Building a security team: which roles to hire first

You do not build a security team by hiring five people at once. The order of your hires matters as much as their quality: a SOC analyst with no tooling or processes gets bored, a CISO with nobody to execute burns out. This guide sets out a realistic sequence for going from no dedicated resource to a small, solid team, and separates what is best kept in-house from what you can hand to providers.

Start from your risks, not from a template org chart

Large-company org charts get shared a lot: CISO, governance, architecture, SOC, CSIRT. Copying them as they are leads you to hire roles you do not need yet. Before you draw the team, answer four simple questions.

What would cost you most in an incident? Production at a standstill, exposed customer data, an online platform going down.
Which obligations apply to you? Contractual requirements from customers, NIS2 depending on your sector and size, GDPR for personal data (the French regulator CNIL publishes useful guidance on data security).
Where does your IT estate live? Mostly in the cloud, on premises, or in industrial environments.
Who already does security, even without the title? A meticulous sysadmin, a security-minded developer, a managed service provider.

The answers shape your first roles. A SaaS company running entirely in the cloud does not have the same priorities as a manufacturer just discovering the security of its plants.

The first role: someone who decides and does

Your first hire lays the foundations. They need to assess the current state, prioritise, convince leadership and get hands-on with the technology. That is usually an experienced generalist security engineer or a hands-on security manager. We cover this choice in our article on hiring your first security profile in an SME.

If your exposure calls for strategic leadership from day one but the budget does not yet stretch to a full-time CISO, a fractional CISO can guide this first hire. Our comparison of fractional and full-time CISOs helps you decide.

A four-step hiring sequence

There is no universal order, but one logic comes up often: lay the groundwork, secure the technical foundations, gain visibility, then structure governance. The table below sums up a common sequence, to adapt to your own risks.

Step	Typical role	What it brings	Sign it is time
1	Generalist security engineer or hands-on security manager	Current-state assessment, roadmap, first hygiene projects	Nobody dedicated, risks identified but not addressed
2	Specialist in your main environment (cloud, application or OT)	Security built in where your estate is concentrated	The first hire is swamped by technical work in a single area
3	Detection-focused security analyst	Ability to see and triage alerts, management of the monitoring provider	Logs exist but nobody uses them
4	GRC analyst or CISO, depending on size	Compliance, risk management, handling audits and customers	Questionnaires and audits crowd out technical work

Step 2: specialise where your estate lives

Once the basics are in place, the first hire is often buried in work from one area. If your business runs on the cloud, a cloud security engineer takes on configurations, identities and automation. If you build your own products, an application security engineer brings security into the development lifecycle. This second hire frees the first one to lead.

Step 3: gain visibility

Building an in-house SOC is rarely realistic for a small team: round-the-clock monitoring takes several people and on-call rotas. The most common answer is to outsource monitoring and hire an in-house analyst who can manage that provider, triage the alerts that matter and improve detection rules. Our guide to hiring a SOC analyst lists the skills to check.

Step 4: structure governance

When customer audits, compliance and risk management take up a large share of the time, a GRC analyst takes that load off the technical team. In more exposed organisations, or beyond a certain size, this is also the moment to hire a full-time CISO if you did not do so at the start.

In-house or outsourced: making the right calls

A small team cannot do everything. The point is to keep in-house what requires a deep understanding of your company, and hand the rest to providers you know how to manage.

Keep in-house:

the roadmap and priority calls;
knowledge of the architecture, access rights and critical assets;
managing providers and checking their work;
the relationship with leadership, business teams and customers on security topics;
coordination during an incident.

Often worth outsourcing:

continuous monitoring (managed SOC), especially nights and weekends;
penetration testing, which benefits from an outside eye;
large-scale incident response, with a provider lined up in advance (in France, ANSSI publishes information on qualified providers at cyber.gouv.fr);
compliance and certification audits.

A simple rule: never outsource an activity that nobody in-house can manage. A provider without a competent counterpart produces reports nobody reads.

The most common sequencing mistakes

Hiring a lone CISO with no means to execute. Policies get written, nothing changes on the ground, and the CISO eventually leaves.
Hiring juniors first. Without an experienced profile to guide them, they progress slowly and pick up habits that are hard to correct.
Building an in-house SOC too early. Analysts spend their days on badly tuned alerts and burn out quickly.
Buying tools before hiring people. A tool nobody operates is expensive and protects very little.
Forgetting continuity. A one-person team has no cover during holidays and no second opinion on big decisions. Plan who steps in, even through a provider.

Hire a team, not a collection of profiles

Each new role should complement the ones before it. Before every hire, ask three questions: which skill is missing today, who will guide the new hire, and which work from the previous role will they free up.

Consistency matters in assessment too. Involve the person already in post in interviews: they know the ground and can judge whether a candidate fills a real gap. For technical skills, favour hands-on exercises over claims. Our article on assessing security skills beyond the CV covers the methods that work.

Finally, think about what the team offers candidates. Experienced profiles are drawn to places where they can build, but they want guarantees: a sponsor in leadership, an identified budget, a clear path for the team. Describing that path in your job ads, even in broad strokes, reassures them and sets you apart.

In short

Building a security team starts with choosing an order. Begin with an experienced profile who decides and does, then specialise where your estate is concentrated, gain visibility by managing a monitoring provider, and structure governance when compliance demands it. Keep leadership and knowledge of your environment in-house, and outsource what a small team cannot hold on its own.

Building your security team and looking for the right profiles in the right order? At Cyber Recrut, a recruiter and a security practitioner help you define each role, and our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your project.