Embracing the infosec community and people in it is important if you want to attract the talent you need. Learning to understand geeks and geek subculture is an important skill here. Read on and understand why both your HR and marketing departments need to learn geek.

So you’re one of those companies that has problems attracting talent? Or keeping it. Maybe even both?

Here’s some comfort in a sense: You’re not alone. That’s the new normal everywhere in IT. Luckily, there are ways to improve your situation. The infosec community holds the key: Embrace its culture and language, show people in it that you understand and respect them, and demonstrate that everybody in your organization takes security seriously. The community will love you back by spreading the word about how great it is to work at your company and how much fun people have there. Succeed, and all your challenges with attracting and retaining talent will be a thing of the past.

Marketing and Employer Branding Are Often Overlooked

In reality, this is marketing and for some reason it’s vastly overlooked in talent acquisition and employer branding. Is it because talent professionals know little about tech culture? Probably, but that can be fixed.

Let’s start from the beginning: What is this community, why is it important, and how does one communicate with it and make it do all those amazing things I mentioned earlier?

The Infosec Community

In short (and hugely oversimplified), the infosec community consists of all those passionate, geeky personalities who love infosec so much that they just have to make it part of their careers. Many of them can’t leave it at that and meet up with like-minded people in their spare time to discuss infosec, watch talks, and get to know more people like them.

Because of these passionate people, the infosec community consists of many of those security wizards every company wants to hire. And they’re in short supply.

Providing Value and Getting Respect

The way to get their attention is actually quite simple: Provide them with content that gives immediate value. If you succeed, the community will help you out, recognizing you as a friend.

Providing value to the community is done by creating meaningful, inspiring, or just fun content of high quality. An important thing is to not take yourself too seriously. If you have an edge, it’s appreciated and rewarded.

Real-Life Examples of Building Credibility

• Reddit Outreach: When working on a FOSS project aiming to replace Fail2Ban, I monitored Reddit for mentions and subtly suggested our alternative where it added value. This helped gain direct interest and awareness.
• Stickers and Humor: Designing stickers that reference geeky jokes or sci-fi like Star Wars can surprise people. At BSides Prishtina, I was introduced as “the guy with the coolest stickers.”
• Talks and Meetups: I’ve given talks on living with ADHD in infosec to dispel myths, share personal stories, and build connections. It’s been a way to showcase my expertise while building my authority in the community.

Providing value to the community is done by creating meaningful, inspiring (or just fun) content of high quality

Getting HR, Marketing, Communications, and the Security Pros to Work in Sync

For this strategy to work best, HR, marketing, communications, and your security team need to be in harmony. Here’s how to make this collaboration happen:

• Cross-Department Workshops: Get everyone together to share their perspectives. Your security team can explain the challenges they face, while marketing and HR can help craft messaging.
• Joint Strategy Development: Build a strategy with common goals that align everyone’s strengths. Let your security team highlight key points while HR and marketing turn these into compelling job descriptions and campaigns.
• Content Creation: Security experts provide technical depth, while marketing ensures it’s clear and engaging. Share behind-the-scenes stories and thought leadership pieces that spark curiosity.
• Feedback Loop: Set up a feedback loop to improve your strategy. Share findings across departments so that adjustments can be made based on community feedback.
• Internal Advocates: Find internal advocates to bridge the gap between technical and non-technical teams. They’ll ensure your message remains authentic and appealing.

More Ways to Engage

I’ve been involved with my local infosec community for a long time, arranging events and talks for peers to show up, grab some pizza, and get inspired for new projects. This has helped me build a network of peers, many in decision-making positions, whom I can reach out to and leverage to my advantage. I can only do that because my involvement in the community has helped me build trust and authority over time.

Other ways to engage include arranging CTF (Capture the Flag) competitions for your employees and the local infosec community, contacting universities to sponsor student events, or interviewing an employee who maintains an open-source security tool that your organization uses.

Content Marketing for the Infosec Community

All these examples are forms of content marketing. Conceptually, it’s nothing new, but using it specifically for the infosec community is still relatively uncommon. When used well, it’s an effective way to speak directly to the community, provide them with valuable content, and show that you understand their needs. This helps you build brand recognition and earn their trust.

Conclusion

Dare to step out of your corporate image and show the infosec community who you really are. Embrace their culture, show respect, and connect authentically. Your company will be seen as an attractive place to work. And if you need help combining these skills, feel free to reach out to me.

There’s a lack of talent in cybersecurity. Nobody seems to be able to hire enough qualified specialists. Nothing’s new in that.

What’s really strange when speaking of this lack of talent is that no one seems to do anything about that and their situation. While you can’t magically snap your fingers to make the specialists you need magically disappear, what you can do is to stand out among the companies looking to hire talent and talk to them in a language they understand.

There’s too many job ads out there that are too formal and neither show the true spirit of the workplace and the specialists already working there nor the specialist they’re trying to attract. Also, there’s practically no companies who understand that engaging with the cyber security community could be a part of their employer branding strategy.

To me that makes absolutely no sense.

In reality, employer branding is marketing and like any other types of marketing it’s about creating immediate value to the recipient who in this case is the cyber security community.

If you think about it, it makes sense: the cyber security community is full of those engaged, talented professionals your company needs to make your business strategy become reality. Those professionals who simply love cyber security so much that they are submerged in pet projects in their spare time, who love seeing other community members with the same passions to share inspiration, knowledge and to feel togetherness in an uncertain world.

By hooking into this community professionally, you show members of the community that you share their values and beliefs; that you are part of the tribe. Tribes are the cornerstone of civilization; people in the same tribe look out for each other, they help and support each other when they can. They truly care for each other. These are the feelings you want to awaken in the cyber security community.

Basically you want sentiment, you want the cyber security community to look up to you as a company, to your specialists. You want to make the cyber security community want to work with you.

The good news is that it’s not hard to do this as long as you know the language of the community, which defines the rules and the tone of your communication and you can predict what community members will find interesting. And, admitted, that last part is quite hard. But basically it’s about knowing about cyber security and knowing about subcultures, about geekiness. Being a geek yourself, regardless of type, is definitely not a disadvantage.

So how do you create value? You give the community what fuels it:

• Knowledge in the shape of videos, talks, articles, workshops, courses and more.
• Humor is a tough element to get right but important. It’s important to show that you as a company dare to show a human side of yourself and that you don’t take yourself too seriously. If you’re capable of that and of doing jokes at your own expense, you win.
• Meetups are where the magic happens; where people interact and get inspired. Your company can support it by sponsoring food and drinks, engaging in planning and doing talks. Those two last ones are always the hardest ones and are typically the reasons for community meetup groups to hibernate or dissolve.

To be frank, community employer branding is not for everyone. Honesty and transparency are important factors. Let me explain:

As a cyber security professional nothing is worse than not being taken seriously; to be hired to help increase security, to see that there is a need and that significant risks need to be addressed but not being able to. What usually happens is that management in theory finds security important but in reality finds other things, like making money, more important. I’m not saying that that isn’t fair to do if it’s done in complete transparency, if all risks have been assessed and addressed on management level and it has been decided. Unfortunately that is rarely the reason. More often than not, it’s the result of incompetent management, bad communication and reporting by people who are not very good at explaining exactly what impact this or that threat has on business risk.

So if you’re not one of those companies that truly does take cyber security seriously in every part of the business, you can’t go around pretending to be. Not forever, at least. And when the community finds out, your efforts will backfire.

So in other words: If your company’s management truly mean it, and you have an organization that supports it, the effort you put into this will pay off if done in the right way.