Hiring and Retaining IT Talent: A Practical Guide for IT Leaders

Few decisions shape an IT department more than who you hire and who you keep. A strong hire can stabilize a fragile system, mentor others and raise the bar for the whole team. A poor fit, or a steady trickle of departures, drains time, knowledge and morale.

Most IT leaders were promoted for technical skill, not recruiting skill. The good news is that hiring and retention are learnable, and many of the levers are within a manager's control. This guide covers the labor market context, defining roles, running a fair process, onboarding and the everyday work of keeping people.

Throughout, check your plans with human resources, which will know the employment laws and internal policies that apply to you.

Understand the market you are hiring in

The US Bureau of Labor Statistics (BLS) projects that employment in computer and information technology occupations will grow faster than the average for all occupations from 2025 to 2035, with about 280,000 openings projected each year, on average. BLS reports the median annual wage for this group was $109,470 in May 2025, compared with $50,980 for all occupations.

Some roles are especially competitive. BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035, and reports a median annual wage of $129,180 for the role in 2025. For computer and information systems managers, the category that includes IT directors and CIOs, BLS projects 16 percent growth over the same decade and reports a median wage of $175,140.

National medians are not your local market, and pay varies widely by industry, region and seniority. Use them as context, then check local salary data with HR before setting a range. If your pay band is well below market, no amount of process improvement will fix your hiring.

Define the role before you write the posting

Weak job descriptions are often a list of every technology the team has ever touched. Instead, start with outcomes:

• What should this person have accomplished after six and twelve months?
• Which skills are truly required on day one, and which can be learned on the job?
• Who will they work with, and what decisions will they own?

For security roles, NIST's NICE Framework (SP 800-181 Rev. 1) offers a "common language that describes cybersecurity work and the knowledge and skills needed to complete that work." It is built from task, knowledge and skill statements grouped into work roles, and NIST notes that organizations use it to "create job descriptions and assess candidate skills." Even outside security, the habit of describing a role as tasks plus knowledge plus skills makes postings clearer and interviews more focused.

Be honest about requirements. Listing degrees, certifications or years of experience that the work does not need narrows your pool without improving quality.

Run a fair, skills-focused process

A consistent process is both fairer and more predictive than unstructured conversation.

1. Agree on the evaluation criteria before reviewing any résumés.
2. Use structured interviews: the same core questions for every candidate, with a simple scoring guide.
3. Include a realistic, bounded work sample, such as troubleshooting a described outage or reviewing a short script. Keep it short, and consider paying for anything that takes more than an hour or two.
4. Use a small, varied interview panel and collect scores independently before discussing.
5. Move quickly and communicate clearly. Strong candidates often have several options, and long silences lose them.

Ask HR which questions are off limits in your jurisdiction, and keep notes focused on job-related evidence.

Onboarding that sets people up to stay

The first weeks shape whether a new hire feels they made the right choice. Make sure accounts, hardware and access are ready on day one. Assign a buddy who is not their manager. Share a 30-60-90 day plan with early, achievable wins, and give access to documentation and architecture overviews. Check in often during the first month, and ask what is confusing; fresh eyes spot gaps the team no longer sees.

Retention: the work never stops

Many reasons people stay or leave are within a leader's reach: the quality of the work, growth, fairness, recognition, workload and the tools they use. DORA, the long-running research program on software delivery, reports that "increased well-being predicts organizational performance and employees' job tenure." It also lists six organizational burnout risk factors identified by Christina Maslach: work overload, lack of control, insufficient rewards, breakdown of community, absence of fairness and value conflicts.

Practical retention habits:

• Hold regular one-on-ones that include career goals, not just status updates.
• Run "stay interviews": ask what keeps people here and what might make them leave, then act on what you hear.
• Review pay against the market at least annually, and advocate for adjustments before someone resigns.
• Offer a technical career path so senior engineers can grow without becoming managers.
• Fund training and certifications tied to the team's direction.
• Spread on-call fairly and protect recovery time after heavy incidents.
• Recognize good work specifically and publicly, when the person is comfortable with it.

Build your own pipeline

Hiring only experienced people from outside is slow and expensive. Growing talent internally is often more reliable. Create visible paths, such as from service desk to systems administration, or from systems administration to security. The NICE Framework notes that organizations use it to "develop employees through role-based training and career planning," which can help you map what each step requires. Internships, partnerships with local colleges and apprenticeship programs can also widen your pipeline.

For example, imagine a regional health system that struggles to hire security analysts. It might identify two service desk technicians with an interest in security, give them a structured plan with training and mentored shifts with the security team, and fill a junior analyst role from within in a year.

When people leave

Some turnover is healthy. Hold respectful exit conversations, look for patterns rather than reacting to one comment, and make knowledge transfer routine long before anyone resigns through documentation and shared ownership of systems. Leave the door open; people who leave on good terms sometimes return, and they talk about how they were treated.

Key takeaways

• BLS projects faster-than-average growth for computer and IT occupations from 2025 to 2035; check local pay data before setting ranges.
• Define roles by outcomes and real requirements; the NICE Framework's tasks, knowledge and skills model helps.
• Use structured interviews and short, realistic work samples, and move quickly.
• Retention depends on growth, fairness, workload and recognition, which managers can influence.
• Build internal pathways so you grow talent rather than only buying it.

Sources

• U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Computer and Information Technology Occupations
• U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts
• U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Computer and Information Systems Managers
• NIST, NICE Framework Resource Center
• NIST, SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework) (November 2020)
• DORA, Well-being