Appendix C: What Can You do to Bring More Women and Girls Into and Up Through Cybersecurity?

The following resources can be downloaded, printed, and shared as one-pagers to help create new pathways for women in cybersecurity.

• Ask Better Questions: Ask students, “what kinds of problems would you like to solve?” rather than, “what do you want to be when you grow up?” to help encourage thinking about technology and cybersecurity career paths. Such questions will help students who value contributing to communal goals and helping others reflect on the social impact of career paths in technology. Consider using strong female characters from fictional technology roles, like on the TV show NCIS or Bones, to depict the problems that can be solved.
• Cybersecurity Is Everywhere: Incorporate cybersecurity as an element of popular extracurriculars like sports or drama. Does the team have a social media presence or a payment system for tickets? Encourage students to investigate how those systems are secured and what improperly secured systems might mean for their team. In order to shape and deliver content, partner with organizations familiar with youth activities, like 4-H or the Girl Scouts, that have experience developing computer science or cybersecurity-specific programs and badges for young learners. Understanding how cybersecurity contributes to the group’s overall goals can help create enthusiasm for careers in the field.
• Earn College Credit in Cybersecurity: Encourage high schools to develop advanced courses in cybersecurity, using language in course descriptions and other course materials that is in line with best practices for how to attract and engage more women students. Work with the College Board and the International Baccalaureate to design exams to award college credit for these courses.
• Expand the Cybersecurity Club: Create a new cybersecurity club if your school does not yet have one. Task the students with figuring out how to engage more of their peers in the club. Exposure to the subject in a socially supportive environment—and early in education—can create excitement for careers in the field among students who might otherwise dismiss the possibility. Simple things like cool graphics and a name that echoes themes from popular culture can be used to attract participants.
• Teachers are Learners Too: Sponsor teachers to attend cybersecurity courses or earn certificates, so that they are equipped with the latest information to teach students. Make resources about coding clubs and cybersecurity camps available to students, too.
• Show Cybersecurity’s Impact on Communities: Turn a real-world community problem into a cybersecurity competition. This encourages students to explore the link between the technology, its impact on people’s lives, and the ability to be creative. Give prizes to students who win intramural programs, or work with existing programs (for example, eCybermission) to compete with teams from other schools.
• Cultivate Growth Mindsets: Research suggests that girls sometimes need different kinds of feedback to succeed in STEM classes and can get discouraged if they fail. Consider training teachers in how to encourage a growth mindset among those students. In other words, teaching them that their abilities in math and science are not innate, but can be developed over time, and that failure is not weakness, but an opportunity to get stronger.
• Introduce Female Role Models: As the saying goes, you cannot be what you cannot see. Show students what women in cybersecurity look like by bringing in guest speakers, integrating women’s stories into history lessons, or even featuring video clips of fictional female technologists from TV solving relevant problems.

Download the one-pager

• Coordinate with Greek Life: Plan a cybersecurity awareness challenge or event with a philanthropic goal with Greek Life organizations on campus (perhaps supporting efforts to protect vulnerable communities from hacking and/or identity theft). Make sure to have free food.
• Connect Careers to Course Registration: Schedule a career event—or series of events—that brings female cybersecurity professionals in to talk about their careers with clubs and societies for women. Ask speakers to be explicit about the links between their work and specific academic disciplines or courses. Time these events to coincide with course registration periods, so that students are connecting with female role models as they make decisions about their academic pathways.
• Redefine Foreign Language Requirements: Allow computer languages to count towards university curriculum (UCC) language requirements.
• Emphasize Security Roles: Partner with organizations like ROTC to break down gendered assumptions around “security” as a general concept. Showcase women in the military as role models, pointing out the many different ways women are protecting the nation’s security. If it encourages the idea to stick, consider using “Mama Bear” images and memes to help students think of how women do play security roles.
• Reframe Cybersecurity: Where technology courses or cybersecurity awareness trainings are a mandatory part of the curriculum or campus life, integrate examples and narratives that emphasize the ways in which good security relies on creativity and helping other people in order to encourage students to connect with careers in the field. Emphasize how cybersecurity jobs use skills—like pattern recognition—that are often considered common strengths for women.
• Gender Equality By Design: Consider making changes to systems, processes, and environments to foster a greater sense of belonging and to reduce the negative impact of internalized stereotypes among girls and women. For instance, putting posters of women up on the walls and including more women in the syllabus can all contribute to a greater sense of belonging and achievement in the classroom.
• Partner with Industry: Beyond hosting career fairs, partner with industry practitioners to collaborate on designing cybersecurity skills and educational career paths. Areas as diverse as St. Louis, Albuquerque, Baton Rouge, and many others already have established cybersecurity apprenticeship programs that pair educators with employers. Consider reaching out to explore the possibility of collaborating or establishing a new program.

Download the one-pager

Outreach

• Seek Out Visitors: Reach out to community organizations to invite groups to see your workplace in action for a day and learn what cybersecurity jobs really look like. Offer free child care for these events.
• Seeking Second and Third Careers: Explicitly encourage applications from individuals in pursuit of a career change, for example, former military or network administrators looking to expand their skillsets. Mothers seeking full-time work as their children become more independent are a particularly large population of experienced employees, and are often contactable through organizations like MotherCoders and Moms Can Code. This allows seasoned employees to enter the workforce and incorporates their existing expertise into cybersecurity.
• Internships without the Commute: Work with schools and other community centers to conduct virtual internships and webinars that reach students, early-career professionals, or career changers who are looking to expand their STEM knowledge and network, but who are not able to commute to a worksite. For example, consider programs that connect with underprivileged communities, single parents, or spouses of deployed members of the military.
• Consider Your Workforce Geography: Which of your work roles actually needs a daily physical presence in the office? If remote employees are a possibility, get creative about what “remote” can mean, and look for employees from geographically diverse areas. Be explicit about your policies on remote hiring. If you are interested in applications from rural areas, distant cities, or from parents of small children, saying so can encourage applications from these potential teleworkers.

The Hiring Process

• Shift Your Focus: Instead of evaluating job applications for specific qualifications like degrees, look for applications that show evidence of quick learners, competency, and motivation.
• Blind Review: Remove names and other information indicating gender from job applications before they are reviewed.
• Structure Your Process: Approach each interview with a consistent process, set of questions, and means for comparing candidates’ responses to those questions. If a test or other evaluation is administered to some candidates, use it with all candidates.
• Mind Your First Impressions: Ensure that company representatives present in hiring interviews reflect your values around diversity. Take advantage of this first opportunity to show candidates that diverse people and perspectives are welcome in your workplace.
• Call an Expert: Consider working with experts who specialize in eliminating unconscious bias in the hiring process. Researchers have uncovered a great deal of information about gendered language in job advertisements and other steps in the hiring process. Look for experts who are well-versed in this information to help develop a conscientious hiring process.

Download the one-pager

• Map Career Pathways: Make career pathways in cybersecurity roles in your organization clear. How does each work role lead to the next position? Be explicit about the knowledge, skills, and abilities required to advance into those positions. Find ways to measure progress in unambiguous, trackable ways, and hold periodic career assessments with your employees to discuss their progress towards their goals.
• Watch out for “Volunteer” Jobs: Whether it is organizing birthday cupcakes, serving as rapporteur at the planning meeting, or taking on the project that “we all know is more work than it is worth,” volunteer jobs reduce the amount of time employees can spend on the projects that build their portfolio. Such jobs tend to fall disproportionately to women. Create a company culture that prioritizes distributing these jobs evenly and allows employees to say “no” without penalty.
• Make Your Policies a Selling Point: Flexible work schedules, paid family leave policies, review and advancement programs, and other inclusive policies matter to more than just your current workforce. Good policies are a way of attracting and retaining talent, and particularly women. Your employees have friends in the industry. Give them a reason to tell those friends about your supportive working environment.
• Cultivate a Culture of Mentorship: Consider ways to reward employees who invest their time in helping others. Create opportunities for mentorship. This can be as formal as scheduling meetups and connecting new hires with seasoned employees, but it can also be informal. Physical space—like the office kitchen—that encourages employees from all departments and seniority levels to cross paths can help to build a culture of mentorship. Company leaders (of all genders) can also demonstrate this culture by visibly making time to serve as both mentor and mentee.
• Boards that Care: Board members of any gender can help to make inclusivity a priority throughout the organization. Beyond just being good business practice, recruit diverse board members who signal their dedication to inclusion through their own behavior and choices help to establish and reinforce company culture. National groups that help place women in C-suite positions and on boards can be an asset in instilling these priorities.

Download the one-pager

Participants in a New America Women in Cybersecurity convening in 2018 generated these ideas and strategies to get more women and girls into and up through cybersecurity. But not all strategies begin and end within the cybersecurity community. External partners in industries as diverse as cosmetics, entertainment, gaming, toymaking, and many others all have a role to play. Each and every one of these organizations has a stake in building strong cybersecurity and in good jobs for women. Below are ideas for these partners that can serve both of these ends.

Leaders in fashion can spark interest in cybersecurity through:

• Fashion magazines spreads that depict women as masters of emerging technology.
• High-end designers that feature security-minded products (e.g. RFID-blocking handbag pockets).
• Cosmetics advertising campaigns that show powerful “hacker” women.
• A red-carpet gala theme focusing on STEM and cybersecurity.

More inclusive gaming can draw women and girls into the industry through:

• Videogames with non-gender-specific appeal that feature story elements around cybersecurity and its impacts on people.
• Female avatars and characters that are technologically skilled and reflect physical features and dress with which young women might identify.

By influencing early childhood, toymakers can have a profound impact with:

• Adding cybersecurity to the careers showcased by dolls marketed to girls. Barbie has lots of STEM careers. Cybersecurity should be one of them.
• Card decks that feature famous women in science, technology, engineering, and mathematics. Grace Hopper, Ada Lovelace, Annie Easley, Elizebeth Smith Friedman, and Mary Kenneth Keller would make an impressive full house!

Those who make movies and television can shine a spotlight on cybersecurity by:

• Creating tech-savvy heroines in animated films. Animated princesses are the theme for children’s costumes, backpacks, binders, toys, accessories, and many other day-to-day necessities. Imagine if that could be used to inspire girls to see STEM education as a way to emulate their cultural icons.
• Mainstreaming women in tech roles. Such role models have already started to appear in popular television, but imagine if this was so normal that it was unremarkable.

Download the one-pager