How Consortia recruits cyber security engineers
Cyber security hiring has moved closer to engineering. The roles growing fastest sit inside the software lifecycle: application security engineers, DevSecOps specialists and cloud security engineers who make the secure path the easy one. Consortia's cyber security recruitment sits within our engineering practice, for companies from start-ups to enterprise.
We recruit across the security team: security engineers and security architects, application security, cloud security and DevSecOps specialists, and the people who lead them, from information security managers to CISOs.
For senior appointments, we also place security leadership on a fractional or retained basis. One client brought in a fractional Head of Information Security through us to guide its SOC 2 and ISO accreditation.
Cyber security covers very different jobs, so we start with what the business needs to protect and why now. An enterprise customer's security questionnaire, an accreditation deadline and a move to the cloud each point to a different hire. Agreeing that first tells us whether to look for an engineer, an architect or a security leader.
Candidates walk us through what they have secured in production, the clouds they know well and where their gaps are. We ask how they approach threat modelling and how they work with development teams. A gap in one provider, such as GCP, is often workable when the underlying engineering is strong. Many DevSecOps candidates come from DevOps and platform engineering, so we look there too.
Security processes often reach beyond the technical team. Candidates may meet engineers first, then a director on business risk, then the CTO and CEO, sometimes with a 90-day plan to present. We prepare candidates for each stage, debrief them straight afterwards and chase the client for feedback.
Experienced security engineers can expect more than the approved band, so we share the ceiling on the first call. Some senior candidates only work on contract, and we check early whether the client will consider that.
