Hiring cybersecurity talent in the public sector
Hiring for cybersecurity in local government or a public body: priority profiles, contract staff, sourcing, assessment and the arguments that win candidates.
A town hall, a regional authority or a public body hiring in cybersecurity faces a double challenge: needs that are growing fast, and a hiring framework that is less flexible than a private company's. Ransomware attacks that have shut down public services for weeks have made the subject very concrete for elected officials and senior management. This guide helps chief executives, IT directors and CISOs in the public sector choose the right profiles, attract them despite the constraints and assess them properly.
What makes the public sector different
The principles of cybersecurity are the same everywhere. Applying them in a public administration or a local authority follows its own rules.
- Continuity of public service. Civil registration, staff payroll, social benefits, water or transport management: an outage hits residents directly, often the most vulnerable ones.
- A very heterogeneous information system. A local authority runs dozens of different business lines (planning, childcare, roads, social services), each with its own software, vendors and sometimes connected technical equipment.
- Limited resources. Many organisations have only a small IT team, or none at all, and rely on service providers or shared structures.
- A specific regulatory framework. In France, the Référentiel général de sécurité (RGS) governs the security of administrations' online services and requires them to be formally accredited ("homologation"). GDPR applies in full, and public bodies must appoint a data protection officer.
- Regulated hiring rules. Civil service status, pay scales, mandatory job advertising, approval chains: a public employer does not have the same levers as a company.
The framework driving demand
Directive (EU) 2022/2555, known as NIS2, available on eur-lex.europa.eu, lists public administration among the sectors of high criticality in its Annex I. The text covers central government and leaves it to Member States to define which regional and, where relevant, local entities fall in scope. The details of the French transposition, and therefore which local authorities are covered, should be checked on cyber.gouv.fr, where ANSSI publishes up-to-date information. Our article on which profiles to hire for NIS2 explains how to map each obligation to a skill.
Beyond NIS2, several public schemes support organisations in France: regional incident response centres (regional CSIRTs), ANSSI resources aimed at local authorities, and Cybermalveillance.gouv.fr for the smallest municipalities. They help, but they do not replace in-house expertise able to own the subject.
The profiles the sector needs
Not every organisation needs all of these roles. The table helps you spot what is missing for your size.
| Profile | Role in a public administration or local authority | Common background |
|---|---|---|
| CISO (dedicated or shared) | Owns the security policy, briefs elected officials and senior management, leads RGS accreditation and crisis management | CISO from another sector, deputy IT director, senior security engineer |
| Security engineer or security-minded administrator | Hardening, backups, Active Directory, segmentation, third-party access | Systems or network administrator from a local authority or an integrator |
| GRC analyst | Risk analyses, accreditation files, oversight of contracts and providers, liaison with the DPO | IT GRC, internal control, IT project manager |
| Detection lead | Alert follow-up, managing an outsourced SOC, first-level investigation | SOC analyst, administrator trained in detection |
| Security lead for a shared-services body | Supports several member authorities, aligns practices, pools tools | CISO, security consultant, project lead at a public digital services operator |
For a small municipality, hiring a full-time CISO is rarely realistic. Pooling is then the most common route: at the level of the inter-municipal body, a management centre or an IT syndicate. Our article on a part-time or full-time CISO helps you decide, and our guide to building a security team suggests a hiring order.
Status, contract and pay: set the frame before you advertise
This is often where hiring fails. Before writing the job ad, clarify three points with HR.
Civil servant or contract staff
Permanent posts are meant to be held by civil servants, but the French civil service code allows contract staff to be hired in certain cases, notably when the role requires specialised skills or when no civil servant could be recruited. Experienced security professionals often come from the private sector and are not civil servants: check from the outset that the role can be opened to them, and for what contract length.
Pay
Pay scales and allowance schemes limit room for negotiation, especially against private-sector offers. Be transparent from the first conversation: a candidate who discovers the gap in the third interview leaves, and remembers the experience. Identify what can compensate: stability, scope, autonomy, training, working arrangements.
Timeline
Mandatory advertising of the vacancy, interview panel, sign-off by the authority: each step takes time. A candidate courted elsewhere will not wait several weeks between two interviews. Set panel dates in advance and cut the number of rounds. Our article on cybersecurity time to hire shows where the weeks get lost.
Where to find candidates
Waiting for someone who knows security, how a local authority works and your business software all at once makes the search longer. Three talent pools deserve your attention.
- Public-sector IT teams. Systems and network administrators in local authorities know the environment, the elected officials and the users. With a training plan and a mentor, several can move into security. Our guide to hiring career changers largely applies.
- Private-sector professionals looking for meaning. Some engineers and analysts want a role that serves the community, with more stability and less travel. They bring method and tooling.
- Integrators and vendors serving the public sector. Their engineers know the architectures, the business software and the constraints of public procurement.
Assess without missing the target
A panel often measures motivation and knowledge of the public environment. For a security role, add a real technical assessment, run with someone able to judge the answers. A few useful scenarios:
- Ransomware on a Monday morning. The reception and civil registration workstations are encrypted. What are your first decisions, who do you notify, how do you keep serving residents? Expect isolation, degraded-mode procedures, communication with senior management and elected officials, and use of the reporting channels.
- Accrediting an online service. A new citizen portal must go live in two months. How do you run the risk analysis and the accreditation file with the resources available?
- The vendor. A software vendor asks for permanent remote access to maintain a business application. How do you control it, including in the contract?
- Briefing elected officials. Explain to a municipal council in five minutes why security deserves a budget. This test reveals the ability to explain simply, which is essential here.
Our article on structuring a technical cyber interview gives the method for building these exercises without being an expert.
Mistakes to avoid
- Posting a generic job description. An ad that reuses an administrative template without describing the real scope, tools and reporting line will not attract security profiles.
- Placing the role too low. A CISO without access to senior management struggles to win budget decisions.
- Asking for everything at once. Governance, accreditation, detection, networking and ten years of public-sector experience: that profile barely exists.
- Forgetting crisis management. Exercises and degraded-mode procedures matter as much as tools.
- Hiring one person with no support. Plan a training budget, access to a peer network and providers for specialist topics.
In short
Hiring for cybersecurity in the public sector means clarifying the frame (status, pay, timeline) before searching, targeting profiles that match your size, and assessing on scenarios close to your daily reality. Pooling and contract staff are often the two levers that unlock the situation.
Need to strengthen the cybersecurity of your local authority or public body? At Cyber Recrut, a recruiter and a security practitioner scope the role with you and run the search together. Our shortlisted candidates prove their skills on hands-on labs tailored to the role. See how we work or share your hiring need.