Diversity in Cybersecurity: Widening Your Sourcing
Diversity in cybersecurity hiring: spot what shrinks your talent pool, rewrite the job ad, open new sourcing channels and assess skills, not backgrounds.
When a security role stays open for months, the instinct is to search harder in the same places: the same schools, the same job titles, the same profiles everyone is already chasing. The problem usually lies elsewhere. An overly restrictive job ad, narrow channels and an assessment that judges the background rather than the skills screen out strong candidates before the first conversation. This article helps you find those invisible filters and widen your sourcing without lowering your bar.
Why diversity is a hiring issue
Diversity of profiles is often treated as a communications topic. In cybersecurity, it is first a matter of effectiveness.
- A larger pool. If your search targets a single type of background, you compete with the whole market for the same people.
- Different points of view. Attackers do not think like your team. A team built from varied profiles (former developers, auditors, sysadmins, lawyers, self-taught practitioners) spots blind spots more easily.
- Better ties with the rest of the business. Security has to convince very different functions. People who have worked in those functions know how to talk to them.
There is also a legal framework. In France, the Labour Code prohibits rejecting a candidate on grounds such as sex, age, origin, disability or place of residence (article L1132-1, available on legifrance.gouv.fr). Most hiring discrimination is not deliberate: it comes from poorly chosen criteria that have the same effect.
What shrinks your pool without you noticing
Before looking for new channels, look at what already filters candidates upstream.
A job ad that asks for everything
Security job descriptions tend to pile up requirements: a specific degree, five years of experience, three certifications, ten tools. Many qualified candidates will not apply unless they tick every box, while others apply without hesitation. The ad then selects for confidence rather than competence.
The degree as the main filter
Requiring an engineering degree or a specialised master's screens out self-taught people, profiles from universities, technical colleges or apprenticeships, and career changers. Yet much of security expertise is built through practice. Our article on what certifications really say shows the same limit on the certification side.
Referrals only
Referrals are an excellent channel, but they reproduce the existing team: people recommend people like themselves. Used alone, they freeze the pool.
Vague interview criteria
"Good vibe", "fits the team": such criteria favour those who resemble us or speak with ease. Our article on soft skills in cybersecurity explains why "culture fit" is a trap and how to replace it with observable behaviours.
Rewriting the job ad to open it up
The job ad is the first lever, and the cheapest. A few rewrites often change who applies.
| Restrictive wording | Open wording |
|---|---|
| "Engineering degree required" | "Computer science education or equivalent experience" |
| "Minimum 5 years of SOC experience" | "Experience analysing alerts or logs, at work or through personal practice" |
| A list of ten mandatory tools | Two or three must-have skills, the rest as "nice to have" |
| "OSCP or equivalent mandatory" | "Demonstrable offensive practice (certification, CTFs, write-ups, engagements)" |
| "Ninja, rockstar, passionate 24/7" | A factual description of the work, on-call duties and real pace |
| No mention of conditions | Remote work, hours, possible adjustments, salary range |
Separate the essential from the desirable. A candidate should be able to think: "I don't have everything, but I have the essentials, so I'll apply." Our pentester job description and SOC analyst job description templates follow this logic.
Check the vocabulary too. Text full of internal acronyms and superlatives discourages people from outside the usual circles without attracting more experts.
Widening your sourcing channels
An open job ad is useless if it is only posted in the same places. Here are channels that are often underused.
- Universities and technical colleges, not just engineering schools. University programmes in networks, systems and security produce solid profiles that are often less sought after.
- Apprenticeships. An apprentice trained in your methods can become a lasting hire. It requires an available mentor, but the pool is large.
- Career change programmes. Sysadmins, developers, auditors, former military: our guide to hiring career changers details the backgrounds that transfer best.
- Technical communities. CTFs, local meetups, regional conferences, open source projects: you meet practitioners there who are on no job board.
- Associations and professional networks that support women in tech and security, or people outside traditional pathways.
- Organisations that support the employment of people with disabilities, such as Cap emploi in France. French companies with 20 or more employees are also subject to a legal obligation to employ workers with disabilities.
- Hiring beyond your local area. If the role allows it, opening partial or full remote work immediately widens the search zone.
Do not add every channel at once. Pick two or three suited to the role, and track where the candidates who reach interviews come from.
Assessing skills, not backgrounds
Widening sourcing only makes sense if assessment is fair. Otherwise you attract varied profiles only to reject them at the first interview.
The same questions for everyone
A structured interview, with the same questions and a scoring grid defined in advance, greatly reduces the effect of bias. Our guide to structuring a technical interview offers a method you can use even without security expertise.
A practical exercise
A short, realistic lab measures what the person can actually do, regardless of their school or former job. It is the best antidote to judging on the CV, as described in our article on assessing skills beyond the CV.
Simple adjustments
Always offer to adapt the conditions: extra time, a remote exercise, a written format rather than an oral one. This is not a favour, it is a way to measure competence rather than how someone handles interview stress.
A varied panel
Where possible, involve at least two people with different backgrounds. Score independently, then compare.
Welcoming and retaining
Hiring varied profiles and losing them within six months solves nothing. Onboarding matters as much as sourcing.
- A named mentor for every new joiner, especially one coming from another field.
- A written ramp-up plan, with clear goals at three and six months.
- Consistent pay bands, which do not depend solely on negotiating confidence.
- A culture where people can ask questions without being judged, which benefits the whole team.
Our article on retaining security teams covers the levers that matter after the hire.
Checklist to widen your sourcing
- The job ad clearly separates must-have and nice-to-have skills.
- The degree is not an elimination filter, unless genuinely required.
- The text describes the work and conditions factually.
- At least two channels beyond job boards and referrals are in use.
- Candidates get the same questions and the same grid.
- A practical exercise suited to the role is planned.
- Adjustments are offered to all candidates.
- A mentor and an onboarding plan are ready before the start date.
Conclusion
Diversity of profiles in cybersecurity does not mean lowering the bar. It means judging competence rather than background: a job ad that states the essentials, channels that leave the beaten track, the same assessment for everyone and a prepared onboarding. That is often where you find the candidates nobody else has seen.
Want to open your next hire to a wider range of profiles? Share your hiring need. Every search is run by a recruiter and a security practitioner, and our shortlisted candidates prove their skills on hands-on labs, whatever their background. See how we work.