Cyber Security Recruitment

Cyber security hiring has moved closer to engineering. The roles growing fastest sit inside the software lifecycle: application security engineers, DevSecOps specialists and cloud security engineers who make the secure path the easy one. Consortia's cyber security recruitment sits within our engineering practice, for companies from start-ups to enterprise.

We recruit across the security team: security engineers and security architects, application security, cloud security and DevSecOps specialists, and the people who lead them, from information security managers to CISOs. Where a business is working towards SOC 2 or ISO 27001, that can include governance, risk and compliance roles too.

It is a market where the difference between a certificate and real capability matters. We recruit on permanent and contract terms across the UK, Europe, the US and the UAE. For senior appointments, we also place security leadership on a fractional or retained basis. One client brought in a fractional Head of Information Security through us to guide its SOC 2 and ISO accreditation.

How we recruit security engineers

Cyber security covers very different jobs, so we start with what the business needs to protect and why now. An enterprise customer's security questionnaire, an accreditation deadline and a move to the cloud each point to a different hire. Agreeing that first tells us whether to look for an engineer, an architect or a security leader.

Many of the security roles we recruit are a company's first dedicated security hire. That person stays hands-on, building DevSecOps tooling, securing pipelines and working across Kubernetes and Terraform. Within a year or two they may be leading the function. We assess for the engineering now and the potential to lead later.

Candidates walk us through what they have secured in production, the clouds they know well and where their gaps are. We ask how they approach threat modelling and how they work with development teams. A gap in one provider, such as GCP, is often workable when the underlying engineering is strong. Many DevSecOps candidates come from DevOps and platform engineering, so we look there too.

Security processes often reach beyond the technical team. Candidates may meet engineers first, then a director on business risk, then the CTO and CEO, sometimes with a 90-day plan to present. We prepare candidates for each stage, debrief them straight afterwards and chase the client for feedback.

Experienced security engineers can expect more than the approved band, so we share the ceiling on the first call. Some senior candidates only work on contract, and we check early whether the client will consider that.