Why your diversity and inclusion efforts should include neurodiverse workers
Neurodivergent workers bring pattern recognition and skills that are crucial to enterprises and cybersecurity.
I caught up with Craig Froelich, the chief information security officer at Bank of America, to talk about hiring neurodiverse workers and how they can benefit cybersecurity teams. Here are some of the highlights.
special report
Neurodiversity is part of Bank of America's hiring strategy. Froelich said:
Neuro-diverse people and neurodivergent people have been in our organization for a long time. Neurodiversity is one of those hidden diversity initiatives where there are lots of people who are neuro-diverse. They may be on the autism spectrum. They may have ADHD. They may have dyslexia. And for a long time, they may not necessarily have felt comfortable in being able to talk about that openly because of an associated stigma. So when we first started thinking about neurodiversity and the importance of neurodiversity in order to be able to help solve some of cybersecurity's hardest problems, it was first about making sure that we had an open and honest, courageous conversation in the organization. From there, it was amazing all of the people that would talk about how they wanted to be able to help. And then it was about finding partners in the community, people who knew a lot more about this than I did, to be able to help us understand where to start and what to do.
I think the important thing to understand is it's not a program. It is part of our hiring strategy. And so people who are neurodivergent, they're either are part of our team already, or that we're bringing into the organization, they go through the same hiring practices.
Neurodiversity's role in cybersecurity. Froelich said neurodivergent people are adept at finding patterns. He said:
One of the great things that people who are neurodiverse can provide is an amazing ability to be able to think about pattern recognition, as an example. So, in cybersecurity, that's roles like cryptography, it's malware reverse engineering, it's hunt team, where focus and intention and looking for details is really important. And people who are neurodiverse have a great aptitude for being able to do that when given all of the right conditions and the right support.
Neurodiversity brings business benefits. Froelich said:
I think there is absolutely a business benefit. In cybersecurity, there is, depending upon who you talk to, something on the order of about 3.5 million jobs that will be unfilled this year. And so it's an imperative for us as an industry to be able to make sure that we're bringing people to the table and that those people have to be able to come from all walks of life. If you're thinking about how to be able to solve a hard problem, like defending an organization like Bank of America from different threats, you have to anticipate what those threat actors are going to do. And people who think differently are going to be able to help you do that. So the advantages are clear.
Environment matters. When managing neurodivergent people you have to think through the right environmental conditions -- especially in a traditional office. Froelich said:
When you have neurodivergent people in your team, you have to think through, how do you make sure that they have the right environmental conditions? Something as simple as providing them with noise canceling headphones, or putting them in a place in the building, when we're still in buildings, to be able to make sure that they're not in a high traffic area, or that they have the right lighting. None of these are really expensive, and frankly none of them are really hard, but it's amazing what you can do when you open up and ask them what it takes for them to be able to focus at what they come up with and what they will help to deliver.
The COVID-19 pandemic has made it easier to tailor the environment to neurodiverse workers. Froelich said:
When they went from the office to working at home, it was actually very easy for them. In fact, probably even easier for them than it was for folks like me. So their ability to stay focused and focused on the outcomes and the details has been a real benefit for us through what we've been dealing with as this national human tragedy or global tragedy related to the pandemic.
Neurodiversity meets machine learning. Froelich said that matching neurodivergent workers with machine learning models has been successful. He said:
I mentioned cryptography or malware reverse engineering, hunting. If you take hunting as an example, you're talking about lots and lots of data. You're looking at logs, you're looking at different anomalies, and the models will help to be able to surface things, but any good security team at a reasonably sized organization is going to be most likely inundated with different alerts. They're going to have a lot of information that the models will end up spitting out, but you still need to be able to process. People who are neurodivergent have an ability to be able to pick through all of that information at a more efficient rate and in a better way to give you that type of information that needs to be risen to the surface so that you can action it faster.
Building a team with neurodiverse people. Froelich said:
This is a journey for us as it is, I think, for most companies. What I would tell you today is that, one, you shouldn't think of neurodiversity as a bolt-on to your hiring strategies and the way you design your organizations. It needs to be part and parcel of everything that you do. So there's certainly certain jobs that neurodivergent people are maybe better at. For example, a lot of neurodiverse people may not necessarily feel comfortable in being able to face off to a business to be able to architect a security solution, because that requires human to human communication. But while that may not necessarily be the right place, you take AI as an example, making sure that they're paired with people who understand how to be able to interact with people who are neurodiverse.
Whether it's the manager or the people on the team, making sure that they have the right training to say, "What are the types of questions that we should be asking and how should those questions be framed so that somebody who's on the team that may need extra support, like somebody who's neurodivergent, has the ability to be able to do that?" What's been really interesting is that just by making sure that we are being more expressive, more direct, more clear, more straightforward in our language, not just in the way that we manage the teams, but also in the way that we hire, our job specifications, it's not only made us better in dealing with people who are neurodivergent, but also it's made us better overall.
Getting started. Froelich said that there are community groups that are a big help for enterprises looking to hire more neurodiverse people. One group, Neurodiversity in the Workplace, has been key to Bank of America. Some advice for enterprises looking to hire more neurodiverse employees:
I think there's probably three things. The first is, start. This is an untapped market for the most part and starting is really the first part. Two, when you go to start, make sure you bring some partners with you. You don't have to learn by yourself. You can learn as you go, like we are, but you can bring partners along like the one I mentioned earlier, Neurodiversity In The Workplace, and they can give you a jump start into it. And the third is, don't think of this as a bolt-on. Don't think of this as a program. Think of this as an entire way of you being able to work. And when you think of it as your hiring practices need to evolve, the way that you manage needs to evolve, it doesn't just benefit you in terms of bringing new people that are neurodivergent to the table, but it actually helps the entire organization.