Where to Hire a Cybersecurity Expert

Cybersecurity is six different jobs that wear the same name on a CV. Hiring well starts with knowing which of them you're hiring.

Virtual / fractional CISO. Strategy and governance — risk register, policy framework, board-level reporting, vendor security review, incident response plan. The job is mostly meetings and documents, not configuring systems. Best fit when the company has grown past the point where security is 'something IT does on the side' but isn't ready for a full-time CISO. Engagement: typically 1–4 days/month over 12+ months.

Penetration tester / offensive security. Active, hands-on probing of an application, network, or cloud account to find what an attacker would. Output is a report listing vulnerabilities by severity, with reproduction steps and remediation guidance. A pentester is not the same person as a CISO — the skill set is genuinely different. Engagement: usually a fixed-scope 1–4 week project, repeated annually.

SOC / detection and response build-out. Designing or operating the monitoring stack (SIEM, EDR, log aggregation, alerting playbooks). The work is half tooling, half process — what gets logged, what triggers an alert, who responds, how fast. Best fit when you've decided to build (or outsource the build of) 24×7 monitoring. Engagement: 3–9 months for build, ongoing for run.

Compliance / GRC. Driving an SOC 2, ISO 27001, HIPAA, or similar audit. Mostly evidence collection, control documentation, and gap remediation. The first audit cycle is the hard one — 4–9 months of work. Subsequent years are 6–10 weeks. Important: a GRC consultant is not the same as a security engineer. They will get you through audit, but they will not necessarily make you more secure.

Application security. Threat modelling, secure code review, SDLC integration, dependency management, fixing the long tail of OWASP-class issues in your codebase. Best fit alongside (not instead of) your engineering team — the consultant trains the team rather than fixing every issue themselves.

These specialties don't substitute. A pentester running your SOC 2 will produce a stilted audit; a GRC consultant running a pentest will produce a checklist, not a report. Hire for the specific job.

Cybersecurity has more certifications than almost any other field. Most are signal, not proof. A few mean something specific.

• CISSP (Certified Information Systems Security Professional). Broad knowledge across eight security domains; requires five years of paid security experience to sit. A CISSP indicates a working professional, not a specialist — useful for CISO and senior generalist roles, less informative for hands-on pentest or AppSec hiring.
• OSCP (Offensive Security Certified Professional). The most respected practical pentest credential. Earned by completing a 24-hour hands-on exam exploiting real systems. Strong signal that the candidate can actually run a pentest. OSEP / OSWE / OSED are advanced variants for evasion, web exploitation, and exploit development respectively.
• ISO 27001 Lead Auditor (typically PECB, BSI, or IRCA-certified). Means the holder has been formally trained to conduct ISO 27001 audits. Strong signal for GRC work, especially if you're pursuing certification yourself. Note: 'Lead Auditor' and 'Lead Implementer' are different — one audits, the other implements.
• CISA / CISM (ISACA). CISA = audit focus, common in financial services and large enterprises. CISM = management focus, often paired with CISSP for senior roles. Less informative for hands-on technical work.
• CEH (Certified Ethical Hacker). Multiple-choice exam with low practical content. Treat as a baseline credential rather than a differentiator for pentest hires.

What matters more than the alphabet soup: ask the candidate to walk through a recent engagement in their own words. Specifics — the system they tested, the bug they found, the fix they recommended — distinguish a credentialed practitioner from a credentialed paper-tiger.

If you've never hired a security consultant, the temptation is to ask for 'a security audit'. That phrase covers a hundred different deliverables. Here is a more useful frame.

Start with a 1–2 week security posture review, not a pentest. The consultant talks to your team, reads your current docs (or notes their absence), looks at your cloud account, repo, and production environment, and produces a prioritised list: the three or four things that, fixed first, will reduce most of your real risk. This is much cheaper than a pentest and almost always more valuable for an organisation early on its security journey — pentests are useful, but only after the obvious gaps are closed.

If a pentest is genuinely the right next step (often because a customer or auditor demands one), scope it tightly. 'Web application pentest, scope = these three URLs, in-scope = unauthenticated and authenticated user roles, out-of-scope = denial-of-service, social engineering, third-party integrations.' Vague scope produces vague reports. A serious pentest costs roughly $8–25K for a scoped web app, more for complex infrastructure or red-team engagements.

Whatever the engagement, ask for a sample report (anonymised) before you sign. The report is the deliverable. If the sample is a list of CVE IDs with no business context, the engagement will produce the same.

Honestly: a consultant is not always the right answer.

• Very small companies with limited customer data and no compliance pressure. Two engineers using a managed cloud platform with sensible defaults are probably more secure than the same two engineers chasing a 30-page consultant report. Spend the consulting budget on a password manager, MFA enforcement, and an automated dependency-scanning tool first.
• Standard threat detection at small scale. Below roughly 50 employees, an MSSP (managed security service provider — for example Arctic Wolf, Expel, Red Canary, Huntress) typically beats a part-time consultant on cost and coverage. The consultant is the right hire later, when you need someone to manage the MSSP relationship and own the risk register.
• When the gap is tooling, not strategy. If you don't have MFA, don't have backups, don't have an EDR, the answer is to buy and deploy those — not to commission a consultant report telling you to. A consultant adds value when there are choices to make, not when the next move is obvious.
• You have an in-house security lead with the relevant audit experience. Bringing in a GRC consultant on top of an internal lead who has run the audit before adds cost without adding capability — better to give the internal lead the budget and time.

If your situation fits one of these, the platforms in the table above are still useful for one-off specialist work — a posture review, an annual pentest, a SOC 2 readiness assessment — but you may not need an ongoing consultant.