What I Look For When Mentoring Someone New to Security

What actually predicts whether a junior security hire will grow?

Here's genuinely what I look for before deciding how to mentor someone new to the field.

Not raw technical knowledge — that's teachable. What I actually look for: does this person ask "why" persistently, are they honest about what they don't know instead of bluffing, and do they follow through on small commitments consistently.

Those three predict long-term growth far better than how much they already know on day one.

Why do habits matter more than current knowledge at this stage?

Because technical knowledge has a short half-life at the start of a security career — frameworks change, tools change, and most of what someone knows in month one will be superseded within a year regardless of how much they knew going in. What doesn't get superseded is whether they keep asking why instead of memorizing the what, whether they're honest when they hit the edge of their knowledge instead of guessing confidently, and whether a small commitment — reviewing a doc, following up on a finding — actually gets done without being chased.

Those three habits compound. Someone who persistently asks why builds real understanding instead of pattern-matching. Someone honest about gaps gets corrected quickly instead of embedding a wrong mental model. Someone who follows through builds the kind of trust that eventually gets them handed bigger, more ambiguous problems — which is exactly the path toward architecture-level work.

Key Takeaways

Technical knowledge is teachable; judgment and habits are the harder, more predictive signal

Persistently asking 'why' predicts growth better than current knowledge does

Honesty about gaps beats bluffing every time

Consistent follow-through on small commitments is a leading indicator of reliability at scale

FAQ

Should mentors focus more on technical skills or soft skills for junior security people?

Neither exclusively — technical skills are teachable and will develop with time and exposure. What's harder to teach, and worth screening for early, are habits like persistent curiosity, honesty about gaps, and follow-through — those predict whether the technical growth will actually happen.

How do you tell if someone new to security is honest about what they don't know, versus bluffing well?

Ask a question slightly outside what you'd expect them to know and watch the response. Someone comfortable saying 'I don't know, let me find out' is showing exactly the trait worth investing in; someone who improvises a confident-sounding but vague answer is showing the opposite.

Is mentoring junior security professionals a good use of time for someone building toward architecture roles themselves?

Yes — mentoring is itself a leadership signal that hiring CTOs and VPs look for, not just a favor to the mentee. Explaining the 'why' behind technical decisions to someone earlier in their career also sharpens the mentor's own reasoning, which compounds directly into architecture-level thinking.