The Brandeis GPS blog

Insights on online learning, tips for finding balance, and news and updates from Brandeis GPS

Tag: Brandeis GPS (page 1 of 15)

Looking back: the growth of Python

Since Guido van Rossum first released Python to the public in 1991, it has become one of the fastest growing major programming languages and established itself as the defacto language among varied scientific communities.

Python is particularly valuable to today’s forward-thinking industries and technologies, including data science and machine learning. Its intuitive platform makes it appealing for new programmers, yet it can also serve as a tool for more complex purposes.

Some of the features of Python include:

  • Minimal keywords, simple structure, and a clearly defined syntax
  • Code that is much shorter than former industry-leader JavaScript
  • A broad standard library that is portable and compatible on a number of hardware platforms
  • A mode allowing interactive testing and debugging of pieces of code
  • Tool customization for efficiency using added low-level modules

Master Python Programming

Brandeis GPS offers multiple online courses that teach the programming language specific to certain industries: Python Programming (FinTech), Bioinformatics Scripting and Python Programming (Bioinformatics), and Python for Robotics and AI  (Robotics). All three courses are available for professional development as long as students can demonstrate previous basic experience with a programming language (or undergraduate-level coursework).

Brandeis GPS offers rolling admission to our 12 fully-online master’s degree programs, so you can apply and be accepted at any time. However, we do have recommended deadlines if you are seeking admission for a specific term. The deadline to apply to our Spring 1 session is Wednesday, December 19. You can apply here. Those interested in taking a course who do not yet wish to pursue a full master’s degree can still take up to two online courses without officially enrolling.

To learn more about GPS courses or graduate programs, check out our website or contact gps@brandeis.edu or 781-736-8787.

When the Wrong Person Leads Cybersecurity

By Matthew Rosenquist

Succeeding at managing cybersecurity risks is tremendously difficult even for seasoned professionals. To make situations worse, poorly suited people are often chosen to lead security organizations, bringing about disastrous results. This has contributed to weaker risk postures for organizations and the rapid turnover in cybersecurity leadership.

I am unhappy to report that the industry has a pervasive problem that few want to discuss: a propensity to enlist inexperienced or unsuitable professionals to lead cybersecurity. It is time to change that caustic and enabling behavior by first recognizing the problem.

As an example, recently in the news, there was criticisms for someone appointed with the responsibility to lead the cybersecurity effort for the 2020 Olympics, but had never used a computer. How does someone who has never used a computer and has difficulty answering basic questions about USB drives, be tasked with building a cybersecurity program to protect the digital security, privacy, and safety for hundreds of thousands of people?

Downward Spirals

Sadly, I have seen similar situations play-out over and over again across academia, business, and government sectors. Far too often, poorly suited people are appointed such roles and it simply does not make sense. Let’s be clear, most are truly knowledgeable and accomplished in their primary field, but a transition to security is a significantly different domain. Engineering and product management executives focus mostly on static problems where there is a solution and desired end-state. Whereas in cybersecurity, we face a highly dynamic set of threat agents, people who are creative, intelligent, motivated, and dynamic, who will adapt to any solution. There is no permanent fix for cybersecurity as it is an ongoing competition to managing risks between defenders and attackers.

Human nature, overconfidence, and a lack of understanding the challenges begins to shape a counterproductive mindset. It is common for a professional from a different discipline, transplanted and put in charge of cybersecurity, to believe their prior expertise is equally applicable to the new challenges. Somehow, magically, they think they are as proficient and insightful at an adjacent domain as their previous profession. To those experienced in adversarial challenges who have seen this unfold, it is an affront to common sense. It is no surprise that such dangerous situations most often result in momentous failure.

For years, the turnover rate in cybersecurity leadership positions across the industry has been very high, with most Chief Information Security Officers (CISO) only lasting 2 to 4 years. When surveyed, CISO’s cite a lack of executive management support or insufficient budgets were the pervasive motivators. But that is only one side of the story as many CISO’s have been let go.

I have always been curious what C-suites and board had to say. When I ask company leaders about a change in cybersecurity leadership, I often hear that an outgoing CISO was ineffective, could not communicate risks well, and demanded significant budget increases every year yet the organization did not show a commensurate benefit. Events culminated when a severe incident occurred and then the C-suite or board chose to find a new security leader.

With the shortage of CISO’s in the industry, those displaced quickly find another company and continue their ‘training’. This musical-chairs routine does not serve the company or overall industry needs very well and simply transplants problems from one organization to another.

Masters of All

This mistake occurs regularly with technical personnel, probably as cybersecurity is generally characterized as a technology problem by the unacquainted. An accomplished engineer or architect is put in charge of security and now with ‘cybersecurity’ in front of their title they truly believe they are a risk expert. They are not. Being savvy in technology vulnerabilities and exploits is far different than understanding the massive breadth involved in managing risk. Most are unwilling to admit their shortsightedness in the breadth and depth of the challenges and their arrogance simply becomes a hinderance to seeking the needed help to be successful.

Ego can be such a major hindrance when the fear, of being perceived as not understanding a problem or knowing an answer, limits your actions. It is typical for a person in such a quandary to retreat back to familiar areas they know, resulting in defining the problem and solution only in the terms of technology. This ignores the behavioral, adversarial, and process aspects that are crucial to managing risk. With blinders on, they continue to push forward regardless, thus the car wreck begins.

Cybersecurity is more than just a ‘tech’ problem and will never be ‘solved’ with technology alone (two pervasive misconceptions from engineers first joining cybersecurity). They are likely doomed. I have seen this happen countless times and can spot it a mile away. It is like an automobile accident happening in slow motion with an overconfident driver continuing to push forward as metal bends and glass shatters.

Enlarged Version of Cybersecurity Domains

Part of the issue is that people, who are experts in one field, assume they understand the entire problem set in another adjacent but ambiguous field. It is not until they are in the new role, that they then experience the unforeseen challenges of a different world.

Imagine a hospital. Would you promote the engineer who developed a defibrillation tool to be an emergency room doctor? No. Although tools and technology play a crucial role in medicine, it is not the same as predicting, preventing, detecting, and responding to health risks for patients across their lifespan. The same applies in cybersecurity. Technology is the battlefield, not the war. Understanding the terrain is important, but must be combined with a keen assessment of your opponents, and the ability to operationally maneuver in advantageous ways.

This is true in other fields as well. Aeronautical engineers aren’t promoted to fighter pilots and textbook publishers aren’t necessarily good grade school principals, so why do organizations make the mistake of a taking a software engineer or business-line product manager and expect them to be successful in leading cybersecurity?

Two Scenarios: Vastly Different Chances for Success

Now, I did say this is a recipe for failure most of the time. There are some, very rare situations, where an insightful but inexperienced person takes a cybersecurity leadership role and succeeds. It is possible. I have only seen it a handful of times and in every case that person was realistic about their knowledge and checked their ego at the door.

Guaranteed Failure:

An engineer, project manager, or business executive is put in charge of cybersecurity. They are confused or intimidated by security practitioners in their organization and respond by immediately surrounding themselves with like-minded, yet similarly security inexperienced people. They add other engineers, marketing, and legal people to their core echelon, inadvertently creating a self-reinforcing ineffective group-think team. Congratulations, an inexperienced leader has just encircled themselves with a cushion of people who don’t have the knowledge to challenge poor directives or independently deliver sustainable success. If you wonder what conversations with them are like, take a look at the Dilbert cartoon, specifically the ‘manager’ character. That is pretty close. Funny from afar, but frustrating up close.

Ineffectual organizations tend to grow fast, spend a lot of money, make hollow promises, tell a story of difficult times that are turning around, but have no real strategic plan, prioritized goals, or clearly defined scope with organizational roles and responsibilities. They seek non-existent cure-all solutions, and their long-term stratagem is to hope nothing bad happens while they battle daily issues. Even worse, the proficient security personnel, that may have been part of the team, will likely leave such a caustic environment for a better employer. That breaks my heart when I see capable people who want to make a difference, driven away. When quality employees begin jumping-ship en-masse, it is a sure warning sign.

The easiest way to detect this situation early on, is to look at their metrics, or lack thereof. If a security organization operates without the benefit of tangible metrics, it is a likely sign they have not defined or are not tracking against goals, roles, objectives, and probably aren’t measuring or tracking risk. What they are doing is responding to issues, self-marketing, rapidly growing the team, consuming significant resources, slowing down the business, and the looking for people to blame when their ineffectiveness becomes apparent. These orgs don’t last. They implode. People quickly leave and executive oversight will soon look past the whitewash to cut budgets, headcount, and eventually replace the leaders.

Potential for Success:

An engineer, project manager, or business executive is put in charge of cybersecurity. They understand they are not a security expert, so they assemble a team who has experience and talent in protecting digital assets, understanding threats, can articulate risks, and are intimate with the technology in use. They build an organization structure that is comprised of operations, engineering, and risk intelligence teams. Then listen and learn. Great leaders bring in the best people and let them excel. They quickly get clarification on the business goals and expectations from executives and customers. They then identify prioritized objectives, define a scope, derive the supporting measurable goals, identify areas in need of immediate attention, and establish the measures & metrics necessary to track progress.

Governance issues are addressed and a strategic process capability is embedded to constantly improve the organizations risk management ability to predict, prevent, detect, and respond to threats. They establish both the tactical plans necessary for immediate survival and day-to-day management, but also define a long-term directional strategy that takes into account the ever-evolving threat landscape, technology changes, and shifting expectations for security, privacy, and safety.

Proficient security workers thrive in such organizations and rarely leave. With a strong plan and capable team in place, leaders can effectively communicate and advocate across the organization. If all of these elements land in place, with the proper support, even an inexperienced security leader can have a chance at success.

Unfortunately, it rarely happens.

Failure is Expensive

Cybersecurity is difficult. It becomes exponentially more problematic when someone who lacks the necessary mentality or skills comes in and makes it profoundly worse. Cleaning up an ineffective legacy security program is painful, expensive, and time consuming. Simultaneously, a poor risk posture opens the door to more attacks and greater impacts until a capable security program is instituted.

We must understand that cybersecurity, like many other highly specialized roles, requires a depth of insight and experience to lead. I will echo Sun Tzu’s “…do what is great while it is small” and recommend putting a good leader in place the first time to build an effective and sustainable cybersecurity organization.

Let’s all break the silence and openly discuss the cycle of poor cybersecurity leadership, for everyone’s benefit.

For more insights on the challenges and required strategic deliverables, read my post Cybersecurity Fails Without Strategy.

Interested in more insights, rants, industry news and experiences? Follow me on Steemit and LinkedIn for insights and what is going on in cybersecurity.

Read the article as originally published here.

Matthew Rosenquist is a member of the Brandeis GPS Information Security Leadership advisory board. He is a Cybersecurity Strategist for Intel Corp and benefits from 28 years in the field of security. He specializes in strategy, measuring value, and developing cost effective capabilities and organizations which deliver optimal levels of security. Matthew helped with the formation of the Intel Security Group, an industry leading organization bringing together security across hardware, firmware, software and services. An outspoken advocate of cybersecurity, he strives to advance the industry and his guidance can be heard at conferences, and found in whitepapers, articles, and blogs.

Faces of GPS is an occasional series that profiles Brandeis University Graduate Professional Studies students, faculty and staff. Find more Faces of GPS stories here.

Brandeis Innovation Showcase 2018

Discover the innovative ways the Brandeis community is changing the world at the Brandeis Innovation Showcase on Thursday, November 15. Held as part of Global Entrepreneurship Week, the Showcase will include presentations and a reception featuring startups, inventions, social entrepreneurship, and scientific discoveries born out of the labs and classrooms at Brandeis University.

View of Innovation Showcase 2017Participants can network with the researchers, students, faculty and staff who are impacting business, sciences, technology and social sectors. Some of Boston’s leading innovation organizations will have booths that provide more information about their work.

Attendees will have the opportunity to join the entrepreneurial action and vote for a crowd favorite by “investing” in projects. They will experience the Brandeisian innovative spirit while networking with Boston’s innovation community.

Get your tickets for the event here and make sure to use the hashtags #DeisInno18 and #BrandeisInnovates on social media so we can follow along.

Graduate School Admissions FAQ

Applying to graduate school when you’re working full time can seem like a daunting task, but many universities are leveraging the latest edtech to make the application process run as smoothly as possible.

At Brandeis GPS, our online application allows prospective students to upload resumes, statements of goals and other key admissions elements directly to our  online system.  One item that does need to be submitted externally is your official transcript, which we encourage you to submit electronically.

Please see below for some FAQs our admissions team often receives about the application process.

Do you require the GMAT or GRE?

No! If you decide to apply to GPS, do not worry about these exams: we do not require them for admission. We don’t feel like they speak to the nature of what is required to excel in our programs.

Does Brandeis GPS accept electronic transcripts?

Yes, we do accept electronic transcripts as long as they are official. This is the easiest and fastest method for both the applicant and us.

How should I send electronic transcripts?

Provide your school(s) with our email address: gps@brandeis.edu. We’ll confirm with you once the documents are received.

What address should I use for paper transcripts?

These should be sent directly from the school(s) to our mailing address:

                  Brandeis University                

                  Graduate Professional Studies

                  415 South Street, MS 084

                  Waltham, MA 02453-2728

We’ll let you know when we receive them.

Do I need to submit transcripts if I transferred courses?

Yes, we require official transcripts for all colleges/universities attended.

What if my program of interest is not related to what I studied in undergrad?

While some applicants may have studied an undergraduate major relevant to their desired graduate program, many have not. Make sure to highlight your professional skills, certifications and expertise in your application. You’ll be able to do this through your resume and statement of goals. (Please note that some programs may have specific requirements, which you can see by clicking on your program of interest here.)

How can I check the status of my application items?

At any time, you can login to your applicant status page once your application is submitted to see what items are pending: Login

<<Start your GPS application>>

Please feel free to contact our enrollment team any time. We understand the commitment it takes to apply for a master’s degree, and we’re happy to walk you through the steps and answer any questions that you have.

How to create a digital culture at your workplace

The Enterpriser’s Project defines digital transformation as the integration of digital technology into all areas of a business, fundamentally changing how you operate and deliver value to customers.

In a world where technology is advancing at a rapid pace, digital transformation should be a required strategy for any organization. To be successful, workplaces must build a digital culture where employees embrace new technologies.

4 Steps for Building a Digital Culture

1. Be upfront about the digital transformation your workplace is undertaking 

Be sure to provide a clear message to employees about what is coming down the pike. Address the key components of what digital transformation is and keep employees informed on what changes they’ll see, what the impact will be, and the likely timeline.

2. Engage employees in forums for discussing  new technologies

Employees should be included in the digital transformation process by having an opportunity to discuss/debate advantages and possible disadvantages of new technologies. They should have a forum to ask questions about new tools and platforms and the most recent technologies such as AI and machine learning, and also feel empowered to share concerns and discuss ways to mitigate risks related to any upcoming transitions.

Graph displaying digital readiness

Image Source: https://infocus.dellemc.com/tim_wright/why-the-workforce-needs-to-change-for-digital-transformation/

3. Make expectations for digital transformation clear

Once there is a timeline in place for your company’s digital transformation, management should be clear with employees about what that is and make sure they are adjusting as necessary. Provide structured goals for employees and monitor individuals’ progress.

4. Promote digital readiness by pursuing professional development in tech-rich fields 

After explaining the digital transformation occurring in your workplace, employees will need to keep up-to-date with their technical knowledge. It may be beneficial to employees to take courses or undergo trainings for professional development.

Brandeis GPS provides online Master’s degrees in tech-rich fields including Strategic Analytics, Digital Marketing and Design, Digital Innovation for FinTech, Robotic Software Engineering, and more. At GPS, you can take up to two courses for professional development before enrolling in one of our 12 online Master’s programs.

Brandeis GPS also works with employers through corporate partnerships, providing tuition scholarships and/or training and continual conversation around educational support for companies.

For more information about our 12 online Master’s degree programs or to learn more about taking courses for professional development, contact gps@brandeis.edu, call 781-736-8787 or visit www.brandeis.edu/gps

Information Security Leadership at Brandeis GPS

With rising technology usage, there has been an inevitable rise in cybersecurity threats and an increased  demand for information security professionals. There is a growing responsibility to protect information as cybersecurity risks can be catastrophic for companies, customers, and careers.

With a Brandeis GPS Master’s in Information Security Leadership, you earn the confidence to attack any cybersecurity situation with leadership and technical savvy.

Brandeis University is ranked #35 among national universities by U.S. News and World Report, so you will have earned a master’s from one of the top universities in the country to lead you through any cybersecurity challenge, and to influence decisions for risk prevention.

Our cutting-edge, industry relevant, 100% online curriculum for professionals will build your leadership abilities and skills in leveraging technical know-how. Since you will learn alongside cybersecurity leaders from many industries in small seminar-style classes with no more than 12 students, your exposure to cybersecurity threats of all kinds will be significantly expanded.

The program will equip you to:

  • Develop a business case for investing in cybersecurity and risk management
  • Inform and influence senior executives to commit to obtaining and maintaining this investment
  • Oversee the planning, acquisition and evolution of secure infrastructures
  • Assess the impact of security policies and regulatory requirements on complex systems and organizational objectives

The 30-credit part-time, online program has six required courses and four electives.

The required courses are Foundations of Information Security, Information Security Management, Principles of Computer Incident Response and Investigation, Principles of Risk Management in Information Security, Information Security and Compliance, and Leading Security in Complex Organizations.

Options for electives include Identity Management and Access Control, Cloud Security, Secure Mobile Applications and Data, Network Security, and Managing Change and Innovation. View all courses offered in Information Security Leadership here.

Those applying to the Information Security Leadership program should have an undergraduate degree with work experience and/or coursework in introduction to networking, introduction to computer science and introduction to computer security.

We hope you enjoyed our cybersecurity series as part of National Cyber Awareness Month.

Brandeis GPS offers a Master’s of Science in Information Security Leadership. The part-time, fully online program prepares graduates for leadership roles in information security with a cutting-edge, industry relevant curriculum that builds leadership savvy and skill in leveraging technical know-how. For more information, contact gps@brandeis.edu, call 781-736-8787 or visit www.brandeis.edu/gps

Governance and the case for bringing cybersecurity out of IT

By Joseph Dalessandro

October is National Cyber Awareness Month, and we’ll be spotlighting cybersecurity content on the blog all month long.

Information security governance is perhaps the most challenging aspect of cybersecurity.

Governance, while not a four-letter word, is often discussed with the same grumble that one uses when speaking about the dentist or aged fish. The basics of governance revolves around the advancement that simple accountability and transparency deters calamity. One cannot predict and avoid all disasters — think volcano here — but at the same time, one cannot grade one’s own homework.

It works well until there is a real test and someone else has the red pen. I think it was the queen of corporate governance, Nell Minow, who said, “watched boards change.” I agree, and would say this observation can be applied all the way down the corporate chain into an organization: those that change are the ones who are watched as objectively as possible.

So what does this have to do with cybersecurity, and why is governance hard in the cybersecurity space? There are a number of reasons for this perception. First, boards have been bamboozled by jargon and an IT executive tier that has been unclear and unsure of what and how to report on security. (For those of you on boards, when was the last time you had a security executive discuss the direct link between spend and the measured reduction of risk?). Indeed, in a Bay Dynamics/Osterman Research survey, “the majority (85%) of board members
believe that IT
and security executives need to improve the way they report to the board.”

While I am not a fan of standards for standards’ sake, the ISO/IEC 38500:2008 Corporate governance of information technology has the following useful definitions:

  • Corporate governance: The system by which organizations are directed and controlled.
  • Corporate governance of IT: The system by which the current and future use of IT is directed and controlled. Corporate governance of IT involves evaluating and directing the use of IT to support the organization and monitoring this use to achieve plans. It includes the strategy and policies for using IT within an organization.
  • Management: The system of controls and processes required to achieve the strategic objectives set by the organization’s governing body. Management is subject to the policy guidance and monitoring set through corporate governance.

Security leaders should tack these definitions to their wall.

When it comes to how security leaders can set the right direction for the board and make sure the Board has the right information for strategic oversight, I think it is a “two-way street.” Boards need to come to the security business and ask questions and security leaders need to come to the Board with improved reporting. Perhaps an improvement would be an approach that keeps the security report separate and distinct from that of technology. For organizations where information security, or cybersecurity, does not report to IT— bravo! You have taken a step toward greater transparency. The inherent mission of IT is accessibility and availability and the inherent mission of security is possession (control), protection and integrity. These missions are often in conflict, and managing them under the same leader (often a technology leader), could result in a Head of Security who does not have the chance to challenge or push back against the IT Executive who writes their performance assessment and controls their compensation.

We can better coordinate, manage and govern our complete security capabilities by bringing cybersecurity out of IT and taking a more holistic approach to incorporating physical and facility security, fraud and loss mitigation, and the other components converging security capabilities, data collection, management, and ultimately governance.

An organization’s board and business management must be in alignment where spend and the use of emerging technology are converging for the business. Security leaders should consider the following approach to champion governance:

  1. Above all, be transparent and accountable. Don’t tell the board what they want to hear or what you think they want to hear (they know when they are being managed). Represent the security program objectively. Characterize how security investments support the delivery of value for the business and supports organizational objectives.
  2. Do the hard work to consistently measure, monitor and report on security risk, and to provide the analysis between security investments and the execution to mitigate or manage risk and reduce or limit potential impact.
  3. Share performance and achievements of security resources — these drive the execution of a program and they are where the rubber meets the road for execution of the security program. Just like other business function, people are what drive success for a security program.
  4. Demonstrate how cybersecurity is aligned with and supports the strategic planning and objectives of the business and the expected business outcomes. Often the inherent conflict between the IT mantra of constant access and availability will be in conflict with cybersecurity’s mission of possession, protection and integrity, but the two do not have to be contentious, but IT needs a peer who can hold IT accountable if needed, not a lackey who does what they are told.

Joseph (Joe) Dalessandro is the program chair of the Information Security Leadership program at Brandeis University Graduate Professional Studies, and the Head of Security & Technology Audit and Audit Data Analytics, Australian Unity.

Brandeis GPS offers a Master’s of Science in Information Security Leadership. The part-time, fully online program prepares graduates for leadership roles in information security with a cutting-edge, industry relevant curriculum that builds leadership savvy and skill in leveraging technical know-how. For more information, contact gps@brandeis.edu, call 781-736-8787 or visit www.brandeis.edu/gps.

Faces of GPS: Meet Kathryn Wight – Director of Partnership Engagement

Did you know that Brandeis GPS helps companies develop stronger workforce pipelines?

Kathryn Wight Headshot

As Director of Partnership Engagement, Kathryn works with employers to understand their organizational needs and determine opportunities for Brandeis GPS to help upscale their employees. These corporate partnerships provide tuition scholarships and/or trainings and continual conversation around educational support.

Born and raised in Carlisle, MA, Kathryn received her degree in psychology and criminal justice from North Carolina’s Elon University. Upon graduation, she chose to remain in the south for a while. After spending some time working as a paralegal, she decided not to pursue a law career and made her way to higher education. 

Kathryn spent eight years at The College of William & Mary before her New England homecoming. She first served as the recruitment manager for the school’s undergraduate career center, working with employers to schedule their on-campus visits and planning career fairs. From there, she spent a few years counseling Master of Accounting students and managing employer relations for all master level programs in the Raymond A. Mason School of Business.

In her role at GPS, Kathryn focuses on helping companies envision how an educational partnership with Brandeis can help cultivate a strong employee benefits program. She finds meaning in building personal connections with partners and gaining a better understanding of how GPS programs and courses can help fill the unique needs of each organization she works with.

Kathryn’s favorite part of her job is all the people she gets to meet and learn about companies from startups to large Fortune 500 firms.

Outside the office, Kathryn is a runner who likes to travel and explore different food and wine cultures. She is currently planning a wedding (that is now less than six months away). She is also a dog lover and enjoys spending time with her five-year-old niece. 

Learn more about our corporate partnership options on our website or contact Kathryn Wight at kwight@brandeis.edu or 781-736-8725.

Faces of GPS is an occasional series that profiles Brandeis University Graduate Professional Studies students, faculty and staff. Find more Faces of GPS stories here.

Meet our newest GPS faculty members

The first week of the October session is here and we are excited to introduce the newest Brandeis GPS faculty members. These industry leaders come to Brandeis GPS with expertise and established networks within their fields. We have no doubt that the knowledge and experience they bring will provide for meaningful learning opportunities in the online classroom.

Garrett Gillin – RDMD 110: Principals of Search Engine Marketing

Garret Gillin Headshot

Garrett Gillin, MBA, is a co-founder and Principal at 215 Marketing, a Google Premier Partner agency located in Philadelphia, PA, where he oversees the development and execution of integrated digital marketing initiatives with a concentration on programmatic advertising, marketing automation, and advanced analytics.

Todd Chapin – RUCD 185: Design for Non-screen User Experiences

Todd Chapin HeadshotTodd Chapin is a co-founder and Chief Product Officer at ShopClerk.ai. He has experience in product management and UX, as well as expertise in personal mobility, speech recognition, and e-commerce. He has worked at Zipcar, Audible, and Nuance Communications. He has graduate and undergraduate degrees in Human Factors Engineering from Tufts University.

Ernest Green – RSAN 160: Predictive Analytics

Ernest Green Headshot

Ernest Green MS, MBA, PMP, is Vice President of Data Mining at a large financial institution in Dallas, TX. Prior to this role, he worked as a Data Scientist with General Motors and has 10+ years of diverse analytics experience. He holds multiple college degrees and most recently completed a Master’s in Predictive Analytics from Northwestern University. His research and expertise are in analytics, machine learning, natural language processing and artificial intelligence.

We are so pleased to welcome these new faculty members to Brandeis GPS and look forward to seeing how they bring their expertise to their online classrooms.

Faces of GPS is an occasional series that profiles Brandeis University Graduate Professional Studies students, faculty and staff. Find more Faces of GPS stories here.

How to recruit and manage the best cybersecurity candidates

By Joseph Dalessandro

October is National Cyber Awareness Month, and we’ll be spotlighting cybersecurity content on the blog all month long.

People management is one of the hardest and most rewarding experiences of one’s working life. With the advent of the “gig” economy, I am curious how we are faring in hiring in the cybersecurity space.

Cybersecurity hiring has been universally difficult for some time. It’s not that there is a lack of quality candidates. The issue is that we are missing each other. This is due in large part to the “traditional” hiring approach that many mangers adopt when they have open roles. They head to HR, or pick up the phone and call HR, and ask HR to find them candidates.

This happened to an acquaintance of mine not too long ago. He was looking for a junior information security analyst: a basic role that requires entry-level experience. He received more than 600 resumes, and realized that solid candidates were getting lost in a sea of unqualified applicants who know security is hot and want in.

If you are a manager in security, it’s time to change your hiring paradigm. To find a better applicant pool, cast your net more efficiently and do the following immediately:

  1. Use your network. Get into your network and spend some time talking to your peers.  Learn how to recruit and get out and start recruiting. If you have people in your network that would be perfect, call them. If they do not want to move, find out if they have contacts looking for work.  Ask your peers where they are finding hires. Share information on candidates, someone who is not a good team fit for you may be a good team fit for a peer of yours.
  2. Set the expectation up front in postings that you are different and you are serious. Include information in job postings that candidates will be tested on role skills during the first interview. Those without skills and basic security knowledge immediately fall out. This works well for junior roles. For more senior roles, make it known up front that for technicians they will need to demonstrate skills and for managers, they will need to discuss culture, training and retention.
  3. Make candidates provide a cover letter or cover email that explains how their experience aligns to the role, or provide them a platform to do this in a structured way. This will, once again, weed out those who do not align with the expectations of the role. If I need to describe in a table how my experience and skills relate directly to the role skills, I know that the manager is serious and is looking for the right candidate, and not just “looking” for candidates. Demand that candidates communicate, and get them together to be interviewed by other managers, from other non-IT departments, to interview them more objectively.
  4. Look for skills and education that shows the candidate is more than a CISSP. CISSP’s are everywhere, but show me a CISSP with a master’s degree who can write a business case or executive memo and I’ll scoop them up.

Once you build a team, you need to cultivate it. You want to develop your employees, and yes, eventually you want them to move on, to be successful in another department or another company. However, at the outset, for all your hires, you want to retain them, develop them and let them thrive.  This will also pay when you need to hire. Some of those employees will develop into their next role with you, and if you know those employees and what they want and where they want their career to go, you can help. Do a better job of knowing your current employees and how you can develop them for that next role. Look at your team for diversity, and for diversity of thought, and make sure you employ some contrarians. Diversity in thought is especially important in cybersecurity. A diverse team will be a high performing team. For roles where you have great staff but they are taking leave or need a different structure to their job, consider altering your approach and preconceptions about the traditional working day or the traditional working role rather than replacing those employees.

There are candidates for roles, but they need to be discovered. If you’re looking for a position, differentiate yourself from the masses. Why do I want to hire you? Stop memorizing port numbers and show me you know what P&L is and that you understand budgeting, or, develop your presentation skills, or, develop data analysis or data visualization skills. Or, better yet, get a master’s in security leadership and I’ll know you can handle the role.

Joseph (Joe) Dalessandro is the program chair of the Information Security Leadership program at Brandeis University Graduate Professional Studies, and the Head of Security & Technology Audit and Audit Data Analytics, Australian Unity.

Brandeis GPS offers a Master’s of Science in Information Security Leadership. The part-time, fully online program prepares graduates for leadership roles in information security with a cutting-edge, industry relevant curriculum that builds leadership savvy and skill in leveraging technical know-how. For more information, contact gps@brandeis.edu, call 781-736-8787 or visit www.brandeis.edu/gps

Image sources:

https://www.cyberdb.co/wp-content/uploads/2017/11/LinkedIn-cybersecurity.jpg

https://image-store.slidesharecdn.com/be4eaf1a-eea6-4b97-b36e-b62dfc8dcbae-original.jpeg

Older posts

Protected by Akismet
Blog with WordPress

Welcome Guest | Login (Brandeis Members Only)