Disclaimer - Using a temp account as my real account is having login issues with 2FA.
I have interviewed a handful of candidates for newly opened Info Sec auditor or InfoSec analyst positions in the last several weeks. If hired, these people will be reporting to me or will be working very closely with me on our separate InfoSec team. I have found quite a large portion of the candidates that did apply to be unsuitable in their technical background or communication ability. To give examples of what I mean:
Unable to succinctly describe the tenets of the CIA security triad (Confidentiality, Integrity, Availability), how these concepts relate, and importance in InfoSec.
Unable to explain concisely what a security control is, types of controls, and example of each without rambling.
Unfamiliarity with principles of Least Privilege or Segregation of Duties, or data classification / sensitivity labeling.
I have re-read the job description that I drafted and the requirements of the job seem clear as well as the qualities in ideal / desired candidates. Prior to interviewing with my team (am team lead) or separate InfoSec team, candidates are screened through HR who is non - technical. I believe the reason weak candidates are moving forward to the interview stage when they should not have been invited is that this initial screening process is flawed.
I would like to strengthen the screening criteria so to improve efficiency in the actual interview stage, without being too blunt or offensive by suggesting to HR that their screening technique is bad.
How can I do this in the least offensive way possible while being honest?