--- title: "How to Upskill Cybersecurity Job Candidates to Transform…" description: "Tired of cybersecurity staff shortages? Learn why traditional hiring fails and discover how upskilling and skills-based approaches can transform your…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "How to Upskill Cybersecurity Job Candidates to Transform Them Into High-Performers and Excellent…", "description": "Tired of cybersecurity staff shortages? Learn why traditional hiring fails and discover how upskilling and skills-based approaches can transform your…", "image": "https://christianespinosa.com/__l5e/assets-v1/3e281a92-b05a-4497-a196-73d698d54748/how-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators-card.png", "datePublished": "2023-09-17T19:09:14+00:00", "dateModified": "2026-06-26T05:35:18.705Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/how-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"How to Upskill Cybersecurity Job Candidates to Transform Them Into High-Performers and Excellent Communicators - Christian Espinosa\"?", "acceptedAnswer": { "@type": "Answer", "text": "The cybersecurity workforce landscape is at a serious threat level. What you can do to ensure your data and networks remain under protection is to focus back on skills-based hiring." } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, leaders, founders, and anyone running a team who is tired of the sanitized version of leadership advice. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Leadership](/blog/category/leadership) # How to Upskill Cybersecurity Job Candidates to Transform Them Into High-Performers and Excellent Communicators September 17, 2023 8 min read 1,764 words I see the cybersecurity workforce landscape. It's at a serious threat level. Millions of jobs are unfilled, and most companies tell me they can’t find qualified cybersecurity job candidates. If we keep going like this, risks will rise and jeopardize data and networks for thousands of businesses. ![](/__l5e/assets-v1/4459de7b-7765-4dba-a89d-2fb813ebc104/how-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators-hero.webp) The takeaways 1. 01 Millions of jobs are unfilled, and most companies tell me they can’t find qualified cybersecurity job candidates. What to do next Have one direct conversation about millions with the person on your team who most needs to hear it. 2. 02 If we keep going like this, risks will rise and jeopardize data and networks for thousands of businesses. What to do next Have one direct conversation about risks with the person on your team who most needs to hear it. 3. 03 As an industry, we have to change how we hire, recruit, and develop cybersecurity talent. What to do next Have one direct conversation about hire with the person on your team who most needs to hear it. 4. 04 Expanding how I consider someone qualified is a necessary step. What to do next Write down the last three decisions you made about expanding and mark which ones you would repeat. I see the cybersecurity workforce landscape. It's at a serious threat level. Millions of jobs are unfilled, and most companies tell me they can’t find qualified cybersecurity job candidates. If we keep going like this, risks will rise and jeopardize data and networks for thousands of businesses. As an industry, we have to change how we hire, recruit, and develop cybersecurity talent. [Expanding how I consider someone qualified](https://christianespinosa.com/blog/how-to-recruit-and-hire-cybersecurity-professionals-to-help-you-win-the-cybersecurity-war/) is a necessary step. Seeing the potential in someone who doesn’t necessarily check all the boxes is one way I address the shortage. For this to work long-term, upskilling must be a part of my employee development strategy. This upskilling includes hard and soft skills because cyber job candidates need both to thrive. Let’s review the current cybersecurity workforce challenges, the facts about the skills gap, and how I upskill new hires. ## Cybersecurity Workforce Challenges Cybersecurity job growth is a bright spot in the tech industry, with many opportunities for someone to have a career that pays a good wage and is in demand. However, the field is currently experiencing significant shortages. According to the (ISC)2 2022 Cybersecurity Workforce Study, the global cybersecurity workforce grew to over 4.6 million, which is an 11.1% year-over-year increase. Unfortunately, 3.4 million jobs remain empty. As a result, many companies and cyber firms are operating without enough people, which can directly impact risk. So, why is the industry struggling with recruitment and retention? It’s a complicated ecosystem, so there’s no easy answer. The cybersecurity workforce shortage is the result of several trends and occurrences, including: - The cyber threat landscape is rapidly expanding, driving the demand for cyber professionals in all industries and businesses. In part, this is a supply and demand issue. - People leave the industry due to [burnout](https://christianespinosa.com/blog/burnout-in-cybersecurity-can-you-prevent-it/). It’s a common problem in a high-stress environment, and most organizations aren’t doing enough to mitigate this. Without proper staffing, people have to do more work, which increases the feeling of burnout. - Younger generations aren’t choosing cybersecurity as a career. Only [12% of the cybersecurity workforce is 34 or younger](https://www.isaca.org/state-of-cybersecurity-2022). The industry needs to find ways to connect with students to attract new people into the field. - Many organizations place too much emphasis on degrees and certifications, which often don’t correlate to having the right abilities, aptitudes, and attitudes. As a result, companies reject those who could be a better fit but need some upskilling. If the industry remains on this path, the shortages will only worsen. Intervention is necessary for the entire community. What you can do to ensure your data and networks remain under protection is to focus back on [skills-based hiring](https://christianespinosa.com/blog/how-to-recruit-and-hire-cybersecurity-professionals-to-help-you-win-the-cybersecurity-war/). ## The Cybersecurity Skills Gap We can’t talk about the labor shortage without addressing the [cybersecurity skills gap](https://christianespinosa.com/blog/is-the-cybersecurity-skills-gap-fact-or-fiction-it-depends-on-the-skills/). It would be great if every cybersecurity job candidate had years of experience and an array of skills. However, cyber leaders agree that a skills gap exists. According to the same workforce study cited above, 55% of hiring managers say applicants don’t meet the criteria of being qualified. The deficit here includes: - Hands-on training and experience - Credentials - Degrees - Recommendations These things don’t always indicate that the person can do the job. The same study also looked at specific skills with gaps, which are the ones that matter in terms of upskilling. The skills in demand and often lacking are: - Soft skills (e.g., communication, leadership, adaptability) - Cloud computing - Security controls (e.g., network, application, endpoint, implementation) - Coding skills - Software development-related topics (e.g., machine code, testing, languages, deployment) - Data-related topics (e.g., characteristics, collection, classification, processing, structure) - Network-related topics (e.g., architecture, networking components) - Pattern analysis - System hardening - Computing devices (e.g., software, hardware, file systems) It’s a mix of soft and hard skills, but the latter was at the top of the list. It’s possible to develop both of these in an individual who has the desire to learn and evolve. Those abilities aren’t always apparent in technical folks. However, if they are willing and have a good foundation to start from, upskilling can be the key to keeping great people long-term and continuously improving. So, what’s the upskilling plan? ## Building an Upskilling Plan for Cybersecurity Job Candidates The first part of the plan should start with a clean slate of qualifications. Define what is imperative and what someone can learn over time. Get to the root of what makes someone a good cyber professional and what attributes they should possess. In upskilling, you’ll have two paths; technical and soft skill development. ### Addressing Technical Upskilling In looking back at the list of skills above, those in the technical category are pretty standard. That’s a good starting point, but you should also consider the future and add training around AI tools and use cases. The curriculum will evolve as the threat landscape does. How will they learn these skills? You need to create a learning environment for employees. This can include hands-on training internally, certification classes that you determine as high-quality, and other resources. Making continuing skill development part of your recruitment and retention strategy can attract people to your company and ensure you keep high-performers. The other part of this is soft skills, and the plan to develop these in technical folks can be more demanding and challenging. ### Improving Soft Skills in Cybersecurity Soft skill development is a path that requires commitment and consistency. It’s about behavior change, and there can be many growing pains. First and foremost, you want to find cybersecurity job candidates who are open to this. Sometimes that might not be obvious until you have a few conversations and try to understand what motivates them and if they can handle flexibility. Transforming anyone into a better communicator and collaborator isn’t easy. With technical folks, it can be harder, as they often have fixed mindsets, see things as black-and-white, and believe they know all the answers. These people could have impressive technical prowess, but these attitudes won’t fit into a healthy culture where everyone is open and transparent. Are they lost causes? No, but again, they must want to change. You can drive this change with guidance from the Secure Methodology™. It’s a seven-step process that I developed because of the soft skill deficiency and recognizing its value in creating and maintaining a strong cybersecurity posture. ## The Secure Methodology: The Framework for Soft Upskilling Here’s a preview of each step and how you can use it to improve the soft skills of technical people: ### Awareness The guide starts with [awareness](https://christianespinosa.com/blog/the-secure-methodology-step-one-awareness/), with the objective of being mindful of the self and others. When this is missing, people don’t see or understand how their behavior affects others. If this is rampant in a culture, conflict and resentment build. With exercises on reflection and perspective, people can get to a state of awareness that improves how they interact with others. ### Mindset [Mindset](https://christianespinosa.com/blog/the-secure-methodology-step-two-mindset/) is crucial in soft skills, and every person on your team needs an open one. A person cannot change without it. Key to this is defining someone’s motivations and why they respond as they do. In this step, the [7 Levels Deep Exercise](https://christianespinosa.com/blog/finding-your-purpose-in-life-understanding-the-7-levels-deep-exercise/) is a good foundation. ### Acknowledgment The third step is [acknowledgment](https://christianespinosa.com/blog/the-secure-methodology-step-three-acknowledgment/). There are several layers to this step. First, it encompasses feedback and its value to cyber professionals. Your staff wants to hear from you about accomplishments and how they are helping the organization. Not all feedback will be positive, and accountability matters, but you should do this in one-on-one conversations. Ensuring that your team feels appreciated and valued will prompt them to adapt with less friction. Second is acknowledging that cybersecurity is difficult and filled with uncertainty. You set the tone of the culture, and if you do this well, your team will follow, enhancing their people skills. ### Communication [Communication](https://christianespinosa.com/blog/the-secure-methodology-step-four-communication/) is the fourth step and the most essential soft skill for anyone. It’s never a bad investment to develop someone’s communication skills. Just be clear on what this means. Being a good communicator and articulate aren’t the same thing. Yes, what we say matters, but most communication isn’t verbal. An excellent communicator is clear, concise, and transparent. They also recognize the needs of the audience and listen to them fully. Assessing candidates based on communication skills can involve prompting them to share real-life stories about how they used it to overcome challenges. Listen for their use of geek speak or overly technical terms. This could be a red flag if they aren’t willing to drop the posturing. ### Monotasking Next is [monotasking](https://christianespinosa.com/blog/the-secure-methodology-step-five-monotasking/); it’s a soft skill you don’t hear much about. Most technical people have been doing the opposite; multitasking. Many believe this is a valuable trait. It is important to be able to juggle priorities, but blocking off specific time to concentrate on one task can make people more productive and eliminate feelings of being in fight-or-flight mode all the time. They will need to act quickly at times and move around priorities, but encouraging monotasking lets people think more critically and problem-solve more effectively. ### Empathy In the Secure Methodology, [cognitive empathy](https://christianespinosa.com/blog/the-secure-methodology-step-six-empathy/) is the sixth step. This type of empathy is the ability to understand another’s feelings and perspectives. It’s crucial to a person’s ability to be a great communicator and collaborator. Much of this relates to stripping down egos and dynamics of “me vs. Them.” You can’t have a successful cybersecurity strategy and team without empathy. Human connection is vital in cybersecurity, and in this phase, you support people to become more empathetic. ### Kaizen The last step is kaizen. It’s a Japanese term meaning “continuous improvement.” It’s the step that never ends and focuses on adaptability and flexibility. When you reach this phase, your staff should be in a state where they want to continue to develop their soft skills and transfer them to others. ## Upskill Cybersecurity Job Candidates with the Secure Methodology The Secure Methodology provides a framework and tools to transform candidates lacking skills. It’s a proven way to change behavior, with benefits for the person and the organization. Get more insights on each step by reading my book, [_The Smartest Person in the Room_](https://christianespinosa.com/books/the-smartest-person-in-the-room/). You can also explore how to apply it in the [Secure Methodology course](https://programs.christianespinosa.com/the-secure-methodology). Frequently asked ### What is the core idea behind "How to Upskill Cybersecurity Job Candidates to Transform Them Into High-Performers and Excellent Communicators - Christian Espinosa"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### Work with me I help founders and cybersecurity leaders build teams that ship, not teams that stall. If that's the problem you're trying to solve, let's talk. [Start a conversation](/contact) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhow-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators&text=How%20to%20Upskill%20Cybersecurity%20Job%20Candidates%20to%20Transform%20Them%20Into%20High-Performers%20and%20Excellent%20Communicators) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhow-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhow-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators) [Email](mailto:?subject=How%20to%20Upskill%20Cybersecurity%20Job%20Candidates%20to%20Transform%20Them%20Into%20High-Performers%20and%20Excellent%20Communicators&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhow-to-upskill-cybersecurity-job-candidates-to-transform-them-into-high-performers-and-excellent-communicators)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder & CEO, Blue Goat Cyber Christian is the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm. He's an Air Force Academy graduate, 24x Ironman, climber of two of the Seven Summits, and the author of The Smartest Person in the Room and The In-Between: Life in the Micro. Keep reading - [ ### Reskilling and Upskilling Talent The wider talent-pipeline argument this piece sits inside. Read essay → ](/blog/reskilling-and-upskilling-talent-can-help-shrink-the-cybersecurity-skills-gap) - [ ### Developing Soft Skills in Cyber Teams The specific skill set upskilling usually skips. Read essay → ](/blog/how-to-develop-soft-skills-in-your-cybersecurity-team) - [ ### Neurodivergent in Tech: Do You Still Have to Learn EQ? Same thread: leadership. Read essay → ](/blog/neurodivergent-neurotypical-eq-high-tech) [← Previous essay The Red Flags to Pay Attention to in Your Cybersecurity Staff and How to Handle Them - Christian Espinosa ](/blog/the-red-flags-to-pay-attention-to-in-your-cybersecurity-staff-and-how-to-handle-them)[Next essay → Reflection Is Part of the Messy and Uncomfortable Growth Process - Christian Espinosa ](/blog/reflection-is-part-of-the-messy-and-uncomfortable-growth-process) Related, Leadership ### Bring this conversation to your team Christian keynotes on cybersecurity leadership, ego in tech, and building human-first technical teams. Available for corporate events, conferences, and executive offsites. [Book Christian to speak](/speaking) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)