Is cyber hiring too dependent on CVs and keyword matching?

Hey r/askrecruiters

Curious whether others feel the same way, but I think CVs are a pretty weak way to assess cybersecurity talent.

In a field like this, practical capability matters far more than how well someone writes a CV or whether they happen to have the exact keyword matches an ATS is looking for. Yet a lot of hiring still seems built around that.

I’ve been exploring a model where cyber professionals are assessed through role-specific challenges instead, across areas like SOC, Red Team, GRC, and AppSec.

What I’m trying to work out is:

• Would practical challenge-based profiles be more useful than CVs?
• What types of assessments would actually feel credible?
• Would a ranking system help, or just gamify something that should stay nuanced?
• What would make something like this trustworthy from an employer or candidate perspective?

I’d really like to hear from people in the industry because I think cyber hiring is still pretty broken in a lot of places.

Brutally honest views welcome.