Hiring Information Security Professionals: ISO 27001 Competence Evidence

Hiring an information security professional is not an exercise in collecting certifications. The organisation must identify the work that needs to be done, the risks attached to it and the evidence that a candidate can perform it in the real operating environment. A strong hire combines relevant knowledge and practical skill with judgement, communication, ethics and an ability to learn.

ISO/IEC 27001 requires the organisation to determine necessary competence, ensure people are competent through appropriate education, training or experience, take action where needed and retain evidence. It does not prescribe degrees, credentials or years of service for a security role.

Direct answer: Define role outcomes and risk first. Translate them into observable tasks, knowledge and skills; assess candidates consistently with work-relevant evidence; verify material claims; then close remaining gaps through a documented onboarding and development plan.

Begin with work, not a job title

The same title can describe very different work. A “security analyst” may monitor alerts, administer controls, assess suppliers, investigate incidents or support an ISMS. A “CISO” in a small company may lead strategy and implementation, while a large enterprise may distribute those responsibilities across several teams.

Write the role around outcomes such as:

• maintain the risk register and support risk owners;
• design and review cloud security architecture;
• investigate alerts and preserve evidence;
• coordinate ISO 27001 control operation and assurance;
• translate security exposure for executives; or
• manage recovery, supplier or vulnerability processes.

For each outcome, describe scale, authority, dependencies and consequences of error. This prevents an impressive but irrelevant technical profile from dominating selection.

The NIST NICE Workforce Framework provides a common language for cybersecurity work using tasks, knowledge and skills. NIST also warns that work roles are not the same as job titles. That distinction makes the framework useful for constructing role-specific evidence without copying a generic vacancy description.

Build a competence profile

Use four evidence dimensions rather than one credential gate.

Dimension	What to define	Useful assessment evidence
Knowledge	Concepts, regulations, technologies and business context	Scenario explanation, prior learning, reasoned discussion
Skill	Ability to perform a relevant task	Work sample, exercise, demonstration, portfolio
Experience	Scale and conditions in which the work was performed	Structured examples, references, artefacts that may lawfully be shared
Behaviour	Judgement, communication, ethics and collaboration	Consistent behavioural questions, scenario trade-offs, reference evidence

Separate essential capability at entry from knowledge that can be learned safely after appointment. A role that owns incident command may require demonstrated judgement on day one; knowledge of the organisation’s ticketing system probably does not.

The professional credentials as competence evidence guide explains how certifications can support a decision without becoming proof of every capability.

Use structured, work-relevant assessment

Ask every candidate for the same core evidence and score it against pre-agreed anchors. This improves comparability and reduces the risk that charisma or familiar background replaces capability.

A practical assessment can include:

1. a short scenario based on the role’s real decisions;
2. a written or verbal explanation for technical and nontechnical audiences;
3. questions that probe assumptions, uncertainty and escalation;
4. a retrospective example of a mistake or changed decision; and
5. a discussion of ethical pressure or conflicting business objectives.

For an ISMS manager, present an overdue treatment action and conflicting owner views. For an analyst, provide a bounded event timeline and ask what evidence to preserve. For an architect, ask the candidate to explain trust boundaries and residual risk. Do not use assessment material that asks candidates to perform unpaid production work or disclose confidential information from previous employers.

Score the reasoning, not whether the candidate guesses the interviewer’s preferred tool. Strong evidence includes clarification of scope, risk-based prioritisation, acknowledgement of uncertainty, proportionate escalation and communication suited to the audience.

Look beyond technical depth

Security work changes behaviour and affects delivery, cost, customer trust and legal exposure. Assess whether the person can:

• understand business objectives before proposing controls;
• explain risk without exaggeration or false certainty;
• negotiate proportionate treatment options;
• listen to users and anticipate misuse or friction;
• connect local changes to wider system effects;
• learn as threats, technology and obligations change; and
• act consistently when access or authority creates temptation.

These attributes are not “soft” alternatives to technical skill. They determine whether technical knowledge produces useful, sustainable outcomes.

For senior candidates, connect assessment to the CISO reporting and governance model so expectations match actual authority.

Verify material claims proportionately

Verification should reflect applicable law, role risk and privacy obligations. Obtain consent and use a consistent process. Depending on the role, evidence may include identity, employment history, relevant qualifications, professional standing, references and legally permitted screening.

Do not collect information merely because it is available. Document the purpose, access, retention and decision rules for candidate data. A discrepancy should be assessed for relevance and context rather than treated as automatic proof of untrustworthiness.

The organisation should also consider conflicts of interest, outside activities, confidentiality duties and access that will be granted. The employment security terms guide connects those expectations to documented obligations.

Record the hiring decision as ISMS evidence

Useful retained evidence includes:

• approved role outcomes and required competence;
• assessment criteria and score anchors;
• completed interviewer records;
• work-sample or scenario results;
• verified qualifications or references where relevant;
• the rationale for the selected candidate;
• identified gaps and associated safeguards; and
• an approved onboarding and development plan.

Avoid retaining excessive raw notes or sensitive candidate material. HR retention rules and privacy requirements still apply. Auditors normally need evidence that the method operated, not unrestricted access to every personal detail.

Use the free ISO 27001 Clause Explainer to examine competence and awareness requirements, then apply the organisation’s own legal and risk context.

Close gaps after appointment

No candidate will arrive with complete knowledge of the organisation’s assets, culture, risk criteria and obligations. Convert accepted gaps into controlled actions with an owner, due date and evidence of completion.

Onboarding should cover role authority, risk criteria, relevant policies, escalation, incident duties, privileged access, important suppliers, current objectives and known control weaknesses. Pair learning with supervised work and observed performance. Attendance alone does not establish competence.

The internal auditor qualifications guide shows how independence and demonstrated capability can matter more than a single course certificate.

Audit the process through a sample

Select recent appointments from roles with different risk and seniority. Trace each from approved role need through assessment, verification, appointment and onboarding. Then sample one unsuccessful or withdrawn recruitment to confirm the method was applied consistently.

Sample audit questions

• Which security outcomes made the role necessary?
• How did the organisation distinguish entry requirements from trainable gaps?
• What evidence showed the candidate could perform high-risk tasks?
• How were technical and behavioural judgements scored consistently?
• Which claims were verified, and why were they material?
• What gaps remained at appointment, and who accepted them?
• How was competence confirmed after onboarding?

Judge pass, partial and fail conditions

Pass: Role requirements derive from real work and risk, candidates are assessed consistently through relevant evidence, material claims are verified proportionately, and remaining gaps are controlled and closed.

Partial: A job description and interviews exist, but criteria are generic, decisions rely heavily on credentials, or onboarding records show activity without demonstrated capability.

Fail: The organisation cannot explain necessary competence, privileged duties are assigned without relevant assessment, material claims are not verified despite role risk, or known gaps remain unmanaged.

Good security hiring is a repeatable evidence process. It selects for the work the organisation actually needs and continues until the person can perform that work responsibly in context.