Hiring your first security profile in an SME

In a small or mid-sized company, security usually rests on the IT team, a managed service provider and the goodwill of a few people. The day that stops being enough, the first security hire becomes a tricky bet: nobody in-house can assess the candidate, and the role only exists in people's heads. This guide helps you pick the right profile, write a credible job ad, assess candidates without being an expert and prepare for your first hire's arrival.

Signs that justify a first role

Hire too early and the role has no substance. Hire too late and it is often after an incident. A few signs tell you the time has come.

• Customer security questionnaires keep piling up and nobody has time to answer them properly.
• IT squeezes security in between emergencies: patching, backups and access rights come after production.
• You rely entirely on providers with nobody in-house to check what they do.
• A regulation now applies to you, for example NIS2 if your sector and size fall within its scope. Our article on the profiles to hire for NIS2 covers these obligations.
• You had a near miss: a compromised account, ransomware narrowly avoided, a data leak at a supplier.

If one or two of these signs apply, a first role makes sense. If all of them do, it is already overdue.

Which profile for a first hire

The temptation is to look for a CISO. In many SMEs it is not the right first role: a CISO with no team and no budget ends up writing policies nobody applies. A junior analyst working alone, on the other hand, lacks the perspective to prioritise. Your first profile needs to both decide and do.

For most SMEs, a generalist security engineer or a hands-on security manager is the best starting point. If you also lack strategic leadership, a part-time CISO can provide it alongside. Our article part-time or full-time CISO helps you choose the model.

Junior, mid-level or senior?

A first security hire works alone, with no peer to review their choices. A junior without guidance will struggle to grow and to be heard by leadership. Aim instead for a mid-level profile who can run an assessment, defend priorities and explain risks in plain terms. A career changer coming from system or network administration can fit if they have already done hands-on security work. Our guide to hiring career changers explains how to assess them.

Writing a job ad that attracts the right people

Experienced candidates read an SME job ad with one question in mind: "Will I have the means to act?" A vague ad that stacks certifications and tools drives the best ones away.

A good first-role ad spells out:

1. The context: size of the estate, cloud or on-premises, providers in place, what already exists in security.
2. The three or four priority projects for the first year, stated concretely.
3. The reporting line: CEO or IT director. Reporting to leadership gives weight to decisions.
4. The resources: budget for tools, access to outside providers, training time.
5. What will not be expected: no SOC to build single-handed, no permanent on-call without compensation.
6. The conditions: remote work, travel, any on-call duties.

Own the fact that this is the first role. For many professionals, building a company's security from scratch is an attractive prospect, as long as leadership is genuinely committed.

Assessing without in-house expertise

This is the main difficulty. Without anyone to ask the right technical questions, the interview quickly becomes a pleasant conversation that proves nothing.

What you can assess yourself

• Prioritisation: describe your context and ask what they would do in the first three months. A strong candidate asks questions before proposing solutions.
• Communication: ask them to explain a concrete risk as if speaking to your executive committee.
• Realism: be wary of plans that start with buying expensive tools before any assessment.
• Autonomy: get them to talk about a time they had to move forward without clear instructions.

What you need someone to check

Technical skills should be observed, not just described. A hands-on exercise in a realistic environment, a configuration review or a log analysis reveals in an hour what an interview cannot. If you lack the expertise to design and judge that exercise, bring in a security practitioner. Our article on assessing skills beyond the CV covers the methods that work.

A short, clear process

Good candidates often have several options running at once. A tight process works in your favour:

• a first conversation with their future direct manager;
• a hands-on exercise or case study based on your context;
• a meeting with the CEO, to check commitment on both sides;
• a quick decision, with reasoned feedback either way.

Preparing the arrival and the first months

A first security hire who lands in an unprepared organisation spends their first weeks chasing access and contacts. Prepare the ground before they arrive.

• Access: asset inventory, admin consoles, provider contracts, existing documentation.
• Contacts: a sponsor in leadership and a counterpart in IT.
• Written expectations: what should be delivered at three, six and twelve months, for example an assessment, a prioritised roadmap, then the first projects completed.
• A regular slot with leadership to settle priorities and unlock resources.

The first months' projects are often the same: map assets and access, check backups and that they can be restored, roll out multi-factor authentication, regain control of privileged accounts, prepare an incident response procedure. The IT hygiene guide published by ANSSI, the French national cybersecurity agency, on cyber.gouv.fr is a solid basis for structuring this work.

The most common mistakes

• Looking for a unicorn: technical expert, lawyer, manager and salesperson all at once.
• Hiring without a budget: the role becomes a fig leaf and the hire leaves quickly.
• Placing the role too low: without access to leadership, decisions get lost.
• Judging on CV and certifications alone, without seeing the candidate at work.
• Leaving the new hire alone with emergencies from week one, with no time for an assessment.

In short

An SME's first security hire needs to both decide and do. Most often, that is a mid-level generalist security engineer or hands-on security manager, reporting high enough to carry weight. The job ad must show real resources, the assessment must observe the candidate in action, and the arrival must be prepared with written expectations. That is what turns a bet into a lasting foundation.

Preparing your first cybersecurity hire? At Cyber Recrut, a recruiter and a security practitioner help you define the role and assess candidates, and our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your need.