Inherited a Security Team? 6 Things to Consider Before Making Your Next Hire

Joining a new organisation as a CISO brings plenty of challenges, regardless of how many years you've spent in security leadership.

You're rarely starting with a blank sheet of paper. You're inheriting an existing team, established ways of working, technology investments and a security strategy that may or may not align with where the business is heading.

And at some point, one question is likely to come up:

Have I got the right people, skills and resources to deliver what the business needs?

Having worked with CISOs and security leaders across organisations including M&S, Hargreaves Lansdown, Admiral Insurance and EDF, I've seen how different security teams can be in terms of structure, capability and resources.

One thing I've learned is that building a stronger security function doesn't necessarily mean building a bigger team.

Before making your next hire, here are six things worth considering.

1. Understand the Talent You've Already Got

Before looking externally, it's worth taking a proper look at the people and capabilities already within your security function.

Not just who's doing what, but where their strengths lie, how their time is being spent and whether their skills are being put to the best use.

You might have experienced security engineers spending most of their time firefighting operational issues, senior specialists tied up in work that could be delegated, or talented individuals who could take on more responsibility with the right development.

It's worth asking:

• Where are the team's strongest capabilities?

• Are people working at the right level?

• Which skills are missing or overstretched?

• Is there untapped potential within the existing team?

• Could responsibilities be better distributed?

Sometimes the answer is recruitment. But sometimes it's about making better use of the people you've already got.

And understanding that distinction before going to market can save a lot of time, money and frustration.

2. Look Beyond Headcount and Assess Capability

A team of ten doesn't automatically outperform a team of five. What matters is whether you've got the right mix of skills and experience to support the organisation's objectives and risk profile.

When I'm speaking with security leaders about hiring plans, the conversation often comes back to where capability is stretched or missing altogether.

That might be across:

Security Engineering

Cloud security, vulnerability management, identity and access management, infrastructure security and tooling can all sit within an engineer's remit.

But expecting one person to be an expert in everything isn't always realistic.

If projects are stalling or remediation backlogs are growing, it may be a sign that specialist engineering capability is needed.

Security Operations and Incident Response

As organisations grow, so do their monitoring, detection and response requirements.

The question isn't always whether to recruit more SOC analysts. It might be whether the existing operating model needs additional expertise, better coverage or external support.

Security Architecture

Businesses investing in cloud adoption, digital transformation or major technology programmes often need strong security architecture capability.

Where that expertise is missing, organisations can find themselves competing for a relatively specialist talent pool.

Governance, Risk and Compliance

GRC capability can sometimes be overlooked in favour of more technical security roles.

But as regulatory requirements and business complexity increase, the right GRC expertise can be just as important as another technical hire.

The point is that identifying the capability gap should come before deciding on the job title.

3. Look at Where Your Team Is Stretched

One of the clearest indicators that additional resource might be needed isn't necessarily the size of the team.

It's what the team is struggling to deliver.

Are security projects repeatedly delayed? Are senior people spending too much time on operational tasks? Are important initiatives being pushed down the priority list because there's simply nobody available to pick them up?

These are often the conversations that lead to recruitment requirements. But before creating a new vacancy, it's worth understanding what's actually causing the bottleneck.

Sometimes there's a genuine shortage of specialist skills. Sometimes the team has the expertise but not the capacity. And sometimes the issue is how responsibilities have been structured. Those are three different problems, and they don't necessarily require the same hiring solution.

For example, if you've got a major cloud security project approaching, you might not need another permanent engineer. A specialist contractor could provide the expertise and capacity required without creating a long-term headcount commitment.

Equally, if the same capability gap keeps appearing across multiple projects, that could be a strong argument for investing in a permanent hire.

Understanding whether you're dealing with a skills gap, a capacity issue or a structural problem makes for much better hiring decisions.

4. Don't Assume Every Gap Requires a Permanent Hire

This is something I discuss regularly with security leaders. When a capability gap appears, the natural reaction can be to create a permanent role.

And sometimes that's absolutely the right answer. But not every requirement needs a permanent employee.

Depending on the challenge, there are several options worth considering:

• Permanent recruitment: For core capabilities, long-term ownership and skills you want to retain within the business.

• Contract recruitment: For specific projects, specialist expertise, transformation programmes or short-term capacity challenges.

• Managed security services: Where ongoing operational support, monitoring or specialist coverage can be delivered externally.

• Specialist consultancy: For targeted expertise, assessments or defined pieces of work.

The right approach depends on the business, the work involved and how long that capability is likely to be needed.

There's also a commercial consideration.

Finding a highly specialised permanent security professional can take time, particularly when the required combination of skills is in short supply.

A contractor might get a critical project moving while you consider the longer-term structure. Alternatively, investing in a permanent hire could prove more cost-effective than repeatedly bringing in external expertise for the same requirement.

There's no universal answer. But exploring the options before committing to a hiring strategy can make a real difference.

5. Hire for Outcomes, Not Job Titles

Security job titles can be surprisingly misleading.

A Security Engineer in one organisation might spend most of their time on cloud infrastructure and automation. In another, the same title could cover vulnerability management, security tooling and incident response. And that's before you get into the differences between Security Architects, Cloud Security Engineers, DevSecOps Engineers and the various specialist roles sitting within GRC.

This is why I always think it's worth starting with the problem you're trying to solve, rather than the job title you think you need.

Before going to market, consider:

• What do we actually need this person to deliver?

• Which skills are essential from day one?

• What could realistically be learned on the job?

• What experience already exists within the team?

• Are we being realistic about the level of seniority required?

That last point is particularly important. It's easy to build a job specification that asks for everything. Deep technical expertise, leadership experience, stakeholder management, multiple certifications and experience across every technology in your environment.

But the more requirements you add, the smaller your potential talent pool becomes. And you may find yourself competing for a very expensive individual when someone with a slightly different background could deliver exactly what you need.

The best hiring conversations start with what success looks like, not a shopping list of skills.

6. Challenge Your Assumptions About Hiring

Every organisation develops certain assumptions about recruitment.

You might hear:

• "We definitely need someone senior."

• "We won't find anyone with that combination of skills."

• "That's what we've always paid for this role."

• "We need someone who's worked in our industry."

• "The right candidate has to have these certifications."

Some of those requirements will be entirely justified. Others might be unnecessarily limiting your options. And this is where having a good understanding of the wider cyber security talent market can be particularly useful.

For example, is the salary you're offering competitive for the skills you need?

Are you insisting on industry experience when the technical capabilities could transfer from another sector?

Could someone with strong foundational skills grow into the role rather than needing every qualification and certification on day one?

Or are you looking for one person to cover what are realistically two different specialisms?

These are the sorts of conversations I enjoy having with security leaders. Not simply taking a job specification and finding someone who matches it, but understanding what the business actually needs and helping shape a realistic approach to finding that talent. Because sometimes a small adjustment to the brief can open up a much stronger pool of candidates.

And sometimes a conversation about the market before a vacancy even exists can help avoid a difficult recruitment process further down the line.

Final Thoughts

The first year in a new CISO role often involves balancing immediate priorities with longer-term plans for the security function. And while technology, processes and strategy are all important, having the right people and capabilities in place is fundamental to delivering them.

That doesn't always mean recruiting more people.

Sometimes it's a permanent hire. Sometimes it's bringing in specialist contract expertise. And sometimes it's recognising that the skills already exist within the business but could be better utilised.

The important thing is understanding what you need before deciding how to resource it.

At Revoco, I work with CISOs and security leaders to help them build and strengthen their teams through permanent and contract recruitment, as well as sharing insight into the wider cyber security talent market.

If you're relatively new to your role, reviewing your team structure or thinking about future hiring plans, I'm always happy to have a conversation. Even if recruitment isn't on the immediate agenda, it's good to connect.