt kind of familiar that bs existed long before any AI tool showed up.

9:30To be fair, the AI just learned it from us and did it faster.

9:37Yeah, absolutely. And I think that is such a key point. And it's something that, you know, I talk about a lot and people ask questions about a lot, which is we're obsessed with AI being biased and, you know, regulation and legislation. And, you know, these are all the right things to do. But the human bias seems to be sort of disappearing off the gender of discussion because everyone's obsessed with the AI part of it. But yeah, I mean, it's kind of a massive issue. And I think the bit there about qualifications and years of experience and where people have been, the universities they're at, is a key part of it, isn't it?

10:08I agree. Yeah, absolutely. So what can, you know, obviously there will be lots of people listening who have cybersecurity needs, are hiring for cybersecurity professionals in one way, shape, or another. What can hiring teams do to actually sort of take this human bias out of the process in, you know, what is such a critical role for an organization? I would say they can do a few concrete things. First, I would say judge people on real and checkable skills. So certification, hands-on experience, thing you can actually verify instead of things like which university did you go to or which big name company did you work at before.

10:49Those are just proxies and they let BS sneak back in. use the same set of questions and the same scoring for every candidate in an interview instead of letting it turn into a free-flowing chat that goes differently for different people. Especially in CyberSquity, it's very important. Where you can strip out the name, the photo, the school for that very first screening pass, just look at the skill first. And actually, look at your own numbers, track where candidates are dropping out of your process and check if that drop looks different for different groups of people. If you never look, you will never know it's happening.

11:26And if you're using an AI tool to help you hire, which is very common these days, ask it what is actually scoring people on. If nobody can give you a straight answer to that question, that's a warning sign itself. Absolutely. And tell us a little bit about how your platform fits into this, how it helps, you know, what it does. Well, the platform is more than a platform. we are building a full ecosystem. So the concept of cyber is to bring the whole community together. What I found out during all my years running a recruitment agency in cybersecurity is the market is very fragmented. There's a lot of things which are being done all over the world.

12:05But let's say like the guys in Paris will not know about something being done in London because it's very fragmented. So the idea of cyber is to bring the whole community together to help each other. to help people getting new certification, to connect, to build the right network, to mentor because there's a mentoring program as well. And the cool piece about cyber is we've built a marketplace which is called Healer, which is actually live in three days. And Healer, the concept is to bring cybersecurity to startup and SMEs using the whole community. So we score the community directly within cyber.

12:45We verify the certification. We verify the ID and we score them. Based on the scoring, they can then deliver services to the marketplace and monetize their skills. This is actually a first globally to think about Upwork and LinkedIn. And we've built both between the vertical, just on the vertical side of the QT. That's cool. I think one of the things also you do is you do some stuff around people being able to apply anonymously in the first instance. Tell us a little bit about that. Yeah, sure. So we've built this feature on a platform, which is anonymous. So essentially, we give the opportunity to our community to hide their name, pictures, any information about the company they worked for in the past.

13:29And they are basically matched just based on skills, certification, and that's it. It's an important feature. And, you know, the community likes it because on such a small vertical, you know, you want to be discreet when you're looking for a job. So there is an element of browsing and being in control of your own profile, as opposed to sending your profile and your CV to a recruitment agency, which usually will send your profile to as many companies as they can to get an interview. So you're in control of your profile, but you're also properly matched based just on your skills and the requirements of the jobs.

14:06And, you know, as you say, we're obviously talking about an audience who are very aware and their data privacy is very important to them. Yeah, yeah, 100%. As a final question, if we sort of look two or three years into the future, how do you think hiring is going to evolve? What would we be talking about if we had this conversation again in three years' time? I think skills start to matter more than pedigree, full stop, really. The idea that you need a specific degree or that you need to have work at one of the five impressive companies is already fading. And I think it keeps fading in CyberSquity especially.

14:43Someone who told themselves I can actually do the work will increasingly beat someone which is a shiner resume and less reliability. Proving your skills become normal, not optional. Right now, a resume is the standard things everyone sends. I think in a few years, some kind of verified proof, validated certificate to demonstrate project, a real skill check become just as standard. Hiring stop being we have an opening panic, post a job, where companies start building relationships with good people before they even have a role open. So when the role does open up, they're not starting from zero. And AI takes over more over the highly repetitive part of hiring, the first filtering, the first matching.

15:28So humans spend their time on the part that actually needs a human. The final conversation, understanding whether someone's a good fit for these specific teams, closing the deal. less time wasted on paperwork, more time spent on the decision that actually matter. That's where I think we're going. Yeah, I would agree with that. And I think it's really interesting because obviously in your market, there are unique pressures around security, the way that Rob's evolving that are really sort of pushing that skills-based hiring to the fore. It's really interesting to hear that. Laurent, thank you very much for talking to me.

16:01Thanks to you. Thanks so much. Really appreciate it. Thank you. My thanks to Laurent. You can follow this podcast on Apple Podcasts, on Spotify, or wherever you listen to your podcasts. You can search all the past episodes at RecruitingFuture.com. On that site, you can also subscribe to our weekly newsletter, Recruiting Future Feast, and get the inside track on everything that's coming up on the show. Thanks very much for listening. I'll be back next time, and I hope you'll join me.

16:38This is my show.