Beyond the Firewall: Part 5 – Measuring Soft Skills in Cybersecurity

Introduction

It’s easy to assign a grade to a lab or a test. But how do you evaluate something like adaptability under pressure or collaborative leadership during an incident response?

In cybersecurity education and early career development, we often say that soft skills matter. Yet, we rarely measure them with the same intent and structure as we do technical ones.

In this post, we tackle the next step in our series: How do you know when someone’s getting better at the people-side of cyber work?

Why Assessment Matters

If we want students or junior analysts to take soft skills seriously, we must build clear signals of progress. Soft skill development should be:

  • Visible: Students need to see what “good” looks like
  • Trackable: Instructors need a way to show growth over time
  • Actionable: Feedback should guide improvement, not just evaluation

Whether you’re an educator or a team lead, that means moving from vague feedback (“work on communication”) to specific markers (“improved your briefing summary from 500 to 200 words while maintaining clarity”).

Ways to Assess Soft Skills

1. Reflection Journals

After each lab or simulation, have students reflect on questions like:

  • What communication decisions did I make?
  • Where did conflict arise, and how did I handle it?
  • What would I do differently next time?

2. Peer Reviews with Structure

Use peer evaluation forms tied to behavioral indicators like:

  • “This team member communicated clearly during planning sessions.”
  • “This person helped de-escalate tension during the exercise.”

Weight these as part of the assignment or simulation grade.

3. Roleplay + Observation Rubrics

Include non-technical roleplay scenarios (e.g., breach disclosure, executive briefings, IR debriefs). Evaluate on:

  • Clarity
  • Tone adaptation
  • Confidence under questioning

4. Instructor Observations in Real Time

Use rubrics or shorthand to record behaviors as students work:

  • Did they ask clarifying questions?
  • Did they loop in stakeholders?
  • Did they acknowledge others’ input or steamroll?

Mini-Lesson: “Reflecting After the Storm”

Scenario: Students have just completed a group tabletop IR simulation. Each played a role in responding to a phishing-based breach.

Task: Ask students to answer the following and submit it with their lab:

1. Where did your team experience the most friction? 2. What role did you play in resolving or worsening it? 3. What communication or leadership skills did you notice in others that you want to develop?

Optional: Ask each student to give one piece of constructive feedback to another team member.

For the Workplace: Performance Check-Ins

Entry-level team leads or SOC managers can adopt the same tools:

  • Add a soft skills growth section to performance reviews
  • Use light journaling in debriefs (1-2 sentences)
  • Request peer kudos or improvement notes quarterly

What’s Next

In Part 6, we’ll explore the capstone: building psychological safety and team culture in cybersecurity environments—where asking questions, owning mistakes, and speaking up are not only allowed but expected.

Because no one grows in silence. And no team thrives in fear.

Stay reflective. Stay intentional. Stay growing.