Building a cybersecurity team is not just about finding people with the right certifications. It is about hiring for aptitude and attitude, creating a culture of growth, and taking a risk-centric approach that aligns security with business outcomes rather than chasing tools.
We spoke with Jesse Miller, founder of PowerPSA Consulting, on the Scale to Zero podcast. Jesse is recognized as an innovative thought leader and operational powerhouse in information security. He helps managed service providers build full-stack operations for deploying cybersecurity services at scale, and has grown an MSP to an eight-figure company before founding his own consultancy.
You can read the complete transcript of the episode here >
What qualities should you hire for in cybersecurity?
Jesse’s hiring philosophy is clear: hire for aptitude and attitude first, technical skills second. Technical knowledge can be trained; communication skills and problem-solving instincts cannot.
He looks for:
- Empathy and people skills: Personality assessments that reveal whether candidates can read people and communicate effectively. Someone who waited tables through college learned to get out of their shell — that translates directly to client-facing security work.
- Problem-solving ability: Transferable skills from unexpected backgrounds matter. Jesse helped a former recording studio engineer transition into cybersecurity compliance because routing audio, managing client requirements, and translating them into technical solutions are directly transferable skills.
- Teamwork over lone-wolf tendencies: Security is inherently collaborative. The unicorn who knows everything but cannot work on a team is less valuable than someone with moderate technical skills and strong collaboration instincts.
That said, senior roles still require domain expertise — a senior cloud engineer needs to know AWS and Azure. But at that level, those skills are a commodity. What differentiates candidates is everything else.
How do you attract and retain cybersecurity talent?
Jesse argues these are the same question. The culture that attracts top talent is the same culture that retains them:
- Create a culture of learning and forward progress. Go-getters who want to grow will leave if they find stagnation after joining.
- Invest in certifications and training. A clear progression path — CompTIA Security+, then CySA+, then CASP, then a Linux course, then SANS GCIH — with salary bumps at each milestone creates stickiness.
- Practice radical candor. Care personally and address directly. Employees who feel genuinely supported and honestly challenged stay longer.
Yes, you might spend $10,000–$30,000 developing an analyst into a top performer. Some attrition is inevitable. But the majority will stay because they know there is more growth ahead — and they will not find that investment elsewhere.
What should a startup hire as their first security role?
Jesse’s answer is unconventional: start with a managed service provider (MSP) to get baseline coverage at the cost of a single employee. Then hire a business-focused generalist as your first internal role.
Why a generalist?
- They build the trust and relationship foundation between security and other teams for the long term.
- They can “herd the cats” — aligning vendors, internal IT, and business stakeholders.
- They speak the language of the business, not just security jargon.
From there, stack specialized roles as you grow. The ultimate goal: grow enough that the last thing your vCISO helps you do is hire a full-time CISO.
How should security teams engage with the business?
The “Department of No” reputation kills security programs. Jesse offers a different approach:
- Speak in business language. “Your cyber risk is high” means nothing. “We could have cashflow issues if these systems are down for three days” resonates immediately.
- Frame security as a business enabler. Position controls as what allows the organization to be agile and capitalize on opportunities, not just what prevents bad things.
- Be helpful proactively. Ask “how can I help you win deals?” Look at target verticals, understand their regulations, and position your security program to answer client due diligence questions confidently.
- Do not be dogmatic. When the business says no to a control, do not pound the table. Find creative alternatives that provide “good enough security” while enabling the business to move.
Organizations that position security as a breath of fresh air during vendor assessments — rather than scrambling to answer basic questions — win more deals and build trust faster.
Why should organizations take a risk-centric approach instead of a tool-centric one?
Jesse identifies three common mistakes organizations make:
- What they do not know is wrong: Buying tools without a strategic plan. Purchasing vulnerability scanning without a vulnerability management team to actually fix what is found. Tools without a risk-centric framework are just expensive noise generators.
- What they know is wrong but keep doing: Applying old approaches to new problems — like treating all highs and mediums equally without considering EPSS exploitability scores, internet exposure, or data sensitivity. Context matters enormously.
- What they think they will get away with: Overstating security posture. With new SEC rules, this is becoming increasingly risky.
The fix: start with a framework, understand your risks, align controls with business strategy, and then select tools that serve that strategy — not the other way around.
What is the virtuous circle in cybersecurity services?
The opposite of a virtuous circle is the “spiral of silos” — competing on price, squeezing margins, doing the minimum to keep clients from complaining, and watching morale decline. Jesse describes the virtuous circle as:
- Charge fairly for premium services. Being at the higher end of market value is justified when you deliver genuine protection and business enablement.
- Invest in the best talent, systems, and tools. Fair compensation enables hiring people who deliver exceptional results.
- Enable clients to be better than yesterday. Help them become leaders, innovators, and agile organizations that can weather storms and capitalize on opportunities.
- Focus on ideal client profiles. Serving the right clients deeply beats serving many clients poorly.
The question is not “how much does it cost?” but “what is the actual ROI of the investment?”
What advice would you give aspiring CISOs?
Jesse owns the domain DontBeACISO.com — a tongue-in-cheek reminder that the role is not for everyone. His advice:
- Make sure you actually want the job. Understand what it entails before pursuing the title.
- Pick a focus. Choose an industry or company type and deeply learn how that business makes money.
- Think business-first, security-second. Until CISOs start acting like business executives who happen to specialize in security, they will remain at the “kids’ table” in the executive suite.
- Invest in “sneaker wear.” Get out of your office, walk around, listen to other business units, and find ways to be helpful before being asked.
The goal is “good enough security” that enables agility — not perfect security that paralyzes the organization.
