The World Famous Hire Ground Panel, Tuesday Edition

The World Famous Hire Ground Panel, Tuesday Edition

Speakers: Kirsten (“Krener”), Higher Ground; Chris Rides, CEO and Founder, Tyro Security; Heather Morris, Director of Recruiting, Red Horse Corporation; Noel Horry, Community Operations Manager, Cobalt; Bruce Potter, practitioner executive (Turngate and prior roles as stated in session)

Conference: BSides Las Vegas

YouTube: https://www.youtube.com/watch?v=RV-eFJwY_iM

Overview

BSides Las Vegas’s Higher Ground hiring village anchors a long-running community effort to make career navigation in security more humane and more legible. This Tuesday panel, moderated by Kirsten, assembles four front-line perspectives that rarely share a stage at equal length: an agency recruiter (Chris Rides, Tyro Security), a corporate GovCon recruiter (Heather Morris, Red Horse Corporation), a community operations leader who also hires (Noel Horry, Cobalt), and a serial hiring manager (Bruce Potter) with a blunt read on incentives. The session is explicitly interactive—Kirsten encourages interruptions—and it is less “how to write a résumé” and more systems analysis of hiring: who knows what, who is paid for what outcome, and why candidates experience ghosting, black-hole applications, and contradictory advice about degrees, certs, and AI.

If you are trying to optimize a job search, the through-line is not a single trick. It is relationship intelligence: understanding whether your first contact is internal or external, whether a posting is funded or contingent, whether a role is evergreen, and whether the person messaging you on LinkedIn is a human with domain context or an automated funnel. The panelists disagree in productive ways—especially on how much corporate recruiters can or will explain to candidates—while converging on the idea that referrals and direct human outreach still dominate real placements even when the public internet looks like an infinite slot machine of openings.

Background

▶ Watch: Panelists introduce agency vs corporate vs community hiring roles and Tyro, R... (2:00)

Kirsten opens by honoring Kathleen Smith as a pioneer of hiring village efforts across conferences, framing Higher Ground as volunteer-powered candidate support. The panel then inventories roles:

Chris positions Tyro Security as a cybersecurity-only staffing and professional services firm. He has been recruiting since 2012 and describes himself as an agency recruiter who partners with companies when internal talent acquisition is bottlenecked.

Heather contrasts corporate recruiting inside GovCon with her earlier staffing background. Her value proposition, as she states it, is proximity to hiring managers—even if she is “not super technical,” she can translate roles more accurately than a distant agency sprinting many reqs.

Noel explains Cobalt community operations: onboarding and ongoing support for pentesters, continuous evaluation, and hiring for a long-running contract role—giving her a lens on candidates who dismiss non-full-time opportunities during market stress.

Bruce summarizes decades of hiring across consulting, Booz Allen, research engineering serving DoD/finance, Sizo, and a startup (Turngate). His contributions skew toward incentive realism: why feedback is scarce, why long requirement lists skew applicant demographics, and why hiring managers skim.

Kirsten sets up the macro context with slides (described verbally) about duplicate job postings—one role syndicated across many agencies—and pay-to-rank job boards where top results reflect advertising spend, not match quality.

Key Findings

▶ Watch: Ghosting segment: candidates should escalate to hiring managers; corporate in... (12:00)

1) Recruiter types create different information fidelity. Bruce warns candidates not to treat recruiter briefings as ground truth; misalignment yields interviews that feel like category errors. Heather argues corporate recruiters can calibrate with hiring managers more tightly, while Chris counters that a disciplined agency that refuses reqs without a hiring-manager conversation—and specializes in security—can still outperform generalist internal teams juggling unrelated departments.

2) Ghosting is structural, not only personal. Heather encourages polite escalation to hiring managers after interviews if recruiters go quiet, and suggests LinkedIn nudges. Chris admits inbox misses and emphasizes agencies may only receive yes/no from clients. Bruce states plainly that corporate staff often lack incentive to deliver developmental feedback unless the candidate has been humanized early.

3) Degrees and certifications are frequently filters, not skill measures. Noel’s Cobalt hiring emphasizes demonstrated pentest capability over degrees/certs, while acknowledging external career paths still reward credentials. Bruce describes degrees/certs as lazy JD scaffolding, especially in GovCon LCAT constructs, while noting many pipelines now emphasize experience once candidates survive screening. Heather mentions waivers for exceptional candidates when rigid requirements block hires. Bruce warns long hard-requirement JDs skew applications toward overconfident applicants and away from women and minorities, citing studies qualitatively.

4) Certifications in commercial markets are often nice-to-have except when recruiters use them as ATS knockouts to reduce volume—CISSP and Security+ appear in this context. The panel agrees government cares more than generic commercial buyers.

5) Market weirdness: Chris sees fewer remote roles, more return-to-office friction, and agency spend scrutiny; some internal teams get more time to fill while still avoiding agency fees. Noel encourages openness to contract or parallel work. Heather explains GovCon job types: funded direct, unfunded contingent, proposal hires, and evergreen reqs—so “open role” does not always mean “paid seat today.”

6) Fake recruiters: Kirsten warns that enabling Open to Work can trigger spam; vet profiles, connection counts, and demand substantive answers before connecting.

7) Résumé reality: Kirsten clarifies 3–5 seconds to earn a deeper read—then potentially minutes if hooked. Panelists want tailored résumés aligned to the specific JD, not exhaustive career dumps. Chris offers a 321 LinkedIn activity recipe (three connection requests, two thoughtful replies, one post daily) for active seekers.

8) AI: Panelists largely do not describe AI resume screeners as their primary filter; knockout questions and ATS rules do much of the mechanical triage. Suggested candidate use: compare resume to JD with an LLM and patch gaps honestly. Warning: ChatGPT-shaped résumés are increasingly obvious.

9) Entry hiring pain: Later answers acknowledge entry-level competition and suggest widening geography, considering relocation packages, and networking aggressively—who-you-know still dominates anecdotes.

10) Sourcing vs applying: A late audience poll (as run in the room) reinforces a painful pattern many attendees already suspect: interviews often trace back to networks and direct outreach rather than purely application portals. Chris describes LinkedIn Recruiter outreach drowning in spam, which paradoxically hides strong candidates in the noise—another reason concise, specific pings outperform generic “I’m interested” messages.

11) AI in screening: When asked directly, several panelists describe knockout questions and ATS mechanics as the dominant triage layer today, with AI more useful as a candidate-side editor and gap-analysis assistant than as a magical evaluator. Noel and Heather note GovCon adoption of AI tooling is emerging but not universal. Bruce’s emphasis on readable English—basic grammar and clarity assisted by tools—is a low-effort control candidates can actually implement.

Technical Deep Dive

▶ Watch: Certifications as knockout filters vs substance; CISSP/Security+ framed as go... (24:00)

There is no exploit chain here; the “technical” content is process engineering and labor-market mechanics.

ATS and knockouts: Chris describes question flows that collapse 1400+ applicants to ~70 when candidates ignore must-haves (citizenship, onsite requirements, relocation). Heather notes ATS autoreject/disqualify paths. This is the real “automation” candidates feel—not a sci-fi resume parser.

LinkedIn graph settings: Kirsten emphasizes toggles that block recruiters from forwarding profiles—self-inflicted visibility holes.

Agency economics: Exclusivity, domain focus, and long-term network investment are presented as variables that change how much signal you get from an external partner.

GovCon procurement: Funded vs proposal pipelines affects whether a candidate is being collected for future work vs immediate start—critical for interpreting urgency and compensation conversations.

Demo / Proof of Concept

▶ Watch: Labor market mechanics: duplicate postings, scraped jobs, pay-to-rank boards,... (28:00)

No live tooling demo is presented. Kirsten references slides (timing guidance, messaging examples) intended for later online sharing and points attendees to Higher Ground résumé coaching in the same room after the panel.

Defensive Implications

▶ Watch: Résumé advice: tailor to the role; avoid unfocused career dumps; enrich Linke... (42:00)

For security hiring managers, the panel is a soft audit of how organizations manufacture bad hires and toxic candidate experience: unvetted JDs, checkbox compliance frameworks mistaken for risk reduction, unfunded reqs that waste community trust, and knockout filters that optimize for HR throughput over defensive talent quality. Leaders who want better outcomes should negotiate true essentials with recruiting partners, shorten hard-requirement lists with diversity impact in mind, and build feedback loops that do not depend on heroic individual kindness.

For candidates, operational security intersects the job search: LinkedIn visibility, vetting inbound contacts, and avoiding spray-and-pray applications that train ATS models to treat you as noise. For employers, the fake-recruiter phenomenon erodes trust in legitimate outreach—another reason to invest in verifiable human touchpoints (village events, known community members, signed emails with company-backed calendars).

Key Takeaways

• Identify recruiter type and incentives before optimizing your pitch; internal vs external changes what they know.
• Treat JDs as filters; probe for waivers, contingent status, and true essentials through questions.
• Referrals and direct outreach remain dominant placement paths in panelists’ lived experience.
• Ghosting is often bandwidth and incentive structure; escalate politely along multiple channels after real interviews.
• Degrees/certs are frequently screening tools, especially under volume; they are not interchangeable with capability.
• Remote roles are scarcer in anecdotes; flexibility and relocation may unlock opportunities.
• ATS knockouts punish applicants who do not read constraints; AI résumés without human specifics read hollow.
• GovCon posting types explain confusing “open” roles that are not immediately billable.

About the Speaker(s)

Kirsten, also called Krener, leads Higher Ground at BSides Las Vegas and anchors the panel. Chris Rides is CEO and founder of Tyro Security, describing 25 years in recruitment and a cybersecurity agency focus since 2012. Heather Morris is Director of Recruiting at Red Horse Corporation with a GovCon corporate recruiting role. Noel Horry works at Cobalt as Community Operations Manager, supporting pentesters and hiring for community roles. Bruce Potter summarizes a career spanning consulting, Booz Allen, research engineering, Sizo, and Turngate, emphasizing repeated hiring and mentorship experience. Additional audience participants ask questions; they are not named as co-speakers in the bundle metadata.