Hiring on the Autism Spectrum

It’s always nice when doing good intersects with smart business practices. One set of researchers is proposing that people high on the autism spectrum, who frequently have difficulty finding good jobs, may be particularly well-suited to info security careers.

The Autism Society reports that 1 out of 68 Americans live with Autism Spectrum Disorder – about 3.5 million people; the advocacy group Autism Speaks says that only 14 percent of them have full-time paid work. The British National Crime Agency found in 2017 that that ASD “appears to be more prevalent amongst cyber criminals than the general populace,” although appears to be no quantitative data that specifies the percentage of cyber security professionals with ASD.

A panel at this summer’s Black Hat conference presented a study that surveyed 290 computer security pros who had been diagnosed with Autism Spectrum Disorder. Results from the online survey indicate that ASD workers experience trouble with sensory issues including ambient noise and high-traffic social areas. They also report incidences of bullying and stressful relationships with co-workers.

“We always try to push people to be innovative and think outside the box,” said Casey Hurt, member of the panel and an information security manager for the US government, said in an interview. “And most people with autism don't have a box to start thinking outside of, so they're able to look at a problem from views that I could never imagine. When it comes to complex problems that don't have a starting point, they're able to tackle them in a way unlike most of my other employees.”

Hurt is a former boss of Rhett Greenhagen, 31, who was diagnosed with autism at the age of 14 and has been working for the US military and in the intelligence community for more than 10 years. What sets people like Greenhagen apart from his peers, Hurt said, is his ability to see patterns in what appears to be masses of undifferentiated data. “There was no doubt I could hand someone like Rhett a massive log file of 700 to 800 gigabits of pure text and he would find things that most analysts wouldn't be able to find. Which lead to the ability to build dashboards of stuff that we wouldn't have had otherwise.”

Greenhagen says that he’s always worked in infosec, except for a short time as a Windows sysadmin (which both Hurt and Greenhagen say he wasn’t very good at). “It was always around hacking, it was always around cyber security. Most of it was just intelligence-based. I just came to find out that I'm highly technical and highly intelligent; it just meshed into one. It's all I've ever done.”

But that success comes at a price: Hurt says a manager has to be aware of the particular requirements of an ASD employee and find ways to work with their atypical backgrounds and needs. Those, inevitably, affect the rest of a team, too.

“Instead of having 28 analysts all doing the same thing” and typically working an entire project from end to end, Hurt said, “I had people that were a little more customer-facing and people that were a little more data-facing in datacentric type jobs, to allow group A to feed into group B. It definitely changed my perspective on how I look to manage my teams going forward.”

Also, the survey noted that a “normal” office environment is not always right for someone on the autism spectrum. Changing that, though, may look like favoritism. “The more that people saw the value of what was coming out of what Rhett was doing, that kind of fixed itself,” Hurt says. “But you had to deal with the perception upfront.”

Greenhagen says that interpersonal communication is frequently a problem for him, and something he’s worked hard at, but still feels keenly that he is envious of other people’s skills at doing things like changing a tire while others are envious of his professional abilities.

“It was very interesting to see how alienated a lot of the people in the industry who are on the autism spectrum felt,” Hurt says of the study. “For a lot of people, it seemed hard to differentiate between the way they view the world and other people and how that impacted those interactions at work and their long-term employment.” It’s hard to get employers to “recognize that there is someone with an extremely valuable talent that they need to work around properly to take advantage of.”

Finding someone with that particular talent set requires looking outside of the usual channels. Greenhagen says he bounced from college to college, never getting a degree, and gets work essentially by being handed from boss to boss.

“I haven't interviewed for a job in a very, very long time. Greenhagen says. “I haven't even had to have a resume in a really long time because I kept on getting passed from manager to manager to manager to manager. I'd get bored at one place and they knew it was time for me to leave so they'd help me find another job. That's just the way it's always been.”

“It definitely comes down a lot to respect and trust, that once I trusted Rhett that there's no doubt that he's being honest with me,” Hurt says. “And vice versa. Rhett had to trust me, or we weren't gonna get anywhere. And I really think that was the key to being a manager in that situation.”