Tiro Security was honored to be part of InfoSec World this year, with our CEO, Kris Rides, taking part in two conversations focused on something we spend a lot of time thinking about: how people build careers in cybersecurity, how companies assess talent, and what actually helps someone make their next move.
Kris moderated the ATS / CISO Careers session alongside Ira Winkler, Michael Powell and Larry Whiteside Jr., and also took part in the fifth year of the Hacking Into a Cyber Career session.
Across both conversations, the same themes kept coming up, getting beyond the ATS, building relationships, showing what you can actually do, using AI well, and understanding that a cybersecurity career rarely follows a perfectly straight line.
What does a cybersecurity career path actually look like?
One of the most interesting parts of the ATS / CISO Careers session was hearing what actually sat behind each person’s career moves.
When you look at someone’s LinkedIn profile or short bio, the path can seem very straightforward. You see one role, then another, then perhaps a move into a CISO position but what you do not see are the relationships, timing, decisions and circumstances behind each move.
A career path might include stepping into an unexpected opportunity, moving because the organization has changed, taking on a different type of challenge, or making a decision based on what makes sense at that particular point in someone’s life and career.
For candidates, that is a useful reminder not to compare your own career too closely to someone else’s LinkedIn profile and for hiring managers, it is also a reason to look beyond job titles and dates when assessing someone’s experience.
How important is networking in a cybersecurity job search?
A major theme from the ATS / CISO Careers session was spending less time worrying only about the ATS and more time building relationships.
Applications still matter, but relationships can influence a career in ways an application system cannot and the panelists shared how some relationships helped them in their careers.
Sometimes your network helps you hear about an opportunity before it is widely available, or maybe someone brings your name into a conversation because they already know your work. In other cases, a relationship can help shape an opportunity around a need that may not have started as a formal job opening at all.
That does not mean networking should be treated as collecting as many contacts as possible. The point is to build genuine professional relationships over time, contribute to your community, stay connected with people in your field and let people see the work you are doing.
For anyone thinking about their next cybersecurity role, that can be just as important as submitting applications.
Is a short CISO tenure a red flag?
Not necessarily.
The panel also discussed short CISO tenures, including the 18-month to two-year range that came up during the conversation.
Looking at a short tenure on someone’s resume or LinkedIn profile and immediately assuming something went wrong misses a lot of context.
A CISO may have built what they were brought in to build and reached a natural handover point or the organization may have matured to a stage where it needs a different type of security leader. It might also be that the CISO is simply be ready for another challenge.
Dates can tell you how long someone was there but they do not automatically tell you whether they succeeded, failed, chose to leave or reached a natural point for the next stage of their career so for employers, that means asking what someone achieved during the role rather than judging the length of the tenure alone.
How do you stand out when applying for cybersecurity jobs?
The career conversation continued during Hacking Into a Cyber Career, another session Kris took part in at InfoSec World.
This was the fifth year of the session, and once again the room was full. While many attendees were joining the session for the first time, the audience included plenty of mid- and senior-career professionals, which made the discussion especially interesting because many of the questions were not simply about getting into cybersecurity. They were about staying competitive as the industry changes.
One of the clearest takeaways from this session was that listing skills is not enough. Candidates need to be able to show what they have done, what they contributed and, where possible, what changed because of their work and that can apply to experience, certifications, AI skills or projects completed outside a day job.
Instead of only saying you know a tool or hold a certification, think about what that knowledge allowed you to do. Did you improve a process? Reduce risk? Build something? Support a team? Solve a problem? Save time? Improve an outcome?
Those details give employers much more to work with than a skills list alone.
How should cybersecurity professionals demonstrate AI skills?
AI naturally became a big part of the conversation.
The panel discussed how they are already using AI in their day-to-day work and for personal projects, while questions from the audience focused on how candidates can prove they actually know how to use it.
Everyone agreed that simply adding “AI” to a skills section is becoming less meaningful and that a stronger approach is to show what you have actually done with it either through a work project, a personal project, a process you improved or something you experimented with outside your job. What matters is being able to explain what you used AI for, why you used it and what the outcome was.
As AI becomes a more normal part of cybersecurity work, the distinction will increasingly be between people who can say they use AI and people who can show how they use it effectively.
Should you use AI to write a cybersecurity resume?
One attendee shared that they had used AI to help write a factual resume, but when they read the finished version, it no longer felt like their own voice and that led to a useful discussion about how to use AI without handing over your personality completely. From that example, we discussed how AI can help you structure or refine a cybersecurity resume, and we agreed the final version should still sound like you.
We shared some tips on how to go about it like giving the tool examples of how you naturally write, checking every claim for accuracy, removing generic language and editing out parts that wouldn’t naturally sound like yourself.
A cybersecurity resume should still be clear, functional and easy for recruiters and hiring managers to understand. It does not need an overdesigned, graphic-heavy layout, but clear does not have to mean completely generic.
There is still room for your experience, personality and way of communicating to come through.
Do cybersecurity certifications still matter?
Certifications can absolutely be useful, but they work best when they support evidence of what you can actually do, that was another theme that came through in the questions from the audience.
A certification can show that you have studied a subject or reached a certain level of knowledge, but employers will still want to understand how that knowledge translates into the work.
If you have certifications, connect them to the projects, responsibilities, problems and outcomes that show how you have applied what you learned.
The same principle applies to almost everything on a resume, the stronger the connection between what you know and what you have actually done, the easier it is for someone to understand the value you could bring.
The career story is usually bigger than the resume
Across both InfoSec World sessions, one idea kept coming back, there is much more to a cybersecurity career than what can be captured in an ATS, LinkedIn profile, resume or list of certifications.
Relationships matter, context matters and the work you can demonstrate matters. As AI becomes a more normal part of how people work, being able to show how you use it thoughtfully will matter more than simply adding another tool to your skills section.
For employers and recruiters, there is a lesson here too, cybersecurity careers are rarely perfectly linear. Someone may take a step sideways, spend a shorter period in one role, move into consulting, change industries or take an opportunity that only makes sense once you understand the context around it.
Thank you once again to everyone who joined both sessions, shared their experiences and asked questions, and special thanks to Ira Winkler, Michael Powell and Larry Whiteside Jr. for being part of such an open ATS / CISO Careers discussion.
InfoSec World gave us plenty to think about, but perhaps our biggest takeaway is this, building a strong cybersecurity career is not only about getting through an ATS or collecting qualifications. It is about the relationships you build, the work you can demonstrate, the decisions you make and the context behind the career you are building.