If I were Iris I would thank Gloria for her efforts in pre-screening applicants, and inform her that from now on I would be taking over the screening process. Gloria is simply not aware of what Iris is looking for in an applicant. Gloria does not understand Information Security certifications or why they are important. To avoid this situation in the future I would take the time to educate Gloria on the various IS certifications and the specific career experience necessary to qualify as a good candidate.
I would then select a group of candidates and invite them to interview. During site visits I would avoid secure and restricted areas so the interviewee would not be able to observe enough information about the operations to become a threat to the organization.
2. What, if anything, is wrong with the human resources focus depicted here? Examine the relationship between certifications and experience. Do certifications alone identify the job candidates with the most appropriate expertise and work experience?
It’s not entirely bad that HR is only focusing on certifications and not on the job experience. However, it is incomplete. A candidate with the proper real world experience can study for, and pass certifications exams with relative ease. Likewise, a certification without the proper real world experience is worth little more than the paper the certification is printed on. It’s not uncommon for a fresh college grad to have an IS certification with zero real world experience. I would not want such a candidate in charge of IS security at my site. HR needs to be educated on the optimal balance of certifications plus real world experience that each job opening requires.