Cyber recruitment firm or in-house hiring: how to choose
Cyber recruitment firm or in-house hiring: the criteria that decide it for each role, your resources and urgency, with a practical decision grid.
Should you hand a security hire to a recruitment firm or run it yourself? The question comes back every time a role opens, and the answer is not the same for a junior SOC analyst as for a first CISO. This guide sets out the criteria that actually matter, compares both options honestly and gives you a grid to decide role by role.
What you are really buying
Hiring is not just posting an ad and reading CVs. A successful security hire chains several distinct tasks, and each one is where in-house and external should be compared:
- Scoping the need: turning a security problem into missions, must-have skills and a seniority level.
- Finding candidates: beyond those who apply, reaching people in post who never look at job ads.
- Assessing technical skills: checking that someone can really do what their CV claims.
- Persuading: presenting the role credibly to candidates who are approached from all sides.
- Closing: running the offer, handling a possible counter-offer and staying in touch until day one.
A generalist HR team often covers points 4 and 5 very well. Points 1, 2 and 3 are where security raises specific difficulties.
The strengths of in-house hiring
Hiring in-house has real advantages that should not be underestimated.
- Knowledge of the company: your teams know the culture, the projects and the people the new hire will work with. They know what makes someone succeed with you.
- Control of the process: you set the pace, the stages and the message, with no intermediary.
- Direct cost: no fees to pay. The real cost is your teams' time, which is often left out of the calculation.
- Employer brand: every successful direct hire feeds your network and makes the next one easier. Our article on employer branding in cybersecurity covers what weighs most for candidates.
In-house works well when three conditions are met: someone on the team can assess the target role, the role naturally attracts relevant applications, and decision makers have the time to run a fast process.
The limits that show up in security
The difficulties rarely come from a lack of goodwill. They stem from the market and the nature of the roles.
Strong profiles don't apply. Many experienced professionals are in post and don't browse job ads. Even a well written ad mostly reaches people who are actively looking. You need direct outreach, which takes time, a network and a credible technical pitch.
Technical assessment needs a practitioner. A title such as "pentester" or "cloud security engineer" covers very different realities. Without someone able to run the technical interview, teams fall back on certifications and keywords, which say little about real ability. Our guide to structuring a technical interview without being an expert helps, but it does not replace a practitioner for specialist roles.
Available time. Hiring comes on top of day-to-day work. Slots get scarce, debriefs slip and the process stretches while candidates accept elsewhere. Our article on time to hire in cybersecurity shows where those weeks go.
The first role. When you hire your first security person, nobody in-house knows the job yet. It is the hardest case, covered in our guide to hiring your first security profile in an SME.
What a specialist firm brings, and what it doesn't
A firm is only useful if it makes up for exactly those limits. Before signing, check what it actually does.
What a good specialist firm should bring:
- Demanding scoping: it challenges the job description, separates must-haves from nice-to-haves and warns you if pay does not match the level you expect.
- Real sourcing: targeted direct outreach, not just posting your ad on the same sites you already use.
- Real technical assessment: someone who knows the job has checked the skills before a candidate reaches you.
- A short, reasoned shortlist: a few solid profiles with a clear summary of their strengths and limits, rather than a pile of CVs.
What a firm will not do for you:
- Decide: the final choice, and responsibility for the hire, remain yours.
- Replace your involvement: a firm cannot make up for unavailable decision makers or a need nobody has signed off.
- Make the role attractive if it isn't: below-market pay or a vague scope will remain obstacles.
Be wary of unsupported numerical promises, such as a guaranteed time to hire or a success rate shown without method. A hire depends as much on your role and your process as on the firm.
Comparing fee models
How a firm charges shapes how it works. Amounts vary between firms and roles: always ask for a written proposal and compare like for like.
| Model | Principle | What to check |
|---|---|---|
| Success fee | You pay only if a candidate they present is hired | Calculation basis, replacement guarantee, any exclusivity |
| Retainer then balance | Part at signature, the rest on hiring | What is owed if the search does not succeed |
| Fixed fee or project | A set price for a defined assignment | Precise deliverables, number of candidates, duration |
The success fee model aligns interests: the firm is paid only if you hire. In return, it assumes you play your part, with quick feedback and a calendar you stick to.
The decision grid, role by role
Rather than a decision of principle, decide case by case. Ask these questions for each role:
| Question | If yes | If no |
|---|---|---|
| Can someone in-house assess this role? | In-house is an option | External technical support becomes valuable |
| Does the role attract relevant applications? | An ad may be enough | Direct outreach is needed |
| Do decision makers have time in the coming weeks? | You can run the process | Delegate sourcing and screening |
| Is it a role you already have in the team? | You have a model of success | Scoping benefits from an outside view |
| Is the need urgent? | Every week counts, add resources | You can try in-house first |
The more you land in the right-hand column, the more likely a specialist firm will save you time and help you avoid a bad hire.
Combining both approaches
The choice does not have to be exclusive. Many companies keep in-house the roles they know how to fill and give a firm the ones that are rare, specialist or new. Others start the search in-house and bring in a firm if the first weeks produce no strong candidate.
Either way, a few rules prevent friction:
- One message to the market: if a firm approaches candidates for you, align the pitch on the role, pay and process.
- Tracked applications: agree upfront on the rule when the same candidate comes through the firm and another channel.
- One assessment grid: whether a candidate comes in-house or through the firm, judge them on the same criteria, for example those in our guide to assessing skills beyond the CV.
In short
In-house hiring fits when you can assess the role, the role draws applications and your teams have the time. A specialist firm makes sense when one of those is missing: a rare profile, a first security role, no expertise for the technical interview, or urgency. Either way, the quality of your scoping and the speed of your decisions remain decisive.
Unsure how to handle your next security role? At Cyber Recrut, a recruiter and a security practitioner scope the need with you, run direct outreach and present a shortlist of candidates who have proven their skills on hands-on labs. You only pay if you hire. See how we work or tell us about your need.