They also make sure that the bank's executive leadership understands the role that the incident response teams play and that individuals are recognized for their work. "Rewards are temporal, but sincere recognition is something you can do consistently. The entire team can understand the impact of that," Polly says.
Training and education are also important for incident response team members, leaders say. "I hire people who are very interested in growth, development and continuous improvement, so I work on getting them training to learn new things," Stroeh says. "That's what they really like to do."
5. Encourage competition
Security pros thrive on challenges, team leaders say, and security competitions like Capture the Flag events can play an important role in keeping team members energized. "Make sure they have the opportunity to go and challenge themselves and see how they compare to others," says Borandi, whose team members attended competitions. "The day-to-day grind is never quite as exciting as competing. People also tend to make themselves sharper on their own just preparing for those events," he adds.
Looking at the bigger picture, most companies face the same universal security threats and challenges, so the biggest differentiators that an employer can offer, other than salary, are engagement and growth.
"As long as you make sure you're paying attention to them, valuing their knowledge, giving them the tools they need and keeping them educated," Gadsby says, chances are security pros will stay on the team.
Sign up for CIO Asia eNewsletters.