IT workers in general, but more so IT Security professionals, pride themselves on their technical skills. Keeping abreast of the latest threats and the newest tactics to demonstrate to management and peers that one is “worthy.” The long alphabet soup in the signature, CISSP, CISA, MCSE, CCNA and so on, is all very necessary and impressive. However, cybersecurity puzzles are not solved by technical skills alone. In fact, the case can be made that soft skills are just as important, especially because everyone in the organization needs to cooperate. Security is everyone’s job.

Collaboration

Security is everyone’s job, so a critical success factor for the cybersecurity leader is what you communicate and how you communicate to various stakeholders to gain support, buy-in and behavior change. The soft skills to partner with various individuals and departments throughout your organization will drive the success of any cybersecurity program.

Communication

Too often, IT security leaders speak in the technical jargon of their area of expertise. Not surprisingly, this makes no impact on business leaders nor on others in the organization whose participation is critical to success. After all, a behavior change is only possible if the employee recognizes risk and internalizes the change. This skill, like many others, can be learned and improved with practice. It’s unusual to see a technically capable person want to learn and hone such a skill, but it’s incredibly valuable, and when encountered, its value is readily recognized.

Culture

Culture in this context includes the perceptions, attitudes and beliefs people in the organization have toward cybersecurity. The process of incorporating emotion is often difficult for technical people to comprehend, but plays a central role in communication and collaboration, and therefore success in changing behavior or adoption of new procedures. Old economy companies, such as financial or government organizations, may have a “professional” culture that requires formality and procedure in communication and content. Technology companies with relatively younger employees may react better to communications with humor or animation, and a more informal style. Learning company culture will make collaboration and communication, and therefore cybersecurity, much more effective.

Ultimately, technical skills are necessary for success, but absent these soft skills, a successful cybersecurity program cannot be achieved. As an industry, we tend to emphasize and value technical skills; the same is needed for soft skills.