Resigning in cybersecurity: notice period and handover

You have accepted a new offer: now you need to leave your current role. In cybersecurity, resigning is more than a letter and leaving drinks. You hold privileged access, secrets, sometimes a security clearance, and your colleagues rely on you for on-call. Here is how to announce your departure, understand your notice period (under French employment law) and run a clean handover, so you leave on good terms without weakening anyone.

Before you announce: make sure everything is signed

The rule is simple: do not resign on the strength of a verbal promise. Wait until you have received and signed a written offer or contract that states the role, pay, start date and anything you negotiated (remote work, on-call, variable pay). If something is missing, have it added before you set anything in motion, as we recommend in our guide to negotiating your cybersecurity salary.

Reread your current contract and the applicable collective agreement too. Three clauses deserve attention:

The length of your notice period, which sets your real start date.
Any non-compete clause, common in consulting and at software vendors.
Confidentiality obligations, which still apply after you leave.

If you are still in your probation period, the logic is different: the French Labour Code provides a short notice delay rather than a resignation notice period.

Understanding your notice period

On a permanent contract (CDI), resigning requires no reason. The law imposes no particular form, but a letter handed over against a signed receipt or sent by registered mail gives you a certain date, which starts the notice period.

French law does not set the notice length for resignations: it comes from the collective agreement, a company agreement, your contract or established practice. Under the Syntec agreement, common in tech and consulting, it is three months for engineers and managers ("ingénieurs et cadres"). Always check the text that applies to your company: your contract, your payslip (which names the agreement) and legifrance.gouv.fr.

Situation	What happens
You work your full notice	You work normally until the end date, on your usual salary
You ask to leave earlier	Your employer may accept or refuse; if it accepts, the unworked period is in principle unpaid
Your employer releases you on its own initiative	It must pay you the salary for the unworked period
You have paid leave left	It can be taken during the notice with your employer's agreement, or paid out

Some agreements also grant hours to look for a job during the notice. Check, but since you already have a new role, this matters mostly if your start date is not yet fixed.

A request to leave early is easier to negotiate when it comes with a credible handover plan. A manager will shorten a notice more readily when they can see nothing will be left hanging.

Announcing your departure

Tell your direct manager first, in person, before HR and before your colleagues. Hand over the letter straight after. Keep it factual and brief: you owe no justification, and a list of grievances helps neither your exit nor your reputation. The security world is small, and you will probably meet your manager again, at a conference, at a client or in a future hiring process.

Prepare a few simple sentences: the decision is made, you have been thinking about it for a while, you want to make the transition easy, and you are proposing a first list of topics to hand over.

The counter-offer: decide before it arrives

A security professional who leaves is hard to replace, and your employer may try to keep you with a raise, a new title or a more interesting project. Decide on your answer before the announcement meeting, not during it.

Ask yourself three questions:

Were my reasons for leaving only about pay?
Could what I am being offered today have been offered earlier, had I asked?
How will I be seen after announcing my departure and then staying?

If you were leaving for a different job, a more mature team, less on-call or a real path to progress, a higher number fixes none of it. And going back on a signed acceptance puts your word on the line with the company that hired you. If you genuinely hesitate, tell your future employer rather than letting them find out at the last minute.

Running a clean handover

This is where cybersecurity is different. Your departure is, quite literally, a security event for your employer: someone holding sensitive access is about to leave. Handling it rigorously is the best proof of your professionalism.

Access and secrets

List with your manager everything you hold:

Privileged accounts, service accounts and break-glass accounts whose credentials you know.
Secrets, API keys, certificates and passwords kept in a vault or, worse, elsewhere.
Hardware keys, authentication tokens and loaned equipment.
Access to cloud consoles, security tools (SIEM, EDR, scanners) and client environments.

The goal is not only to give that access back, but to make rotation possible after you leave. Flag the secrets only you know: your team will remember it.

Files and knowledge

Open incidents and cases: status, next actions, contacts.
Detection rules, scripts and automations: where they live, what they do, what breaks if touched.
Projects: decisions made, open risks, commitments made to business teams or clients.
Contacts: vendors, internal teams, client counterparts.

If a useful script lives in a personal repository, move it into company tooling rather than keeping it.

On-call and clearance

Give early warning so the on-call rota can be reorganised without landing on your colleagues all at once. If you hold a security clearance, inform your company's security officer: the clearance is tied to the role and follows a closing procedure.

What you must not take with you

The line is clear, and future employers will judge you on it: a security professional who leaves with data is a bad signal for anyone hiring.

No audit or pentest reports, no client deliverables, no log data.
No lists of vulnerabilities, indicators or internal configurations.
No copies of the company's knowledge base or code.

Your experience, however, is yours. To showcase it without disclosing anything, describe anonymised situations and skills, or build personal examples, as explained in our article on the cybersecurity portfolio. Update your profile too, following our LinkedIn advice, but wait until your notice ends to announce the new role publicly if your current employer prefers it.

The non-compete clause

Under French law, a non-compete clause is only valid if it is limited in time and geography, justified by the company's legitimate interests, takes the specifics of your job into account and provides financial compensation. The employer can often waive it, under the conditions set by the contract or the agreement.

If your contract has one, check its scope before you even accept the new offer, especially if you are joining a direct competitor or a client. When in doubt, ask an employment lawyer or a staff representative.

During the notice: stay professional to the end

Your duty of loyalty runs until the last day. Keep working seriously, document as you go, and offer a session with whoever takes over your topics if they are already known.

Stay in touch with your future employer as well: paperwork, preparing your arrival, meeting the new team. A notice of several months is calmer when everyone knows where things stand.

In short

A good resignation in cybersecurity comes down to a few habits: get everything signed before you announce, know the exact length of your notice, decide your answer to a counter-offer in advance, and run a handover that allows every access and every secret to be rotated. Leaving cleanly protects your former employer, and it is the best reference you can leave behind.

Thinking about your next step? Join the Cyber Recrut network for free. Our recruiters stay with you until your first day, notice period included, and our shortlisted candidates prove their skills on hands-on labs rather than on a CV alone. See how we work.