I was discussing an issue with an ex-colleague. He is currently assisting (as an HR member) with hiring for an Information Security department, where the Information Security team are responsible for providing technical interviews, the HR team is supposed to be helping with psychological profiling and background checks.

Basically we were just having an over-a-beer chat about the whole thing. I offered my anecdotal layman's observation that everyone I have ever known who works in network-level information security, crypto security, etc., tends to be this retentive type of personality: They don't talk much. They keep sentences brief. Emotional connection is difficult, they look like at you with suspicion. Emails are distilled to one-liners almost always.

His response was that while that was good advice, he could not act on it without some kind of sociological/psychological hard evidence to back it up. His counterargument, playing kind of devil's advocate, was that we don't know if that kind of personality is attracted to security work, if it is created/shaped by security work, or if being retentive (as opposed to a profuse bullshitter for example) is any kind of criteria at all.

We didn't really get past that philosophical obstacle of whether these particular character traits should be something that is used to determine if the person is a good match for information security roles.

So, my question is:
When hiring for a security critical role, how should one approach the problem of assessing the personality and social behaviors of the candidate?

  • The question is in italics, and very clear. – Sentinel Jan 21 '19 at 22:59
  • Let me know if you are online. Join me in chat and we can talk. Writing an answer but just like to know your thoughts as I also work in cybersecurity – Anthony Jan 22 '19 at 0:08
  • 1
    This isn't really a workplace question. – AndreiROM Jan 22 '19 at 16:12

I am an information security professional, currently working as an analyst / engineer and formerly a security auditor.

How should one approach the problem of assessing the personality and social behaviors of the candidate from the perspective of hiring for a security critical role?

Demeanor and personality are important aspects of any candidate when interviewing for a role, but in my first - hand personal experience, even more so for candidates looking to work in information security. There are certain character traits that I believe can be fairly agreed upon as critical, perhaps even game - breaking for a cybersecurity professional.

Discretion and maturity

Employees working in information security are often highly trusted with access to confidential information that may significantly damage a company if misused / leaked. A newly discovered, but un-patched vulnerability and the circumstances surrounding employee terminations are good examples. If information on unmatched vulnerabilities are disclosed, then an individual with unscrupulous intent and adequate knowledge can exploit it , possibly resulting in substantial, perhaps even irrecoverable harm to the company.

As to how to measure this trait, I tend to rely on behavioral questions about how the candidate behaved under similar circumstances in a past job. A question such describing how they balance security considerations with end user acceptance can often tell much about what candidates deem important information and how they adapt to different audiences, technical and non-technical alike. If I sense the candidates may be fudging / dishonest I follow up with a bit more probing questions.

Their resume and interview conduct is frequently another source from which to glean such information. In my linked question, the candidate's resume presentation was a negative insofar as their discretion is concerned. The fact that the candidate revealed his birthdate is especially concerning.

Finally, I have used the "online presence" of the candidate and their "Internet hygiene" to get a rough idea of their degree of caution towards data. Details such as what they choose to share in social media, any personal websites, or what / whom they follow online can often be revealing.


People working in the InfoSec profession frequently encounter situations in which critical decisions need to be made but for which full, definitive information to make it are not available. Similarly, resources (technical or human) might not be fully available to implement a decision. As an example, when I am reviewing IDS / SIEM logs, I look for patterns and deviation from a baseline. I often engage my "sixth sense" as to whether behavior is normal or malicious and hence worthy of further investigation, knowing there are tradeoffs. When deciding what security controls to audit, I think like a black-hat, a process requiring a certain degree of intuition.

As to how to measure intuition, again I tend to rely on behavioral questions, such as how the candidate made decisions under conditions of incomplete information or resource constraints in a past job.

Open mindness and willingness to learn

The cybersecurity profession is one of the most dynamic sub-fields within IT, and what may be considered secure today may be insecure tomorrow as vulnerabilities are discovered and exploited. As to how I assess the candidate on this quality, I ask questions such as how they accept correction of their work, examples of what they have done to improve themselves professionally, or of significant events in cybersecurity to see their degree of awareness.

Should these particular character traits be something that is used to determine if the person is a good match for information security roles or not?

By themselves, no. However, you should factor in such personality traits. If I were assisting in hiring for this role, I would judge traits such as uncommunicativeness / aloofness as a negative. Certain activities such as handling security incident response, or completing security risk assessments necessarily require interaction with other colleagues. When I perform a risk assessment, one of the first and most important tasks I do is interview end users / non - technical business people. Similarly, during incident response, timely but through communication is essential to containment and remediation, again an activity that requires communication.

  • Thank you! Someone voted your excellent answer down. There is something very wrong with this site. Upvoted. – Sentinel Jan 22 '19 at 7:16

No, it isn't.

You can't really expect to base the employment of an introverted, uncommunicative person based mainly on their traits of not communicating well.

Although you might be stereotyping people in this role, you still need to judge candidate suitability on traditional measures of quality and demonstrable knowledge.

  • I suppose that's the grey area - part of that measurement should be some kind of assessment with how susceptible the character is to social engineering, which is probably the most important source of attack vectors. – Sentinel Jan 21 '19 at 13:31
  • 1
    Not really. It is entirely possible that gregarious people to also be careful about their security online. It's also possible for non-communicative people to be susceptible to online hazards. – user44108 Jan 21 '19 at 13:35
  • Gregarious people will tend to have more people in their offline community, though, which increases risks in and of itself. That's being excessively paranoid though maybe. The online digital hygiene is one thing, the social behavior and weaknesses/threats through the personality itself are another. I suppose the question is how does one actually go about assessing that area? (I updated the q) – Sentinel Jan 21 '19 at 13:38

Your friend is totally right.

You may be just stereotyping personal traits that have nothing to do, by themselves, with the job and without hard evidence you really cannot know if your observations are:

  • biased,
  • based on selective perception,
  • based on a limited experience (not statistically significant),
  • due to different factors (company or country culture, etc.)
  • whatever else
  • Hi Czar thanks, I updated the question to clarify a bit so you might want to update your answer. Basically, what approaches could be taken to assess the offline aspect of the candidate for a role critical to information security? Questions like use of prostitutes, etc., should all be in scope for example? – Sentinel Jan 21 '19 at 14:00

Generalize, much?

Good IS people come from all types of background. The HR person should interview them in the same way as they interview any other people. If they have any doubts about capability, they should give more weight to certifications than they might otherwise.

To only employ people based on personality traits that are here-say based on a very small sample size is entirely wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.