Working in the cybersecurity world is like running a ruthless marathon—slow and steady is more likely to win the race than a quick sprint that leads to burnout. Cybersecurity is not an exact science; it is part art, part science and part intuition that is akin to having a sixth sense. The evaluation and recruitment of talent and the rollout and optimization of cybersecurity technologies are long-haul efforts that require focus, commitment and persistence. Today, dedication and persistence are required to ensure end-to-end visibility across an organization’s entire threat landscape for earliest detection and response. Like preparing for a marathon, working effectively in cybersecurity takes careful planning and training for the uphill battles and roadblocks along the way.
There is no evidence that cyberattacks are slowing down. Technology solutions such as artificial intelligence (AI) and machine learning (ML) are helping to combat predictable malicious behaviors and activities. Yet at the same time, attacks are becoming more sophisticated, frequent and destructive; cyberattacks resulted in an estimated US$6 trillion in associated damages in 2022.1
Meanwhile, cybersecurity teams continue to struggle with hiring and retention. According to the fifth annual ISC2 Cybersecurity Workforce Study, the global cybersecurity workforce comprises 4.7 million people—the highest ever recorded—however, the gap of experienced cybersecurity professionals needed to adequately protect enterprises worldwide is 3.4 million, a number that has grown significantly.2
The combined problem of a dire staffing shortage and growing cyberthreats cannot be solved with technology alone. In fact, with a market flooded with security solutions, many organizations are building programs that simply comprise too much technology, making the problem worse. The reality is, the more complex a technology stack, the more blind spots it may have. The goal should be to enable as much pervasive visibility and early detection and response capabilities as far to the left of the cyber-kill chain as possible using the optimum amount of technology.
The answer is twofold: simplicity when it comes to the technology stack and finding the right balance between people, process, technology and continuous innovative security optimization and development.
Traditionally, the industry has focused first on using technology and processes to protect enterprise networks and their users. However, it is important to increase the focus on cybersecurity teams that are more shorthanded than ever with monumental task lists that only keep growing. Any chief information security officer (CISO) will support the observation that when a security program is put under duress during a breach, it is the responsibility of the cybersecurity team to pull through to the other side to recover and maintain business resilience. To add to the challenges, ISACA’s State of Cybersecurity 2023 report states that soft skills such as communication, flexibility and leadership have been identified as the largest skill gap in today’s cybersecurity professionals.3
As challenges abound in hiring and retaining cybersecurity talent, an approach that prioritizes emotional intelligence (EI), also known as emotional quotient (EQ), over technology skills can help organizations identify the right talent for the right job and thus gain better visibility into their threat landscape.
EQ Over Technology
Recommendations for prioritizing EQ over technology include:
- Identify human skills—Communication between security teams and the rest of the organization can help address risk more effectively. People with high EQ—possessing qualities such as empathy, flexibility, stress tolerance and active listening—communicate and connect with others more effectively, leading to better job performance. Having team members who use these human skills can go a long way toward developing positive interactions with the wider organization. Bring on team members with human skills that are already ingrained.
- Do not focus solely on technology skills—How a person thinks about approaching challenges and problems and navigates through conflict can be more effective than their technical expertise. For example, a person with experience in identity access management can be hired to fill a vulnerability management and threat intelligence position based on their human skills toolkit. Technical skills can be learned in many cases, but critical thinking skills come at a premium.
- Diversify the team—Research on organizational culture has shown that when employees are treated fairly—regardless of race, gender, sexual orientation or age—they are nearly 10 times more likely to look forward to going to work.4 However, diversity is not just about equitable representation of people. Those with diverse cultural backgrounds also bring diverse and new ideas, efficiencies and perspectives, creating better solutions and results. A person’s ability to approach challenges and apply critical thinking in new ways can often be more valuable than their technical knowledge.
- Connect face to face—These days, many people work remotely. Video allows for personal connections, so 15-minute team standups that support consistent communications as a group or one-on-one can be helpful. These meetings can be time consuming, but they are also critical to keeping teams on task and maintaining job satisfaction.
- Utilize broader organizational culture—One of the best secrets to keeping valuable team members content is to tap into the organization’s broader culture—whatever that may be. Many organizations have a comprehensive set of corporate and governance practices that focus on community, including volunteer work, philanthropic initiatives and sustainability efforts. It may be valuable to encourage team members to get involved.
Measuring and Coaching EQ
Measuring EQ can provide valuable insights into a team’s dynamics, communications and overall effectiveness. There are many assessment tools for this, including:
- Wong’s Emotional Intelligence Scale (WEIS)—Using WEIS can help identify individual and collective strengths and weaknesses in EI within the team. This information can be helpful to guide targeted training and development efforts.5
- Emotional and Social Competence Inventory (ESCI)—The results of the ESCI can help identify specific areas where team members may have competency gaps related to emotional and social intelligence. Closing these gaps can improve team dynamics.6
- Mayer-Salovey-Caruso Emotional Intelligence Test (MSCEIT)—Applying MSCEIT results can help to identify potential leaders within the cybersecurity team. In addition, the results can be used to develop EI competencies in current and future leaders.7
- The Trait Emotional Intelligence Questionnaire (TEIQue)—TEIQue insights can be used to facilitate more effective conflict resolution within the team. Team members can better comprehend their own and others’ emotional traits, leading to more constructive conflict resolution.8
- Profile of Emotional Competence (PEC)—Team members who score high in certain areas based on the PEC can be paired with those who need improvement. Mentoring programs where experiences and strategies for building better relationships within the team can be helpful.9
- The Emotional Quotient Inventory 2.0 (EQ-i-2.0)—This tool can be used as part of the interview process, particularly for leaders and resources that need to collaborate cross-functionally. It is particularly useful for identifying a candidate’s ability to build relationships, communicate effectively and resolve conflicts.10
Whatever methods the organization chooses, identifying and understanding the emotions of employees helps to build trust and rapport while motivating and inspiring team members to perform well, be productive and more effectively protect the organization from cyberattacks.
Coaching for EQ involves helping individuals develop and improve their ability to recognize, understand and manage emotions, both in themselves and others. To unlock the full potential of EQ, there are six main areas to focus on:
- Boosting motivation
- Having empathy
- Maintaining a positive attitude
- Asking for feedback
- Using active listening skills
- Being self-aware
Specifically, when coaching on human skills and grooming talent for success, a key priority is bringing one’s human side to work. It is important to put biases and assumptions aside when interacting with others and to respect their points of view. It is also important to focus on the person, not the personality, and to avoid taking anything personally.
Trust can be built by always creating psychological safety throughout the team and understanding there can be a difference between what is said and what is heard. In addition, implementing a culture of gratitude goes a long way toward creating motivated, highly effective teams.
Conclusion
The long-haul job of protecting enterprise networks from growing cybersecurity threats, together with the job of finding, hiring and retaining cybersecurity professionals, is an endurance sport. It is essential for leaders to coach and instill EQ as a tool to build a mindset that values endurance. Building and optimizing teams is difficult, yet it can be highly gratifying to see careers develop and thrive. There is great fulfilment in building high-functioning teams comprised of people who love their jobs. In a profession in dire need of people, it is essential to put team building first.
Endnotes
1 Vojinovic, I.; “More Than 70 Cybercrime Statistics—A $6 Trillion Problem,” DataProt, 14 July 2023, http://dataprot.net/statistics/cybercrime-statistics/
2 ICS2 Cybersecurity Workforce Study, USA, 2022, http://www.isc2.org/research
3 ISACA, State of Cybersecurity 2023, USA, October 2023, http://xhrj.yutb.net/state-of-cybersecurity-2023
4 Bush, M.; “Why Is Diversity and Inclusion in the Workplace Important?” Great Place To Work, 13 April 2021, http://www.greatplacetowork.com/resources/blog/why-is-diversity-inclusion-in-the-workplace-important
5 Consortium for Research on Emotional Intelligence in Organizations, “Wong’s Emotional Intelligence Scale (WEIS),” http://www.eiconsortium.org/measures/weis.html
6 Consortium for Research on Emotional Intelligence in Organizations, “Emotional and Social Competence Inventory (ESCI),” http://www.eiconsortium.org/measures/eci_360.html
7 Brackett, M. A.; P. Salovey; “Measuring Emotional Intelligence With the Mayer-Salovery-Caruso Emotional Intelligence Test (MSCEIT),” Psicothema, 2006, p. 34-41, http://psycnet.apa.org/record/2006-12699-005
8 Petrides, K. V.; N. Frederickson; A. Furnham; “Trait Emotional Intelligence Questionnaire 144,” (TEIQue) [Database record], APA PsycTests, 2004, http://doi.org/10.1037/t12409-000
9 Mikolajczak, M.; S. Brasseur; C. Fantini-Hauwel; “Measuring Intrapersonal and Interpersonal EQ: The Short Profile of Emotional Competence (S-PEC),” Personality and Individual Differences, vol. 65, July 2014, http://doi.org/10.1016/j.paid.2014.01.023
10 Calm Worldwide, “Emotional Quotient-Inventory 2.0,” http://calmworldwide.org/eqi-2-0/
CHRISTINE WHICHARD
Is global chief information security officer and senior vice president (SVP) of enterprise technology/systems at SmartBear. With a balance of business and technical experience, her record of accomplishments spans more than 20 years. Previously, Whichard was SVP of client engagement and operations at Videology (now part of Amobee). She was also senior director of the technology solutions group at Merkle, a global performance marketing enterprise with nearly 16,000 employees and more than 50 locations. She has held various roles in data analytics for Advertising.com and Medstar Health, among others. She is a member of ISACA.