Likely the same disconnect in infosec: wanting to hire someone with years of experience in a particular domain. Rules out people with related experience and rules out people just starting. Solution is to hire and train people, that’s how we filled last 2 infosec roles.

There are privacy roles where you have to be an attorney and roles where you don’t. I was speaking to the latter, as I’ve been turned down in the past for not enough direct experience. For attorneys, I don’t know what criteria is used, sounds like more than just experience?