How to Hire Information Security Analysts:
A step-by-step guide to finding top quality information security analysts. Includes a full hiring process that will help you find and hire the best, fast.
Write a compelling information security analyst job description.
Expand beyond the basics.
Finding information security analyst starts with a great job description. This should not only detail what the job entails and the minimum requirements applicants should have, but it should also highlight what makes your company a great place to work.
Use an information security analyst job description template to make things easier.
Sell your company to applicants.
The attractive aspects of becoming an information security analyst include great working conditions, highly competitive salaries, and job security. Sell your company vision and values, talking up attractive aspects of the working conditions and organizational culture, such as affording information security analysts a great deal of autonomy and a working environment that is welcoming and supportive.
Compose your job posting.
Start with a brief introduction of your business, highlighting the top-selling points, before providing a concise summary of the position you want to fill, along with the most attractive benefits you offer. Following this, list the job responsibilities and the minimum requirements.
Post your job on multiple sites.
Advertise your job on general job boards.
It's best to start by posting to general sites, like Indeed and CareerBuilder. These sites are incredibly well-known and receive large amounts of traffic. You'll also want to make sure your post is picked up by Google for Jobs.
Post to niche job boards.
Depending on the number of viable applications your receive through general job portals, you may also want to post to a few job sites specific to the IT and tech industry. Popular IT and tech job boards include HackerEarth and TechFetch.
Make use of professional networking and headhunting.
To expand your reach beyond candidates who are actively searching for opportunities, you can look to professional networking platforms, like LinkedIn, to find passive candidates. In fact, headhunting is the primary method for sourcing information security analysts.
On professional networking sites, you can search for profiles that match your job specifications and reach out to suitable candidates with a tailored message highlighting what you offer and pointing out what you believe makes them a great fit for the position and your company.
Screen your applicants.
Go through the resumes of all the applicants.
Before interviewing candidates, you'll want to screen the applications you've received to ensure you don't waste time getting to know unqualified candidates. An easy way to filter out unsuitable applications is by using a resume parser, especially if you have a large number of applications to process.
Send screening emails to applicants.
Another way to trim down the applications is to send each candidate a short email with a few key questions to verify nonnegotiable requirements, such as the minimum number of years of experience in information security or a bachelor's degree in computer science or information technology. Refer to your job description to formulate screening questions.
Examples of screening questions: "How long have you worked in information security?" "Which security frameworks have you worked with?" "What security information certifications have you obtained?"
Conduct background checks.
Once you've narrowed your candidate pool, you'll need to conduct background checks to verify their employment history, application details, criminal record, and more. Read our guide to the best background checking services for new hires.
Interview your top candidates.
Conduct a phone interview.
Conducting phone interviews to learn more about candidates is less time-consuming than in-person interviews and is sufficient for getting most of the information you need. The phone interview should be fairly brief, essentially serving to verify the information you have received from candidates in their applications and the responses to your screening questions.
Encourage candidates to give you a brief summary of what they have to offer and why they believe they are well-suited for this position.
Find out why they left their previous job and inquire about their salary and benefits expectations.
When you identify candidates who appear to be a great fit for the position, be sure to keep selling the job and your company as a great choice and reiterate the aspects of the position they are most drawn to.
Example interview questions: "Why do you want to be an information security analyst?" "Can you tell me a little about your experience in the field of information security?" "What was the most challenging project you've worked on?" "What, in your opinion, makes you the ideal candidate for this position?" "Why did you leave your last job?" "What do you expect in terms of compensation and benefits?"
Conduct an in-person interview.
It is not common for information security analysts to be invited for a test of their abilities as part of the recruitment process. Usually, they are instead subjected to an often very rigorous in-person interview in which their technical abilities are questioned.
To be sure that the candidates you have under consideration have the skills and know-how to perform their job as an information security analyst to your satisfaction, you should carefully prepare both closed and open-ended interview questions that test their knowledge and abilities.
Example interview questions: "What is the difference between TCP and UDP?" "What is the difference between a security threat, vulnerability, and risk?" "What is penetration testing? Please describe the process." "How would you explain a complex cybersecurity concept to someone with no prior knowledge of the topic?" "What techniques would you use to prevent web server attacks?"
If you need more inspiration, have a look at our information security analyst interview questions.
Make an offer.
Call your preferred candidate to offer them the job.
Since security information analysts are currently in demand and are likely to have several job prospects lined up while actively searching for a new position, you'll want to make your desired candidate an offer fairly quickly. The norm is to inform them of your decision in a brief phone call.
Send a follow-up email.
After speaking to your preferred candidate over the phone, send them a formal job offer letter by email.
