Cybersecurity advocates: discovering the characteristics and skills of an emergent role

PURPOSE: Cybersecurity advocates safeguard their organizations by promoting security best practices. However, little is known about what constitutes successful advocacy. METHODOLOGY: We conducted 28 in-depth interviews of cybersecurity advocates. FINDINGS: Effective advocates not only possess technical acumen, but also interpersonal skills, communication acumen, context awareness, and a customer service orientation. ORIGINALITY: We are the first to define and enumerate competencies for the role of cybersecurity advocate. IMPLICATIONS: Non-technical skills are deemphasized in cybersecurity training, limiting career progression into the cybersecurity advocate role for existing security professionals and those from other disciplines. We suggest improvements for professional development that encourage greater security workforce diversity.