Cyber security recruitment has become overly dependent on certificates. CISSP, CISM, CEH and similar qualifications can demonstrate study, commitment and a baseline understanding of recognised frameworks. They cannot prove that someone can make a sound decision when the evidence is incomplete, the system is failing and the consequences are real.
The mistake is not using certification. The mistake is treating certification as evidence of capability.
What certification can and cannot tell you
A relevant qualification can help an employer establish that a candidate understands common terminology, control frameworks and professional expectations. It may be useful for regulated work, customer assurance or roles where a contractual requirement exists.
That is where its evidential value stops. An examination cannot establish whether somebody can:
- identify the material risk among hundreds of technically valid findings;
- challenge a senior stakeholder without losing the relationship;
- make a proportionate decision when there is no perfect answer;
- recognise when a control works on paper but fails operationally;
- lead calmly through an incident; or
- explain a complex security problem to a board in terms that support a decision.
Those abilities are developed through exposure, reflection and accountability. They are not acquired by memorising the expected answer to a multiple-choice question.
Experience is built where theory ends
Real environments are untidy. Systems have undocumented dependencies. Exceptions outlive the decisions that created them. Suppliers provide incomplete answers. Controls conflict with operational priorities. The person responsible still has to decide what matters, what can wait and what must change now.
Experienced practitioners have seen apparently sensible decisions fail for reasons that were not visible at the outset. They understand that technical correctness is only one part of a defensible decision. Timing, organisational capacity, commercial pressure, human behaviour and operational consequence all matter.
This is why experience is not simply time served. Ten years of repeating the same narrow task is not automatically more valuable than three years of varied, accountable work. The relevant question is what the candidate has owned, what went wrong, what they learned and whether their judgement improved.
Pattern recognition is the practical advantage
Senior experience produces pattern recognition. A familiar failure rarely arrives in exactly the same form twice, but its underlying structure often repeats. Weak ownership, unclear decision rights, optimistic supplier claims, untested recovery assumptions and dashboards without context appear across industries.
A seasoned candidate can recognise those patterns earlier. They know which questions expose an assumption and which details are merely noise. That shortens diagnosis, reduces avoidable experimentation and gives an organisation a better chance of acting before a concern becomes an incident.
Pattern recognition should not become dogmatism. Good experience makes a leader curious, not complacent. The strongest candidates can explain where their previous experience applies, where it does not and what evidence would change their view.
Calm under pressure must be tested
Interviews often reward polished explanations of ideal practice. Security work frequently demands something different: a clear response when the information is partial, the clock is running and several stakeholders want incompatible outcomes.
Ask candidates to work through a realistic scenario. Give them an incident with uncertain scope, an executive demanding an immediate answer and a critical service that cannot simply be switched off. Do not assess whether they recite a textbook sequence. Assess how they establish facts, frame uncertainty, set priorities, assign ownership and communicate risk.
The objective is not to manufacture stress. It is to observe judgement.
A better cyber security recruitment process
A credible selection process should combine evidence rather than rely on a single proxy.
- Define the outcomes before the credentials. State what the person must improve, own or deliver in the first year.
- Separate mandatory requirements from convenient filters. If a certificate is not genuinely required by regulation, contract or role design, do not present it as mandatory.
- Use a practical scenario. Test prioritisation, reasoning and communication against a problem resembling the actual role.
- Examine accountable experience. Ask what decisions the candidate personally owned, not merely which programmes they observed.
- Probe failure. Strong candidates can discuss mistakes without evasion and explain how their decisions changed afterwards.
- Assess translation. A senior security professional must connect technical evidence to business consequence and executive action.
- Look for continued learning. Experience has value only when it remains current and is tested against new evidence.
The role of HR and executive leadership
HR should not be expected to distinguish deep technical capability without support. Security and technology leaders must help define the role, design the assessment and challenge lazy screening criteria.
Equally, technical interviewers should not turn recruitment into a contest of obscure knowledge. The aim is to determine whether the candidate can produce the outcomes the organisation needs. Trivia, brand familiarity and shared career history are poor substitutes for evidence.
For senior appointments, boards and executives should be explicit about accountability. A CISO cannot succeed where risk ownership is deliberately vague, authority is withheld or every difficult decision is pushed back into the security team. Recruitment cannot repair a structurally impossible role.
Certification is supporting evidence, not the verdict
The strongest candidate may be certified. They may not be. Either way, the decision should rest on demonstrated capability, relevant experience, judgement and the ability to operate in the organisation that is actually hiring.
Certificates establish that somebody passed an assessment at a point in time. Experience shows what they did when the answer was not supplied.
If the appointment carries material security accountability, Gratmore can provide independent executive advisory, assess whether the role has been designed to succeed and provide fractional CISO leadership where senior ownership is needed before a permanent hire is justified.
