With a growing skills gap in the cybersecurity space, people who are neurodiverse could be the perfect fit for a role, but many organizations need to re-evaluate how inclusive their recruitment process really is.
Neurodivergency as a term was coined by a sociologist named Judy Singer in the late 1990s, the business world has only begun adopting it within the past few years. According to the Associated Press, neurodiversity is the concept that difference in brain functioning, such as autism, dyslexia or attention-deficit/hyperactivity disorder (ADHD), are normal variations, with strengths and weaknesses. Individuals who exhibit these variations are considered people who are neurodiverse.
An estimated 15 to 20% of the world’s population falls under the neurodivergent category, and 30 to 40% of that population are currently unemployed, according to the Division of Cancer Epidemiology and Genetics. There are also thousands of people currently employed who are undiagnosed.
More organizations are beginning to recognize the value of a diverse workforce, including the many different viewpoints people from different backgrounds, religions and experiences bring to the table. But they may not recognize that existing workplace culture caters to people who are neurotypical.
This was the key messaging from a panel discussion at the recent PrivSec event in London, entitled “The Future of Cybersecurity Is Neurodiverse,” chaired by Purvi Kay, head of cybersecurity governance risk and compliance at BAE Systems.
Although many firms are willing to talk about neurodiversity, a lot of stereotypes still need to be eliminated, said panellist Yvonne Charrot, who is a diversity, inclusion and wellbeing manager at the IASME Consortium.
“If the world is set up for people who are neurotypical, those that are different will find it harder,” she said. “There is a reason why neurodiverse people are not in the workplace if it is set up for neurotypical people.”
How Inclusive Is Your Recruitment Strategy?
Many people who are neurodiverse rule themselves out of even applying for a job because of the wording. Phrases such as ‘needs to be a good communicator’ or ‘flexible’ can be a real barrier, Charrot said. Communication and collaboration may not come naturally to someone who has autism. And someone with anxiety may thrive in a routine but struggle with change.
“Have a look at your [job descriptions],” she explained. “Do you really need a brilliant communicator? If someone who loves routine applies for a job, then they [may not] be flexible.”
Charrot added that other job specs seek alumni from highly ranked universities. Someone with ADHD or dyslexia may not have fared well in school, but they could still be great candidates for the job.
Stripping out unnecessary language in a job description is crucial to attract more diverse candidates, said Jim Newman, head of cybersecurity at Railsr, who shared he was diagnosed with ADHD as an adult.
“Make sure you are hiring for aptitude and that you remove any barriers to entry. Your interview process needs to be as inclusive as possible, and make sure a diverse group of people are actually doing the interview as well,” he said. “Equality doesn’t mean treating everyone the same way. People need to be treated differently according to their needs. Make sure they are supported and allowed to excel.”
Updating interview processes and allowing applicants to showcase their skills through technical assessments, work assessments and structure interviews, ensures that all individuals can feel psychologically safe during the recruitment process.
Neurodiversity Doesn’t End With Recruitment
Once an organization has recruited someone who is neurodivergent, the journey has only just begun. Managers must think about not only retaining the new recruit, but also how they are going to be handled by those that manage them.
“We are still autistic after you have hired us,” said Holly Foxcroft, who is head of neurodiversity cyber research and consulting at Stott and May Consulting and has been diagnosed with autism and ADHD. “If your culture doesn’t support us, then we are going to leave. The average person’s perspective about autism is very linear – it is either Rainman or Einstein. You need to address subconscious biases and communication within your organization and understand it is about supporting that individual’s needs, not their diagnosis.”
Having an inclusive recruitment strategy also means taking many other things into account, Foxcroft added. It is important that not all support resources are hinged on a person disclosing, and rather creating an environment where all people can feel psychologically safe and can express their needs at work.
“It has been said that people who are neurodivergent can be difficult in both leadership roles and to manage,” she explained. “Think about things such as communication, how you send out meeting requests, how bright your lights are, are you asking [neurodivergent] people to come to meetings in the middle of a task that is important to them? This can be a challenge, but companies need to be inclusive in their communications.”
Charrot agreed it was important to support both sides.
“Everybody is an individual, and managers need support as well. They need to know why the people they manage need additional support and that they are not trying to be awkward,” she said. “A company can put a lot of effort into recruiting people who are neurodiverse, but managers and the rest of the workforce need support, too. It is also important to have a diverse leadership team.”
Designing flexibility and neuro-inclusivity into work should span the entire employee lifecycle. This not only benefits individuals, but also organizations. Providing support and resources to all individuals without requiring them to disclose their condition leads to increased retention, reduced training spend due to planning for all needs instead of some, increased likelihood of internal mobility and ultimately improves ROI.
Aptitude vs. Qualifications
The panel concluded that organizations can often be blinded by a need for qualifications, when perhaps they should be measuring candidates by aptitude and how they can be trained and developed from within.
Foxcroft questioned why cybersecurity is not on the school curriculum from an early age.
“There is no education in schools on cyber, and there is nothing to support children’s investigative minds with this technology,” she said. “Unless you study IT at university which covers cloud security or infrastructure security, for example. How can we expect the next generation to have aptitude when we give them no introduction to the concept of cybersecurity?”
Charrot added that firms need to be mindful of not excluding anybody either, when looking to diversify a workforce.
“Sometimes people get a bit prickly and question if they are being ruled out,” she said. “Obviously the industry has been dominated by a certain type of person, and perhaps it always will be. We are not trying to get rid of anyone. Diversity just means you are representative of your customer base. It is not just a tick box exercise but about giving everyone access to success and opportunity.”
