Csdrhrt

On the information security team at my company where I currently work, we have several critical / urgent roles we are looking to fill, amongst including a senior security architect, several senior security engineers, and several cybersecurity intelligence analysts.

We are having trouble with the local candidates so I am thinking of discussing with my manager the possibility of traveling to several cybersecurity conferences coming up across the country (example and example)to market our company and hopefully broaden the applicant pool. As a bonus, all team members have certifications that require continuing professional education credits (CPE) to maintain, so it seems such idea is valuable. We also have surplus budget for travel and training.

However, our team has never attempted to hire through industry events, and all previous roles have been filled through the traditional office interview. I am not sure how many attendees would have their resume ready or be in the interview state of mind. Therefore my questions are:

• Although networking opportunities are mentioned, are overt attempts to hire appropriate at these kind of events?




• From experience, are candidate quality different than say if candidates apply themselves the traditional method - through company posting or recruiting firm




• Given the different and assuming more informal environment, should interview technique be changed, and if so what strategy is preferable?

I'm sure there are several people at every one of those events that are looking for jobs.

If you stopped every random person and just start interviewing them, that would obviously be too much. Here are my suggestions.

• Bring lots of business cards. Make sure they have your contact information, company web site, and job title that implies hiring authority.




• Sign up for talks that are relevant for the position you are hiring for.




• Think of a good comment or question for the speaker. This will increase your visibility, and people might later approach and want to talk about that.




• In your questions, casually mention where you work.




• Pay attention to what other people are asking, and later start a conversation with them about their question.




• When waiting in lines, start casual conversations with people around you.




• If you casually ask people about their work, and listen to them, they will probably enjoy talking about themselves.




• When talking to someone, do more listening than talking.




• If a conversation is going well, you can briefly mention you are hiring, but not go into details, unless the person asks about.




• If they express an interest, tell them you can interview at the event, and ask them when would be a good time. Exchange business cards and contact information.




• Unless it's mutually agreed it's an interview, keep conversations light and casual.

Although networking opportunities are mentioned, are overt attempts to hire appropriate at these kind of events?

I think a Hackathon type event is better suited to what you're describing. You're in a controlled environment, able to see how people perform, and you can ask if they want a job. If not, at least a good PR event for others to see your company.

In a trade show/conference/summit type event, people are there to learn. Meaning they're most likely paid or sponsored by their company to come to the event. In one example event you gave, it costs $1,000 to attend, and on top of that attendees have to travel there. That's no pocket change for anyone to just spend $1,000+travel, be jobless, and expect to get hired at these events. Then you have to question if they do have a job, and you "steal" them, how easily is it for them to hop jobs or why your company is better than theirs? They basically made their employer pay for their interview by going to you to interview, and get hired. Not exactly a great trait to show off that you're willing to spend employer's money to get a better job.

Penetration Tester here. It depends on which events you are turning up to.

The more corporate events (e.g: Infosec) are more focused on selling products than actually talking shop, so to speak. These will be filled either with people that have jobs or people who are looking to sell their product.

The ones with talks that get into the nitty-gritty (e.g: B-sides) are the ones where you might want to go to, but don't just ask for CVs.

Set up a stall and some attack-simulation environments. Have some participants on some Kali boxes and task them to break into the target, and other participants looking at an instance of whatever SOC program you use, trying to discover and block out the attack.

If you want to tell which events are which, just look up their videos of past talks on YouTube. The ones you want will go into at least some sort of technical details.

Although networking opportunities are mentioned, are overt attempts to
hire appropriate at these kind of events?

Attendees might (most likely) find that off-putting. These events aren't typically seen as events at which to hire or get hired.

From experience, are candidate quality different than say if
candidates apply themselves the traditional method - through company
posting or recruiting firm

Well... You probably stand just as good a chance of finding good candidates there as you would in a traditional interview and hiring process. I don't see why the quality of candidates would be any different. These are very specifically targeted industry events. I wouldn't think you'd get a bunch of unqualified, uninterested "randos" at these events.