Filling cybersecurity jobs can be incredibly complicated. MSPs face a well-documented talent shortage, making it crucial to hire the right people and keep them engaged.
According to Scott Barlow, vice chair, board of directors for the Global Technology Industry Association (GTIA), “Attempting to manage cybersecurity without the help of on-demand experts simply isn’t a viable option. The challenges are far too great and the risks are even greater.”
Here is some bite-sized advice for MSPs seeking to fill key security positions and retain the best talent.
How to Fill Cybersecurity Jobs
- Prioritize real-world security expertise over formal degrees. When reviewing resumes, focus on hands-on experience with real threats—candidates with a history of incident response, penetration testing, or malware analysis are more valuable than those with just theoretical knowledge.
- Look for deep technical skills in areas like network security rather than insisting on specific academic credentials. Create your own capture-the-flag (CTF) challenge to gauge an applicant’s problem-solving skills in live environments.
- Evaluate soft skills. Communicators, team players, and problem-solvers excel in cybersecurity roles. During interviews, use scenario-based questions like: “How would you explain a zero-day vulnerability to a non-technical executive?” or “Describe a time you had to collaborate under pressure to resolve a security incident.”
- Consider non-traditional applicants to widen your talent pool. Interns can contribute to cybersecurity-related projects without adding major cost. Veterans often bring a disciplined, mission-oriented approach to security work. Career changers from IT support or software development can bring a valuable outside perspective and diverse skillset while coming up to speed quickly.
Investing in Professional Development
- Continuously develop your team’s skillset: An MSP staff armed with up-to-date skills and certifications will be more confident and loyal to your business. Consider reimbursing employees for training costs to encourage continued growth.
- Celebrate Achievements: Recognize when employees achieve sought-after certifications like CISSP for broad security management knowledge, cloud security (e.g. CCSP), and ethical hacking credentials (CEH, etc.) A public shoutout in a team meeting or a LinkedIn endorsement can also go a long way in showing appreciation.
Retaining Great Employees with a Winning Culture
- “Create a culture of recognition. We want to be able to recognize our people often and in a timely fashion because it’s important. And people want to be recognized. They don’t just want to collect the paycheck every two weeks. They want people to know that other people recognize that they do a good job,” said Joe Cicirelli, vice president, managed services, Ntiva Inc.
- Define clear promotion criteria so cybersecurity analysts see a future at your company. Provide mentorship so that employees get the support they need to grow.
- Tie raises and bonuses to skill development. Implement a structured review process where employees who complete critical security training or demonstrate leadership are eligible for bonuses. Long-term retention incentives like increased PTO can help prevent poaching by competitors.
- Overworked employees are more likely to leave. Avoid burnout by tracking utilization and balancing workloads. Use time-tracking tools to monitor workload and prevent overloading top performers. Rotate on-call responsibilities fairly and encourage time off to maintain work-life balance.
Next Steps
Filling cybersecurity job roles isn’t just about hiring the most qualified person—it’s about finding individuals who can grow with your business and keeping them engaged long-term. MSPs face a major challenge in recruiting and retaining security talent, but by focusing on real-world expertise, investing in continuous development, and fostering a strong company culture, you can build a team that stays ahead of evolving threats.
Images: iStock
