Mfcttrf

Our company has grown to the size that we are looking to specialize in the roles within the cybersecurity function. At a high level, we are diving into offensive security employees- colloquially also known as red team to act similar to a penetration tester attempting to exploit security, and a Blue team focused on defensive security, controls engineering, and incident detection / response.

Currently the Security Operations team is almost entirely focused on defensive security. We are starting recruiting for new employees to work in the offensive security capability. Form my experience in cybersecurity, and interacting with my network members working in cyber, successful penetration testers / red team members are "future focused",and "think like a black hat" reading and educating themselves on vulnerabilities discovered and how an adversary can exploit them. To summarize, learning how to learn.

I realize evaluating candidates how they learn and keep abreast of news within the cybersecurity profession may be somewhat subjective, because learning styles are different for all individuals. Also, the importance of events are often also subjective. For example, some sectors may be exposed more to a particular event / breach.

How can I best objectively assess a candidates learning aptitude
within specialized field in IT?

• Given a certain amount of learning may happened outside of work, is such a question fair to the candidate? Would candidates likely see it
  as "intrusion" into their work - life balance and be turned off
  therefore?

How can I best objectively assess a candidates learning aptitude within specialized field in IT?

First of all it is a bit tricky to be able to truly gauge and understand a candidate's aptitudes and skills solely during interviews. That is why most times there are several rounds of interviews, coding tests, etc..

Now, that being said, if you want to assess the learning aptitude a candidate has, I would suggest focusing your questions towards the ways and resources the candidate uses to solve problems.

You want to ask questions like "When facing a new penetration project/test, what are the usual steps you take?", or well "When you find a dead-end or are unsure what to do next what you usually do?"... and you want to see if the candidate's answer indicates learning aptitude (googling, searching on SO, searching on forums, reading doc, etc., or whatever aspects you are looking for).

As mentioned before, assessing candidates during interviews is not trivial, and sometimes only when the candidate is on-board and starts with real projects and tests is that you will really see if they have learning aptitude. That is why sometimes job roles may have a probation period, so both you and the candidate can see if you are a good fit. You could consider having a probation period so you have more time to better gauge their aptitudes.