Freelance or permanent role in cybersecurity: an honest look

Going freelance appeals to many security professionals: a day rate that looks far above a salary, more freedom, missions you choose. A permanent contract can look less attractive on paper, yet it brings things no invoice replaces. Here is an even-handed comparison, so you decide with the full picture rather than on a figure you read online.

Two models, two logics

An employee on a permanent contract sells time and skills to an employer, who carries the business risk: if there is no project this month, the salary is still paid. A freelancer sells a service to successive clients and carries that risk personally. Everything else follows from this difference.

In cybersecurity, freelancers often work as staff augmentation (reinforcing a team for a set period), on expert assignments (audits, penetration tests, certification support) or in a fractional leadership role. Our article on the fractional CISO covers that last case from the company's side.

Income: compare like with like

This is the most common mistake: multiplying a day rate by the number of working days in the year and setting it against a gross salary. An honest calculation starts from real revenue and removes everything the employer used to cover.

To compare, make a cautious estimate of the days you will actually bill in a year, removing holidays, training, prospecting and a month or two without a mission. Then apply the contributions and costs of the legal setup you choose, ideally with an accountant's help. The result is often higher than a salary, but the gap is almost always smaller than the raw calculation suggested.

Security and social protection

A permanent contract is not a job for life, but it gives a protective framework: notice periods, severance if you are let go, unemployment insurance, company health and disability cover, paid leave. It also makes some personal steps easier, such as a mortgage, although banks are increasingly used to assessing self-employed applicants with a few years of accounts.

As a freelancer, you build that protection yourself: disability cover, a cash buffer, professional liability insurance. The last point matters especially in security: a penetration test that causes an outage, or a scoping mistake, can have serious consequences. A clear engagement agreement and suitable insurance are not optional.

Growth and skills

This is the least discussed argument, and often the decisive one. In a permanent role on a good team, you learn alongside more senior people, you see the consequences of your choices over several years and you can move into management or architecture.

As a freelancer, you see many different environments, which is very formative. But you are hired for what you already know, rarely to learn. The risk is repeating the same mission for years, then realising your skills have aged with nobody pushing you to renew them.

A few questions to answer honestly:

• Do you already have expertise that clients buy without hesitation, or are you still building it?
• Can you learn on your own, with method, without a team around you?
• Are you comfortable selling, negotiating and chasing a client who pays late?
• Could you absorb three months without a mission financially?
• What draws you: independence itself, or a salary you currently find too low?

If the answer to the last question is "the salary", a well-run negotiation or a change of employer sometimes solves the problem more simply. Our guide to negotiating your cybersecurity salary helps you check.

The reality differs by role

Not every security role suits freelancing equally.

• Pentest and audit: well-bounded missions, easy to scope and bill. The market exists, but competition is real and reputation builds slowly. The path described in becoming a pentester comes first.
• GRC, compliance, ISO 27001 or NIS2 support: recurring, time-bound needs that suit senior people able to lead on their own.
• Cloud security, architecture, IAM: frequent reinforcement on transformation projects, often as long staff augmentation.
• SOC and incident response: shift work and on-call duties are hard to run solo. Missions exist, mostly as reinforcement or crisis expertise, but permanent employment remains the dominant model.
• Roles requiring security clearance: some sensitive environments clearly prefer employees, or involve clearance delays that fit poorly with short missions.

Legal setups in France, briefly

Without going into tax detail, which changes and depends on your situation, there are three broad options in France:

1. Micro-entreprise: simple to set up and run, but capped in revenue and poorly suited when expenses are high.
2. A company (EURL, SASU): more flexibility and room to optimise, at the price of heavier administration and an accountant you will almost certainly need.
3. Portage salarial (umbrella employment): you find your missions, an umbrella company employs you and invoices the client. You keep protection close to an employee's, in exchange for management fees.

Check the official rules on public reference websites when you take the step. A conversation with an accountant before you leave your permanent role will spare you most bad surprises.

A reversible choice, if you prepare it

Freelancing is not a one-way ticket. Many professionals alternate between both models over their careers. For a smooth return to a permanent role, two precautions are often enough:

• Document your missions: scope, technologies, outcomes, within confidentiality limits. A freelance CV that lists client names with no substance is unconvincing, as we explain in our article on the cybersecurity CV.
• Keep your progression visible: new skills, certifications, broader responsibilities. A recruiter wants to understand what each mission taught you.

On the employer side, a former freelancer is often seen as autonomous and quickly productive. The question you will hear in interviews is simple: why come back, and for how long? Prepare an honest answer.

In short

Freelancing in cybersecurity can pay more and offer real freedom, provided you already have recognised expertise, a financial buffer and a taste for selling. A permanent role brings protection, a team and a progression that are often underestimated. Compare realistic net income, look at the specifics of your role, and choose the model that serves your career five years out, not just your next payment.

Weighing your options? Our recruiters know both markets and can help you see clearly, free of charge. The candidates we put forward prove their skills on hands-on labs, which speaks to employers whatever your background. Join the Cyber Recrut network and see how we work.