Help desk has your cybersecurity talent. Here’s how to find and encourage it

Jim Sherlock found one of his best pen testers—the offensive-minded security pros who break down tech vulnerabilities—at the help desk.

Sherlock’s company at the time, the online learning-assessment platform Pearson, had to prepare for its busiest period of the year: school finals. Sherlock managed Pearson’s product operations before serving as director of information security, compliance, and tech innovation between 2015 and 2021.

While Pearson prepped for its academic equivalent of the Super Bowl, Sherlock noticed a help desk employee with a knack for capturing user traffic between students’ testing devices and Pearson’s system. That employee was adept at building scripts that replayed that activity, allowing the company to simulate hundreds of thousands of students logging in to take tests.

Understanding an application through the information it exchanges, beyond what appears in its interface, is valuable for both load testing and security testing. Sherlock noted the employee’s skill and steered him to the security side of the house.

Sherlock remembers asking him: “Why don’t you pretend to be a bad actor that intercepts traffic and modifies student testing behavior over the wire? What can you get the system to do that we might be only enforcing on the client side?”

Sherlock saw the help desk as an important place for employees to matriculate into all roles throughout the organization, including non-technical jobs like project management and technical ones like software development and cybersecurity.

Any transition from help desk to cybersecurity, however, can involve formal and informal efforts that recognize talent and place a person on an international career path. Such a career shift also requires connection managers like Sherlock who can spot special skills at the service desk and send them to the right mentors and teams.

“The key is making sure that you’ve got somebody in a leadership position over a help desk that understands their responsibility to both identify talent and then their their job should be to move them through the org,” Sherlock, now VP of AI and cybersecurity R&D at cybersecurity firm ProCircular, told us.

Finding and fostering talent. A Gartner survey conducted in July 2026 found nearly three-quarters of 251 global executives expected their orgs’ cybersecurity function to have a higher proportion of senior and experienced talent, according to Alex Michaels, director analyst with the tech-insights firm. That data point, he added, reveals how cybersecurity leaders are finding it harder to identify and develop entry-level talent, especially with automation (via AI) changing the necessary skills for cybersecurity roles.

“The more that gets automated, the more that gets forgotten. So, the starting point to effective security analyst is even further than it was yesterday,” he said.

Here are some of Michaels’s recommendations for steering an organization’s entry-level talent into cybersecurity:

• Gauge interest. Employers can use internal job marketplaces, champions programs, and employee resource groups to spot who’s attracted to the field. For cybersecurity skills, Sherlock watches for people who have a “natural proclivity for gathering as much data as possible on a system,” and who can break a complex problem into manageable parts.
• Set up shadowing opportunities. Someone interested in governance could benefit from observing a risk assessment. An aspiring security operations center (SOC) analyst, similarly, may strengthen their expertise by sitting in on a tabletop exercise. Organizations can work with their HR teams to formalize these rotational programs and establish learning objectives.
• Share a clear plan. Document a cybersecurity hopeful’s short-term and long-term goals. An “IDP,” or individual development plan, can include goals like certifications, instructional classes, and mentorship experiences. Each objective, ideally, should identify the skill, activity, target date, expected outcome, and person responsible for supporting or reviewing it, Michaels wrote in a follow-up email to IT Brew.
• Build accountability. Organizations can also recognize managers and mentors for providing structured development support.

Mentorship and shadowing can also be ad-hoc and informal. Ben Bernstein, manager of the cybersecurity advisors team at agentic security platform Huntress, is grateful for his early-career stop at the University of Rhode Island’s help desk, along with previous work at cybersecurity company Red Canary, which had teams that welcomed questions and allowed more junior employees to look over their senior colleagues’ shoulders.

“I think that you just need a culture of open-door policies of ‘anybody can basically send a Teams or Slack message to a colleague, whether they’re on the same team, a different team, even if they wear a ‘C’ in their title,’” Bernstein said.

Many new DevOps positions opened up when Pearson transitioned years ago from on-prem facilities to AWS cloud environments. Sherlock looked to the help desk for people to “build infrastructure that they used to support.”

“I was evaluated based on my ability to move individuals out of the help desk into other positions within the company, and that’s really what it should be in a healthy org,” Sherlock said.