Discovering and Empowering the Expert-Level Cybersecurity Talent Within Your Team

The talk starts from a hiring problem: expert-level security talent is hard to recruit, so the speaker argues organizations should grow it from existing staff. The speaker traces a personal path from systems administration into full-time security work, reaching principal architect level over about a decade as a state government employee. The core idea is a protected block of time each week, roughly one or two hours, for staff to find repetitive chores and automate or simplify them.

The approach was piloted internally under the name GSC, standing for grow, simplify and enhance. Participants propose a task, define requirements, and report to their manager monthly, with management removing blockers instead of micromanaging. Metrics are individual, and an exit gate requires documentation, training and a team vote confirming others can support the result before the next round begins. Examples included checking asset inventories across security tools for gaps, and replacing a manual phishing-results request with a self-service dashboard fed by automated data pulls.

After about four months, just under half the team had joined, and the phishing dashboard was roughly 70 percent complete. Progress was slower than hoped because of leave, incidents and executive requests. Takeaways include starting with small wins, expecting slow growth, avoiding direct comparisons between junior and senior staff, and offering recognition rather than penalties to those who opt out. Documentation and training keep the automation running after its creator moves on.