The Security Hire You Actually Need Isn’t Technical

When a security team asks me to help them hire, they almost always hand me a job description that is a list of tools. Five years with this SIEM, certifications in that cloud, scripting in these languages. And almost always, the gap that’s actually hurting the team isn’t technical at all. It’s that nobody can get the rest of the company to do anything.

I have watched brilliant technical teams fail to move the needle for years because every good recommendation died in translation — too technical for the executives, too abstract for the engineers, too adversarial for the business. The vulnerability didn’t get fixed because the person who found it couldn’t convince the person who owned it. That is not a tooling problem. No amount of packet-capture expertise solves it.

Security is mostly a persuasion job

Past a certain size, a security team’s output is not what it does directly — it’s what it convinces everyone else to do. Get engineering to change how they build. Get finance to fund the boring identity project. Get an executive to accept a risk on the record instead of pretending it away. Every one of those is an act of influence, and influence is a skill we systematically fail to hire for because it doesn’t come with a certification.

The person who can sit with a skeptical VP of engineering and leave with a genuine commitment is worth more to your risk posture than another analyst who can write a beautiful detection nobody acts on. Both matter. Only one of them is on your job description.

What I actually look for

I look for people who can hold a room without raising their voice. Who can take something genuinely complex and make a non-expert care about it in ninety seconds. Who ask “what does the business need” before “what does the framework say.” Who can disagree with an executive and keep the relationship. Who write clearly, because unclear writing is unclear thinking, and security runs on getting other people to act on your thinking.

None of that means technical depth is optional — a persuasive person who is wrong on the fundamentals is dangerous. But technical skill is the price of entry, not the differentiator. You have plenty of people who know the answer. What you’re short on is people who can get the answer implemented by someone who doesn’t report to them.

Hire for the gap you actually have

Before you write the next req, ask honestly where your program keeps stalling. If good findings die on the vine, if the same risks reappear because the fix never sticks, if the business sees you as the department of no — another tooling expert will not fix any of that. You need a translator, a diplomat, an operator who happens to understand security. Write that job description. It’s the harder one to fill, which is exactly why it’s the one worth filling.