I am an information security professional, currently working as an analyst / engineer and formerly a security auditor.
How should one approach the problem of assessing the personality and social behaviors of the candidate from the perspective of hiring for a security critical role?
Demeanor and personality are important aspects of any candidate when interviewing for a role, but in my first - hand personal experience, even more so for candidates looking to work in information security. There are certain character traits that I believe can be fairly agreed upon as critical, perhaps even game - breaking for a cybersecurity professional.
Discretion and maturity
Employees working in information security are often highly trusted with access to confidential information that may significantly damage a company if misused / leaked. A newly discovered, but un-patched vulnerability and the circumstances surrounding employee terminations are good examples. If information on unmatched vulnerabilities are disclosed, then an individual with unscrupulous intent and adequate knowledge can exploit it , possibly resulting in substantial, perhaps even irrecoverable harm to the company.
As to how to measure this trait, I tend to rely on behavioral questions about how the candidate behaved under similar circumstances in a past job. A question such describing how they balance security considerations with end user acceptance can often tell much about what candidates deem important information and how they adapt to different audiences, technical and non-technical alike. If I sense the candidates may be fudging / dishonest I follow up with a bit more probing questions.
Their resume and interview conduct is frequently another source from which to glean such information. In my linked question, the candidate's resume presentation was a negative insofar as their discretion is concerned. The fact that the candidate revealed his birthdate is especially concerning.
Finally, I have used the "online presence" of the candidate and their "Internet hygiene" to get a rough idea of their degree of caution towards data. Details such as what they choose to share in social media, any personal websites, or what / whom they follow online can often be revealing.
People working in the InfoSec profession frequently encounter situations in which critical decisions need to be made but for which full, definitive information to make it are not available. Similarly, resources (technical or human) might not be fully available to implement a decision. As an example, when I am reviewing IDS / SIEM logs, I look for patterns and deviation from a baseline. I often engage my "sixth sense" as to whether behavior is normal or malicious and hence worthy of further investigation, knowing there are tradeoffs. When deciding what security controls to audit, I think like a black-hat, a process requiring a certain degree of intuition.
As to how to measure intuition, again I tend to rely on behavioral questions, such as how the candidate made decisions under conditions of incomplete information or resource constraints in a past job.
Open mindness and willingness to learn
The cybersecurity profession is one of the most dynamic sub-fields within IT, and what may be considered secure today may be insecure tomorrow as vulnerabilities are discovered and exploited. As to how I assess the candidate on this quality, I ask questions such as how they accept correction of their work, examples of what they have done to improve themselves professionally, or of significant events in cybersecurity to see their degree of awareness.
Should these particular character traits be something that is used to determine if the person is a good match for information security roles or not?
By themselves, no. However, you should factor in such personality traits. If I were assisting in hiring for this role, I would judge traits such as uncommunicativeness / aloofness as a negative. Certain activities such as handling security incident response, or completing security risk assessments necessarily require interaction with other colleagues. When I perform a risk assessment, one of the first and most important tasks I do is interview end users / non - technical business people. Similarly, during incident response, timely but through communication is essential to containment and remediation, again an activity that requires communication.