Been a thread going today on the "talent shortage" in #infosec. We've talked about HR, Hiring Managers, Orgs having unrealistic hiring goals, bad job desc., etc. However it's time for some real talk on an issue that is reducing the number of EXPERIENCED professionals in the 1/

market. It's an uncomfortable conversation but one that cannot be ignored (although I know now as I bring this up, there will be those that claim it doesn't happen). The fact is, we as a community continue to drive people away. You know where I'm going, this industry continues 2/

to push out members of underrepresented groups. Some of this is done with very aggressive, overt, tactics. Some of it is more subtle but still very intentional. And in some cases it's simply systemic and we participate in it by our failure to acknowledge and work against those 3/

systemic forces. ISC2 and other orgs have been looking at the lack of women in this industry for a while now. While slowly improving, the behaviors that seek to drive women out continue. BIPOC are even more sorely underrepresented in our space and while I'm clearly not a BIPOC 4/

I've talked to a number about the experiences that drive them out of this industry. Interestingly enough, much of what they've told me mimics the issues that women have been fighting. Having skills called into question, being treated awkwardly or with outright contempt, 5/

struggling to find representation in a sea of white at conferences, on panels, etc. The list goes on. I know many of you share my concerns on this and I know others of you believe it doesn't exist. To the latter, stop telling millions of people their experiences are fake 6/

open your ears and listen. That many people are not making this stuff up.

My point is, yes there are issues at the employer level that need to be worked on, but we need to fix our own house too. We can't blame everyone else when our own behaviors cause talented people 7/

to leave this industry on a daily basis. Think it doesn't happen? Well I just heard from someone today who left their rather prominent role in an organization to seek a job unrelated to security because of how this industry treated them. So yeah, perhaps that's motivation for 8/

me to write this thread, but it isn't the only reason. This continues to brew beneath the surface. We ignore it because as a community its uncomfortable to talk about. Popular members of our own community get away with it because we're afraid to speak against them. And to some 9/

extent for good reason. I've witnessed the retaliation first hand. Sometimes we do stand up. Recently we had an extreme case where someone exhibited these behaviors and he got served every way imaginable. But it isn't always so obvious nor do we always respond. 10/

So what I'm saying is, let's continue to fix the recruiting/hiring issues. But let's #DoBetterBeBetter as a community cleaning up our own act because we are to blame as well. I love this community, I love all of you, I want to see us succeed together!! /RANT