How should organisations build a more inclusive hiring pipeline for tech and cybersecurity roles?

Why Inclusive Hiring Matters for Tech and Cybersecurity

Inclusive hiring is not a “nice to have” for technology and cybersecurity teams. Narrow entry criteria shrink the available talent pool, reinforce homogeneous problem solving, and often exclude people with the exact skills modern security work needs: investigation, pattern recognition, systems thinking, communication, and operational discipline. This matters even more in security, where teams already face persistent capability gaps and high turnover. NHIMG research shows that 68% of organisations do not know how to fully address NHI risks, which is a reminder that resilient security depends on more than pedigree alone.

Organisations that over-index on four year degrees also miss candidates who have proven themselves through labs, apprenticeships, military service, help desk work, cloud operations, or adjacent analytical roles. That is especially costly in a market where Ultimate Guide to NHIs — Why NHI Security Matters Now notes that NHIs outnumber human identities by 25x to 50x in modern enterprises, making operational scale a real concern for hiring and staffing models alike. In practice, many teams discover the limits of degree-only hiring only after open roles remain unfilled and critical work is already delayed.

How to Design a Broader Pipeline Without Lowering the Bar

The practical goal is not to dilute standards. It is to define the work more precisely, then map multiple routes into it. Start by breaking roles into skill clusters: detection engineering, IAM administration, incident response, cloud operations, scripting, policy writing, and stakeholder communication. Once the work is decomposed, hiring managers can screen for demonstrated capability rather than credentials that merely correlate with capability.

• Use task-based assessments that mirror real work, such as log analysis, basic scripting, or case triage.
• Accept transferable experience from adjacent roles, including IT support, business analysis, audit, and systems operations.
• Create apprenticeship, internship, and returnship paths with clear progression milestones.
• Pair early career hires with mentors and structured learning plans so growth is measurable, not informal.
• Track promotion, conversion, and retention by pathway to see which entry routes actually work.

For security-specific role design, current guidance suggests aligning competency checks with control outcomes instead of résumé signals. That means a candidate for a junior SOC role might be evaluated on alert interpretation and escalation judgment, while a candidate for IAM support might be tested on least privilege, access review hygiene, and basic troubleshooting. The NIST SP 800-53 Rev 5 Security and Privacy Controls framework can help teams translate work into control-oriented expectations, while NHIMG’s Top 10 NHI Issues is useful for understanding where poor identity practices create operational drag.

Inclusive pipelines also need compensation and progression discipline. If junior routes are treated as temporary labour with no bridge into stable roles, diversity gains will evaporate. These controls tend to break down when organisations hire many entry-level candidates but fail to fund onboarding, coaching, and manager time to develop them.

Where Inclusive Pipelines Commonly Break Down

Tighter hiring standards often increase process overhead, requiring organisations to balance consistency against speed and budget. One common failure is confusing accessibility with lowered expectations. A role can be open to non-traditional candidates and still require strong fundamentals, reliability, and learning agility. The difference is that the organisation proves those qualities through work samples and structured interviews, not through pedigree.

Another edge case is cybersecurity, where clearance requirements, regulatory constraints, or on-site duties may narrow the pool. In those environments, best practice is evolving toward a dual-track model: maintain strict role-specific requirements where they are truly necessary, but remove irrelevant barriers everywhere else. That includes avoiding vague degree requirements for roles that do not depend on them and using consistent scoring rubrics to reduce bias. When teams need a reality check on identity and access risk exposure, 52 NHI Breaches Analysis is a useful reminder that security failures often come from weak process, not a lack of elite credentials. The tradeoff is clear: broader access widens the funnel, but it also demands stronger onboarding and manager accountability to preserve quality.

Related resources from NHI Mgmt Group

• Why do organisations value SSCP for operational security roles?
• When should organisations prioritise Zero Standing Privilege for non-human identities?
• How can organisations reduce secret leakage in ServiceNow at scale?
• How do organisations reduce false positives in secret detection pipelines?