Breaking into Cybersecurity Part 1: Communication

Tech skills are very important in the field of cybersecurity and there's no denying that. No matter what tech suite is in use, it's used differently from organization to organization and will require training to familiarize with the use case.

Security Information and Event Monitoring (SIEM) platform is a ubiquitous security technology. Every organization has different logging requirements, different compliance requirements, and a wide range of devices that need logging. No SIEM deployment will look exactly the same from organization to organization. The general concepts remain the same but it'll still require some training.

What is more difficult to train is communication skills. Good communication skills require more time to develop than learning a new technology. No matter what area of Information Security you end up in, communication is vital.

Penetration Testers need to write concise reports to explain weaknesses discovered which will clearly communicate the risk of the findings. Governance Risk and Compliance (GRC) personnel need to write clear policy and procedures and communicate risk metrics and compliance requirements to business leaders. Security Analysts communicate the impact of alarms and alerts triggered. Each of these employees may be tasked with giving a live presentation before stakeholders. Effective communication is going to be critical.

But how do you develop communication skills?

Written communication skills require a knowledge of general grammatical rules. Fortunately, there are excellent resources to help improve your grammar skills. I highly recommend The Grammar Girl's Quick and Dirty Tips, Mignon Fogarty has a knack for making grammar fun and exciting.

Additionally, you'll want to prove your written communication skills. Try reaching out to your local newspaper to write a Letter to the Editor about a cybersecurity topic relatable to the general public (National Password Day for example). The target audience for this article should be a non-technical; remove any buzzwords and jargon. Your point here is to educate the general public, not to show off your knowledge.

Next, write a technical paper for publication in a trade journal. The Information Systems Security Association (ISSA) publishes a monthly journal. The journal is open for members and non-members to contribute; however, the ISSA offers mentorship for writing your article exclusively to members.

As an Information Security professional, you will be required to communicate to both a non-technical and technical audience. Writing and publishing articles for both types of audiences will prove your ability.

Now comes the scariest part of communication for most people: speaking before an audience. Even today, I still get nervous speaking live but that's okay. It's a skill that you can develop and as you develop, you will get more comfortable. If you are nervous about public speaking, I highly recommend finding a local Toastmaster's International club near you. Toastmasters International provides a supportive environment for you to learn and grow your communication skills. You will learn how to give presentations before a live audience and how to respond quickly to impromptu questions. Most importantly, you will receive constructive feedback to help you hone your skills. My favorite part about Toastmasters was the impromptu questions. You will be given a random question asked by a member; you will then have 30 seconds to give a 2-3 minute response. This skill is extremely valuable for interviews.

If you are not able to join a Toastmasters club, practice with a trusted friend. Have them ask you random questions covering a wide range of topics.

Another idea I would suggest would be to take an Improv class. Improv classes aren't just for actors. They help build communication skills by responding to situations.

Communication skills may seem intimidating to build but there are ways to build and improve. Effective communication skills will help you along your career path.