Community Employer Branding

There’s a lack of talent in infosec and it’s possible to affect potential candidates’ view on your company in general and specifically as an employer.
Nothing new in either of those things. Employer branding has been a thing for a long time.

What is new, though, is the way to do employer branding.


You’re looking to hire infosec specialists. Those are typically very technical and as such they are a special breed. They typically have a unique mindset in many ways; they are part of a subculture with their own humor and cultural and behavioral codecs. Hooking into that culture provides trust towards your company and will provide you with a head start in your employment strategy. After deploying this approach, those aforementioned specialists start trusting you and identifying with you and your existing technical specialists and make them want to work for you. Put differently: by communicating in a way that complies with existing codecs signaling that you understand potential candidates and their tribe; that you are part of that same tribe, you will find it significantly easier to hire the talent you need to support your business strategy and -goals.


In reality, this is marketing: Content marketing towards the infosec community. It’s about producing content (very broadly put) that provides immediate value to the recipient. Also, it’s about defining the exact persona you’re trying to reach and predict what they appreciate – what they need from you before they know it themselves. So to use this approach, you need a strategy defining what you’re looking to achieve and a plan outlining how to do it. Like any other types of marketing, it requires a long-term plan to have any effect so your plan should think at least one year ahead. Producing content that resonates with the persona(s) you’ve defined is the real challenge here. Content can be anything from technical articles to memes; only the imagination sets the limit here. So being capable of getting unorthodox ideas which puts the personality of your company forward is really important here. In general the infosec community appreciates it when you’re using nerdy humor and references and that you’re not taking yourself too seriously. Depending on what kind of content you’re planning, the process of creating it takes time from your technical specialists. This as well as utilizing it optimally can be optimized in different ways by using techniques such as crowdsourcing, content chunking and compounding, reusing. Implementing this strategy in practice requires experience with the infosec community and the people in it. For most HR professionals this is a challenge. Luckily, help is available. How can we help?