Cybersecurity is one of the hardest markets to hire in, and a lot of the difficulty comes from how companies approach the process. Candidates are still being filtered on degrees, previous employers, and years of experience- signals that are particularly weak in a field where the best work is confidential, and skills need updating constantly. Good people are getting screened out, and what looks like a talent shortage can often be a matching problem.
So, what changes when companies stop filtering on the usual proxies and start hiring on what candidates can actually do?
My guest this week is Laurent Halimi, CEO and founder of Cyberr.ai, a professional network for cybersecurity professionals. In our conversation, Laurent explains why the skills shortage in cybersecurity is only half the truth, where the bias in hiring really comes from, and what it takes to judge candidates on skills that you can actually verify.
In the interview, we discuss:
- How AI is changing what cybersecurity professionals do and the new roles it is creating
- A real skill gap at the senior level and a matching problem everywhere else
- The certification race and why it is losing relevance
- Why hiring in cybersecurity is different from other technical fields
- Trust, stale skills, and work that stays invisible
- Where the bias in hiring algorithms really comes from
- Practical steps for judging candidates on verifiable skills
- Anonymous applications and giving candidates control of their profiles
- Will skills finally beat pedigree, and what does the future look like?
Follow this podcast on Apple Podcasts.
Follow this podcast on Spotify.
Key takeaways
- The cybersecurity talent shortage is only half the truth; there is a real skills gap at the senior level and a matching problem everywhere else.
- Verifying skills matters more in cybersecurity than almost any other field because much of the best work is confidential and cannot be shown in a portfolio.
- Biased hiring algorithms learned their bias from human decisions, replicating long-standing preferences for certain universities and employers at speed.
- Hiring teams can reduce bias by judging candidates on verifiable skills, using the same structured questions for every interview, and tracking where different groups drop out of the process.
- Skills look set to increasingly beat pedigree, with verified proof of ability becoming as standard as the resume in cybersecurity hiring.
Transcript
Matt Alder 0:00
Talent shortages get talked about constantly in hard-to-fill markets like cyber security. Some of that scarcity is real, and some of it is qualified people who never get seen. Telling these two problems apart changes what you do about hiring. So which one are you dealing with? Keep listening to find out.
Matt Alder 0:21
Support for this podcast comes from Cyberr, the professional network for cyber security. If you’re hiring for cybersecurity roles, you’ll know that they are more complicated and time-consuming than more generic requisitions. The briefs are full of acronyms. Filtering through candidate pools is incredibly complex, and outbound response rates are a fraction of what you see elsewhere. Specialist agencies will take away the burden, but at a high cost. And every week a role stays open, your organisation is at heightened risk. Cyberr Recruiter is built to close that gap, saving you time, effort and money in the process. Every Cyberr member profile carries a trust score. Certifications are validated through Credly and identity is verified at signup. Through their custom search agent, CIRA, your team brief in a role in plain language and get a qualified shortlist within minutes. You can find out more by going to cyberr.ai/hire. And Cyberr is spelt C-Y-B-E-R-R. That’s cyberr.ai/hire.
Matt Alder 1:49
Hi there, welcome to episode 817 of Recruiting Future with me, Matt Alder. Cybersecurity is one of the hardest markets to hire in, and a lot of the difficulty comes from how companies approach the process. Candidates are still being filtered on degrees, previous employers and years of experience. Signals that are particularly weak in a field where the best work is confidential and skills need updating constantly. Good people are getting screened out, and what looks like a talent shortage can often be a matching problem. So what changes when companies stop filtering on the usual proxies, and start hiring on what candidates can actually do? My guest this week is Laurent Halimi, CEO and founder of Cyberr, a professional network for cybersecurity professionals. In our conversation, Laurent explains why the skills shortage in cybersecurity is only half the truth, where the bias in hiring really comes from and what it takes to judge candidates on skills that you can actually verify.
Matt Alder 2:55
Hi Laurent, and welcome to the podcast.
Laurent Halimi 2:57
Hi, how are you?
Matt Alder 2:59
I’m very well, thank you. And it’s a pleasure to have you on the show. Please could you introduce yourself and tell everyone what you do?
Laurent Halimi 3:05
Of course. So my name is Laurent. I’m the CEO of Cyberr. The simplest way to describe us, we are the first LinkedIn for cybersecurity.
Matt Alder 3:14
Fantastic. And cybersecurity, I mean, it seems like a sort of a fascinating industry to be in, particularly sort of from a hiring perspective. With everything that’s going on with AI, I could see that that’s sort of reshaping your industry in sort of several directions. How’s it changing what cybersecurity professionals do? And what’s that throwing off in terms of demand for specific roles in hiring?
Laurent Halimi 3:39
Sure, but it’s actually a very big one. So let me break it into three simple pieces. First, AI is a new thing attackers use and a new thing defenders have to worry about. So there are actual new jobs being created. People whose whole job is making sure the company’s AI system can’t be tricked or hacked. That job barely existed three years ago. Secondly, AI is becoming a tool that security teams use pretty much every single day now. A lot of the boring, repetitive work, staring at alerts, checking logs, it’s starting to get done by AI first and the human checks after. So instead of hiring someone to sit and watch a screen all day, companies now want someone who can supervise the AI, catch its mistakes and make the final call. Thirdly, because of that shift, the skills companies are hiring for are changing as well. Lots of new software you will see on the market have a component in AI now. So it’s less, can you do this repetitive task and more, can you think clearly and make good judgement calls when something looks off? So the roles are shifting away from pure manual work and towards oversight and judgement. It’s not that AI is taking cybersecurity jobs. The jobs are actually turning into something a bit more senior, a bit more thoughtful.
Matt Alder 5:03
I mean, that’s really interesting because for a long time, there’s always been a lot of conversation about the talent shortages in this industry. Is that still the right way to read that market? Or are things kind of more complicated with these new roles and changes in the way the work is done?
Laurent Halimi 5:18
I have heard about the talent shortage for many years as well. Honestly, it’s true, but it’s not the whole truth anymore. And I think people should hear that. Yes, there is a real shortage at the top. If you need someone senior who really understands cloud security or AI security specifically, those people are generally hard to find and everyone’s fighting over them. But underneath, something else is going on. There are plenty of good qualified people applying for jobs and getting completely ignored, not because they’re not good enough, but because the way companies filter candidates is actually broken. Résumés get scanned for keywords, good people get skipped over, and it just looks like nobody’s out there. But actually the person is right in front of you. So I would put it this way. It’s not just a shortage of people. It’s a shortage of good matching, I would say. There is a real skill gap at the senior level and a real matching problem everywhere else.
Matt Alder 6:16
Yeah, that’s really interesting. I want to kind of dive into that in a bit more detail in a second. But before we do, I suppose just in a bigger picture, you sort of kind of alluded to this before. Is AI massively increasing the need for cybersecurity? Is it something that’s like really sort of driving the market or is it just another technology to think about?
Laurent Halimi 6:36
No, I think AI is like everything. You know, AI comes with pros and cons. In cybersecurity, we certainly saw, especially in the last six months, you probably heard about Anthropic as well, completely changing the face of the market. I think even the community, the cyber community, is kind of overwhelmed with what’s happening. The certification, you know, it’s very certification driven. So we see a lot of people trying to get as many certifications as they can, which kind of become sort of irrelevant for the jobs companies are hiring for at the minute. This is exactly why we built that platform, is to help navigate all of the changes and help the community to get the skills that they need for the next role they’re looking for.
Matt Alder 7:19
And does the way that cybersecurity professionals are hired, is that different from other technical fields? And what happens when people sort of try and hire them the way that they sort of hire other technology professionals?
Laurent Halimi 7:34
I think so, yeah. I think there are a few reasons, and they actually all matter. One, the most important one, is trust. You generally cannot fake your way into cybersecurity. Someone lies about their skills and you hire them anyway. It’s not just an awkward Slack conversation. That’s a company with a security hole in it. So verifying someone’s actual real skills matters more here than almost anywhere else. Two, I think the skills go stale fast. Something you learned two or three years ago in this field might already be out of date today. A certificate from a few years back doesn’t tell you much about whether someone can handle what’s happening right now. So years of experience on its own is a pretty weak signal in cybersecurity. And a lot of the best work is invisible as well. A software engineer can show you their code on GitHub. A cybersecurity person usually can’t show you the breach they stopped or the system they secured. It’s confidential. Or it would be actually a security risk to talk about it publicly. So you can’t just look at someone’s portfolio the way you can in other tech jobs. That’s the way we put it.
Matt Alder 8:42
And is that what’s kind of really fuelling the matching problem here? Because there’s a sort of a matching problem across recruiting in general, but I can see that a lot of the things that you mentioned there would make, you know, matching people to jobs just using résumés, CVs, really challenging.
Laurent Halimi 9:00
Yeah, I think it’s important to say plainly. People love to worry about the algorithm is biased, but also every biased hiring algorithm out there learned its bias from humans in the first place. So someone at some point decided what a good candidate looks like. And often that meant favouring people from certain universities, certain previous employers, people who just felt kind of familiar. That bias existed long before any AI tool showed up. To be fair, the AI just learned it from us and did it faster.
Matt Alder 9:37
Yeah, absolutely. And I think that is such a key point. And it’s something that, you know, I talk about a lot and people ask questions about a lot, which is we’re obsessed with AI being biased and, you know, regulation and legislation. And, you know, these are all the right things to do. But the human bias seems to be sort of disappearing off the agenda of discussion because everyone’s obsessed with the AI part of it. But yeah, I mean, it’s a kind of a massive issue. And I think that, you know, the bit there about qualifications and years of experience and where people have been, the universities they’re at is a key part of it, isn’t it?
Laurent Halimi 10:09
I agree.
Matt Alder 10:09
Yeah, absolutely. So what can, you know, obviously there will be lots of people listening who have cybersecurity needs, are hiring for cybersecurity professionals in one way, shape or another. What can hiring teams do to actually sort of take this human bias out of the process in, you know, what is such a critical role for an organisation?
Laurent Halimi 10:30
I would say they can do a few concrete things. First, I will say judge people on real and checkable skills. So certification, hands-on experience, things you can actually verify instead of things like which university did you go to or which big name company did you work at before? Those are just proxies and they let bias sneak back in. Use the same set of questions and the same scoring for every candidate in an interview instead of letting it turn into a free-flowing chat that goes differently for different people, especially in cybersecurity. It’s very important. Where you can, strip out the name, the photo, the school for that very first screening pass, just look at the skills first. And actually, look at your own numbers, track where candidates are dropping out of your process and check if that drop looks different for different groups of people. If you never look, you will never know it’s happening. And if you’re using an AI tool to help you hire, which is very common these days, ask it, what is it actually scoring people on? If nobody can give you a straight answer to that question, that’s a warning sign itself.
Matt Alder 11:39
Absolutely. And tell us a little bit about how your platform fits into this. How it helps, you know, what it does?
Laurent Halimi 11:45
Well, the platform is more than a platform. We are building a full ecosystem. So the concept of Cyberr is to bring the whole community together. What I found out during all my years running a recruitment agency in cybersecurity is the market is very fragmented. There’s a lot of things which are being done all over the world, but let’s say like the guys in Paris will not know about something being done in London because it’s very fragmented. So the idea of Cyberr is to bring the whole community together to help each other, to help people getting new certifications, to connect, to build the right network, to mentor because there’s a mentoring programme as well. And the cool piece about Cyberr is we’ve built a marketplace which is called Healer, which is actually live in three days. And here, the concept is to bring cybersecurity to startups and SMEs using the whole community. So we score the community directly within Cyberr. We verify the certifications. We verify the ID. And we score them. Based on the scoring, they can then deliver services to the marketplace and monetise their skills. This is actually a first globally. Think about Upwork and LinkedIn. And we’ve built both between the vertical, just on the vertical side of cybersecurity.
Matt Alder 13:04
That’s cool. I think one of the things also you do is you do some stuff around people being able to apply, you know, anonymously in the first instance. Tell us a little bit about that.
Laurent Halimi 13:14
Yeah, sure. So we’ve built this feature on the platform, which is anonymous. So essentially we give the opportunity to our community to hide their name, pictures, any information about the company they worked for in the past. And they are basically matched just based on skills, certification, and that’s it. It’s an important feature and the community likes it because on such a small vertical, you want to be discreet when you’re looking for a job. So there is an element of browsing and being in control of your own profile, as opposed to sending your profile and your CV to a recruitment agency, which usually will send your profile to as many companies as they can to get an interview. So you’re in control of your profile, but you’re also properly matched based just on your skills and the requirements of the jobs.
Matt Alder 14:06
And, you know, as you say, we’re obviously talking about an audience who are very aware and their data privacy is very important to them.
Laurent Halimi 14:15
Yeah, yeah, 100%.
Matt Alder 14:15
As a final question, if we look two or three years into the future, how do you think hiring is going to evolve? What would we be talking about if we had this conversation again in three years’ time?
Laurent Halimi 14:29
I think skills start to matter more than pedigree, full stop, really. The idea that you need a specific degree or that you need to have worked at one of the five impressive companies is already fading. And I think it keeps fading in cybersecurity especially. Someone who can prove they can actually do the work will increasingly beat someone with a shinier résumé and less reliability. Proving your skills becomes normal, not optional. Right now, a résumé is the standard thing everyone sends. I think in a few years, some kind of verified proof, validated certificates, demonstrated projects, a real skill check becomes just as standard. Hiring stops being, we have an opening, panic, post a job, wait. Companies start building relationships with good people before they even have a role open. So when the role does open up, they are not starting from zero. And AI takes over more of the highly repetitive part of hiring, the first filtering, the first matching. So humans spend their time on the part that actually needs a human. The final conversation, understanding whether someone’s a good fit for this specific team, closing the deal. Less time wasted on paperwork, more time spent on the decisions that actually matter. That’s where I think we’re going.
Matt Alder 15:44
Yeah, I would agree with that. And I think it’s really interesting because, obviously, in your market, there are unique pressures around security, the way that roles are evolving, that are really sort of pushing that skills-based hiring to the fore. It’s really interesting to hear that. Laurent, thank you very much for talking to me.
Laurent Halimi 16:01
Thanks to you. Thanks so much. Really appreciate it. Thank you.
Matt Alder 16:04
My thanks to Laurent. You can follow this podcast on Apple Podcasts, on Spotify, or wherever you listen to your podcasts. You can search all the past episodes at recruitingfuture.com. On that site, you can also subscribe to our weekly newsletter, Recruiting Future Feast, and get the inside track on everything that’s coming up on the show. Thanks very much for listening. I’ll be back next time, and I hope you’ll join me.
