In the first article in this series, Los Angeles County Sheriff’s Department Sergeant Peter Hish outlined three foundational decisions agencies should make before launching a cyber unit. Now he takes a closer look at one of the most consequential: staffing. From identifying the right aptitude to balancing sworn and civilian roles and retaining highly trained personnel, Hish explains why building the right team requires more than simply selecting strong investigators and sending them to training.
By Sergeant Peter Hish
In the first article in this series, I laid out three decisions that decide whether a new cyber unit is still working two years in: mission scope, federal partnership posture and staffing. Staffing got one section, but it deserves its own article because it is the decision agencies underplan the most and the one that quietly sets the ceiling on everything else.
Here is the mistake I see most often. A chief budgets for a cyber unit the way the agency budgets for detectives. Post the positions, pick strong investigators, send them to training, stand back. That plan feels responsible. It is also how units end up thin in every direction at once.
A cyber unit is not one job with a training add-on. It is three different crafts, each calling for a different aptitude. The hardest part of building it is not training people. It is selecting the right people to train in the first place.
| RELATED: Building a cyber unit? Make these three decisions first
Selection before training
Start with the uncomfortable truth because the whole staffing plan turns on it. Not every strong detective has the aptitude to learn networking, security and digital forensics. Not every sharp crime analyst can be taught to trace cryptocurrency across chains. This is not a knock on good investigators. It is a recognition that this is a different kind of work, closer to how an engineer thinks than how a detective works a room.
Most staffing plans skip this. They assume a motivated investigator plus a training budget equals a cyber investigator, given enough time. Sometimes that is true. Often it is not, and the failure is expensive in a specific way. You select someone, you send them to a course booked 12 months out, you pay for the seat and the travel and the year of ramp-up, and somewhere in month eight everyone in the room quietly understands the fit was wrong. Now you have burned the seat, the budget and the year, and you still have to backfill the position.
The fix is to select for aptitude before you spend a training dollar. You are not looking for someone who already knows the tools. You are looking for the person who takes a system apart to understand it, who is comfortable being a beginner again, who reads the documentation for fun and who chases a problem past the point where most people would hand it off. Give the candidate a real problem to work through. How they approach it will tell you more about their aptitude than an interview question or resume ever will.
This is a different kind of work, closer to how an engineer thinks than how a detective works a room.
Selecting for aptitude solves only half the problem. Cyber is a profession in its own right, and it is rare to find someone who is already both a strong investigator and ready to do cybersecurity or digital forensics work. When an agency does find that person, its own hiring rules can still keep them out of the seat. Union contracts built around seniority and bidding rights, fair-hiring requirements set by city councils and county boards, and promotional exams that were never built to measure this kind of aptitude can all stand between a chief and the one candidate who fits.
I watched this happen. I had an investigator who was exceptional at the job and had strong cyber skills on top of that. They had cyber training and were already applying those skills to their casework. They were in their current seat for one reason: It was the job they had applied for.
When the cyber investigator position opened, they were the strongest fit we had. But they were screened out during the situational judgment portion of the exam, a psychometric assessment built around hypothetical workplace scenarios that had nothing to do with the position. The assessment never measured what the job actually required. They scored below the cutoff and could not advance.
The unit did not lose a candidate because they lacked the aptitude. It lost them because the hiring process was never designed to identify it.
A staffing plan that never asks whether the agency’s own hiring process can place the right person is missing a decision, not just a step. Find out what your process will and will not let you do before you need it, not while a qualified candidate is sitting in front of you.
The three crafts
Once you accept that selection is the hard part, the next question is selection for what.
The cyber detective builds cases through subpoenas, search warrants, undercover personas, cryptocurrency tracing and testimony that survives cross-examination. This is investigative work with a technical layer on top.
The civilian analyst lives in data, using open-source intelligence, link analysis, blockchain analytics and structured-data mining. This is pattern work, the discipline of turning a pile of records into a picture.
The forensic examiner is closest to a lab role, handling device acquisition, image analysis, mobile-device extraction and the meticulous documentation that keeps evidence admissible. The temperament that makes a great examiner — patience, rigor and a tolerance for repetition — is not the temperament that makes a great undercover investigator.
Three jobs, three aptitude profiles. The agency that treats them as interchangeable produces a team that is passable at all three and strong at none, and it usually does not discover this until a case needs real depth in one of them.
The related decision is the sworn-and-civilian mix. Some of this work does not need a badge. The analytical craft can be done by civilians, often better and more cost-effectively than by pulling a sworn detective off the street to do desk work.
The case-building and forensic crafts are a different matter. Both involve search warrants, evidence handling, chain of custody and testimony, and both belong with sworn personnel. A staffing plan that gets the mix right puts civilians in analytical roles and keeps sworn personnel focused on work that carries a badge into court.
The analyst economics
Civilian analysts look like the budget-friendly option on the org chart. They cost less than a sworn detective and slot neatly into a data role. Then the agency tries to hire and keep one who can actually trace cryptocurrency, and the economics change.
An analyst with real cryptocurrency-tracing or advanced open-source skills is competing in the same market that bids for sworn cyber investigators, and that market includes the private sector. The more skilled the analyst becomes, the smaller the cost advantage gets, and an agency that planned around the paper number is short a seat it counted on.
This does not make the civilian analyst the wrong call. It makes the cheap-analyst assumption the wrong plan. Budget for what a capable analyst actually costs, or plan to grow one and hold onto them, but do not staff the unit around a number that only works until the person is good at the job.
The retention trap
Here is the trap every staffing plan walks into if no one designs against it. The moment your investigator becomes good, they become marketable.
A detective who has been selected well, trained and certified is a valuable private-sector hire. In Southern California, a cyber investigator with cellphone-forensics certification and a SANS credential is an $180,000 to $225,000 hire on the outside. The same is true of an analyst with cryptocurrency-tracing experience. You did not just train an investigator. You trained a candidate private industry is actively recruiting, and you did it on the public’s dime.
The cost of losing that person is not the salary line on the budget. It is the 12 to 18 months of ramp-up time the agency already paid for and now has to pay for again with the next hire. Two well-timed resignations can put a small unit back at the starting line, and the chief is explaining to council why a unit that briefed well last year has no depth this year.
The moment your investigator becomes good, they become marketable.
You cannot out-salary the private sector, and you should not try. What you can do is design the unit so that leaving is a choice, not a default. That means a written career path that shows an investigator where this assignment leads. It means a documented succession plan so no single departure guts the unit. At a minimum, it means a planned, respected return to patrol or detectives for the investigator who chooses to move on, so the assignment is a step forward in a career rather than a dead end. A unit without any of this is not retaining people. It is renting them until someone makes a better offer.
What a healthy staffing plan looks like at month 12
You can tell a real staffing plan from a hopeful one by what exists in writing at the one-year mark.
The three crafts are named and separated, and every person in the unit knows which one is theirs. Selection screens for aptitude, not just interest, and the unit can point to how it screens. The sworn-and-civilian mix is deliberate, with civilians in the analytical seats and sworn personnel on the case-building and forensic work that carries a badge into court. The analyst positions are budgeted at what capable analysts actually cost, not at the optimistic number. And there is a career path and a succession plan on paper, so the unit is built to survive its own success.
None of this requires a bigger budget than the agency already approved. It requires treating staffing as an organizational-design problem instead of a hiring checklist. The chief who does that has a unit that gets stronger as its people get better. The chief who does not trains talent for someone else to keep.
I should be plain about one thing. I built this unit and trained the people, and I lost some of them to the private sector before I learned to design for it. What I did not do is select them. My agency fills these positions from a ranked list produced by a competitive testing process, and the unit takes the next name on it. So none of this is latitude I had and used well. It is what I learned I needed, from a seat where I did not have it.
The training pipeline itself — the certifications, the sequencing and the year it really takes to get an investigator to independent casework — is a subject on its own, and the one I will take up in my next article.
About the author
Sergeant Peter Hish is a 27-year veteran of the Los Angeles County Sheriff’s Department, where he has supervised its cyber and fraud team for the past decade. He built the unit he describes in this article and now teaches the same material to incoming command staff through the National Public Safety Innovation Academy at Polk State College and the Regional Training Center in Fountain Valley. A U.S. Army veteran, he is the founder of Sentinel Vault, publisher of the Sentinel Vault Insights blog, and author of “Hacked or Hardened? The New Reality for Business Owners.”
