Remote work and on-call: raising them with cyber candidates

Remote work and on-call duty are among the topics that most often decide a cybersecurity hire, yet they are usually the last ones to come up. The result: a motivated candidate discovers at the final interview a constraint they cannot accept, or accepts a vague promise that will make them leave a few months after joining. This article explains when to raise these topics, what to spell out, and how to negotiate without weakening either the offer or the team.

Why these two topics weigh so much in security

In many jobs, remote work and hours are about comfort. In security, they go to the heart of the role. A SOC monitoring around the clock, an incident response team that can be called at night, a classified environment where remote work is impossible: these constraints come straight from the mission.

Candidates know it. The more experienced ones have often lived through badly organised on-call rotations, incident nights with no recovery time, or remote work withdrawn overnight. So they ask precise questions, and they read your answers as a sign of how mature the team is. A vague answer does not reassure, it worries.

The right moment to raise them

The rule is simple: before the technical interview. These topics belong to framing the role, not to the final negotiation.

In the job ad: state the remote work pattern and whether there is on-call duty, even in a single sentence.
In the first conversation: give the frequency, organisation and compensation, then check that the candidate is comfortable.
During the process: let a future colleague describe an actual on-call week or a recent incident.
In the written offer: put in writing what was said.

A candidate who withdraws at the first conversation because the on-call pattern does not suit them saves you time. The same withdrawal after four stages costs you a great deal, as we explained in our article on the mistakes that drive candidates away.

On-call: what the candidate needs to know

"Occasional on-call" means nothing to a candidate. They need enough detail to picture their life with that rhythm.

Candidate's question	What you should be able to answer
How often?	The real rotation: how many people share it, how long an on-call period lasts
How many calls, in practice?	An honest order of magnitude, observed over recent months, without dressing it up
Who calls me, and why?	Escalation criteria, the tier that filters before you, the cases that justify waking someone
Am I on my own?	Whether there is a second tier, a reachable manager, a provider in support
How is it compensated?	The on-call allowance, how interventions are paid, the rest granted afterwards
What happens the day after an incident night?	The recovery rule, and whether it is actually applied

The last row is often decisive. A team that publishes a rest rule but expects everyone at the 9 a.m. meeting after an incident night soon becomes known for it.

The legal framework in brief

In France, on-call duty (astreinte) is governed by the Labour Code (articles L3121-9 onwards, available on legifrance.gouv.fr). Time spent intervening is working time, and the on-call period must be compensated, either financially or with rest. The details then depend on your collective agreement and company agreements. Check them with HR before discussing them with the candidate: announcing compensation your agreements do not provide for creates a problem from day one.

Remote work: moving past "to be discussed"

With remote work, the difficulty is less the amount than the clarity. A candidate prefers a modest but stable arrangement to a generous promise that depends on the manager's mood.

What to spell out:

The pattern: days per week, fixed or flexible days, rules during onboarding.
What limits it: access to sensitive environments, an analysis lab, equipment that cannot leave the site, security clearance, client requirements.
The framework: a company agreement or charter, or an individual agreement. The French Labour Code (article L1222-9) provides for these options.
The equipment: workstation provided, secure remote access, any contribution to costs.
Stability: what could change the rule, and how the team would be told.

If the role requires significant on-site presence, say why. "Forensic analysis is done on an isolated network, on site only" is a constraint good candidates understand. "Management prefers to see the teams" is an argument that will put some people off, and it is better to know that early.

Negotiating without weakening the team

Once the framework is set, there is often some room to negotiate. It must stay fair within the team: an arrangement granted to a new hire and refused to their colleagues always comes out eventually.

The most common levers:

Delay entry into the on-call rotation by a few weeks, while the new hire learns the environment. This often serves the team as much as the candidate.
Adjust which days are remote rather than how many, for example to account for a long commute.
Offer compensation in rest rather than pay, or the reverse, where your agreements allow it.
Review the arrangement on a set date: a meeting planned after the probation period, with known criteria.

What to avoid: promising an exception verbally without writing it down, or hinting that the on-call load will lighten "once the team grows" when no hiring is planned. Those are the promises candidates remember.

Signals to listen for

Negotiation is also an assessment, in both directions. A few reactions deserve your attention.

The candidate asks precise questions about escalation and recovery: usually a sign of real on-call experience, which is reassuring.
They accept everything without a question: check they have understood the rhythm. A quick "yes" sometimes turns into a quick departure.
They refuse any on-call for a role that includes it: no point insisting. Note it and stay in touch for another role.
They raise a specific personal constraint: childcare, a commute, a volunteer commitment. A clear answer, positive or negative, beats "we'll see".

For SOC roles in particular, our guide to hiring a SOC analyst also covers how to present on-call and shift work from the first approach.

Checklist before the first conversation

Before contacting a candidate, make sure you can answer these points.

The remote work pattern is set and its rationale can be explained.
The limits on remote work are identified and justified.
The ad mentions whether there is on-call duty.
The rotation, its length and the real call volume are known.
Escalation criteria and available support are described.
Compensation is validated with HR and consistent with your agreements.
The recovery rule after an intervention is clear and applied.
The possible room for negotiation is defined in advance.
A team member can describe the real rhythm.
Everything said will be repeated in the written offer.

In short

Remote work and on-call duty are not details to settle at the end of the process. In cybersecurity, they are part of the job description. Raising them early, with precise answers, compliant compensation and a prepared margin for negotiation, prevents late withdrawals and early departures. Candidates readily accept a constraint that is explained: what they refuse is discovering it after signing. It is also a pillar of your employer brand.

Preparing a hire with on-call duty or limited remote work? At Cyber Recrut, a recruiter and a security practitioner frame these conditions with you before any approach, and introduce candidates who have proven their skills on hands-on labs and know what they are signing up for. See how we work or tell us about your need.