Tech hiring Cloud, DevOps & security
Hire cybersecurity engineers who fix what they find.
A cybersecurity engineer works out how your systems could be attacked and closes those routes: reviewing designs and code, hardening cloud accounts and identity, and building the detection that tells you when something has gone wrong. We shortlist engineers assessed on practical security work, not on certificates alone.
01 The role
What you get, when you hire a cybersecurity engineer.
A cybersecurity engineer reduces the chance that an attacker gets in, and the damage if one does. In a product company that means threat-modelling new features, reviewing code and infrastructure changes, tightening who and what can reach production, and making sure there are logs worth reading when an alert fires at night.
Finding problems is the easy half. Any scanner will produce hundreds of findings by lunchtime. The difficulty is deciding which five matter for your system, getting them fixed by teams with their own deadlines, and adding controls that developers do not immediately route around. An engineer who can only write reports leaves you with a longer backlog and the same exposure.
The title covers several jobs. Application security, cloud security, detection and response, and offensive testing overlap but are not interchangeable, and governance work such as SOC 2 or ISO 27001 is different again. A first security hire at a small company is usually a generalist with one deep area; say in the brief which area that should be.
What they ship
- Threat models and security reviews for new features and architecture changes
- CI security checks: dependency, secret, code and IaC scanning
- Least-privilege IAM, single sign-on and just-in-time access to production
- Central logging, detection rules and alert triage that people act on
- Incident response runbooks, rehearsed in tabletop exercises
- Penetration test scoping, retesting and tracked remediation
- The technical controls and evidence behind a SOC 2 or ISO 27001 audit
02 Skills and stack
Skills to look for, in three columns.
Security tooling is crowded and mostly interchangeable. What matters is whether the engineer can tune a tool until its findings are trusted, and can read the code or the cloud configuration behind each one.
Core
The role cannot be done without these.
- Threat modelling and secure design review
- Web and API security (OWASP Top 10, ASVS)
- Identity and access: OAuth 2.0, OIDC, SAML, least privilege
- Cloud security on AWS, Azure or Google Cloud
- Networking, Linux and how systems are actually attacked
- Detection, logging and incident response
- Scripting in Python, Go or Bash
- Risk judgement: what to fix first, and why
Tooling
Varies from team to team.
- Burp Suite or OWASP ZAP
- Semgrep, CodeQL or Snyk for code and dependencies
- Trivy, Checkov or Wiz for containers, IaC and cloud posture
- Gitleaks or TruffleHog; Vault or a cloud secrets manager
- SIEM: Microsoft Sentinel, Splunk or Elastic
- EDR: CrowdStrike, SentinelOne or Defender
- Okta or Microsoft Entra ID
- AWS GuardDuty, Security Hub and CloudTrail, or equivalents
- Cloudflare or AWS WAF
- Terraform, for controls that live in code
Adjacent
Useful, not required.
- Penetration testing and red teaming
- SOC 2, ISO 27001, PCI DSS and GDPR requirements
- Kubernetes and container hardening
- Digital forensics and malware analysis
- Security of LLM features: prompt injection, data leakage
- Security awareness training for staff
- Vendor and third-party risk review
03 When to hire one
Hire a cybersecurity engineer for the right problem, or hire someone else.
The wrong hire for the problem is an expensive way to learn what the problem was. Check your situation against both columns.
Hire a cybersecurity engineer when
-
Enterprise customers are sending security questionnaires
Sales is stalling on questions about encryption, access reviews and penetration tests. Someone has to make the answers true, not just fill in the form.
-
You hold payment, health or identity data
A breach would be a regulatory event as well as an embarrassment. The controls need an owner who understands both the system and the obligation.
-
Security work is whatever a developer has time for
Dependency alerts pile up, old access is never removed and nobody reviews risky changes. That is manageable with ten engineers and dangerous with fifty.
-
You had an incident, or a near miss
A leaked key, a phished account or a public bucket showed you could not say what was accessed. You need detection and a rehearsed response before the next one.
-
A penetration test produced a long report and little change
External testers find issues. An in-house engineer gets them fixed at the root and stops the same class of bug returning.
Look elsewhere when
-
You need one penetration test before a customer audit
That is a scoped piece of work with a report at the end. A permanent hire makes sense once there is continuous security work to own.
Post a freelance project -
Deployments are manual and servers are configured by hand
Security controls need a pipeline and infrastructure as code to attach to. Get repeatable delivery in place first.
Hire DevOps engineers -
Your cloud accounts grew without a plan
Account structure, networking and baseline guardrails are platform work. A security engineer reviews that design; a cloud engineer builds it.
Hire cloud engineers -
The pain is outages, not attackers
Availability, on-call and error budgets belong to reliability engineering. The skills overlap less than the job titles suggest.
Hire site reliability engineers -
You expect one person to watch alerts around the clock
Continuous monitoring is a rota, not a hire. It needs several people or a managed service, with an engineer directing them.
Build a dedicated team
04 How we assess
Four checks, before a name reaches you.
A CV says what someone claims. We test what they can do, then send you the evidence with the shortlist.
-
Stage 1
Profile review
We look for security work with an outcome we can follow: a control the candidate designed, a vulnerability class they removed, an incident they handled. Certificates are noted, but they do not replace evidence of what the person changed in a real system.
-
Stage 2
Technical test
A timed test covering web and API vulnerabilities, authentication and access control, cloud and network fundamentals, and practical exercises such as spotting the flaw in a piece of code or configuration and saying how to fix it.
-
Stage 3
Conversation with our team
Our engineers ask the candidate to threat-model a system aloud and to talk through a real finding from discovery to fix. We listen for prioritisation, for an accurate sense of how attacks work in practice, and for how they persuade developers to act.
-
Stage 4
Review and levelling
Reviewers score accuracy, speed, problem-solving, communication and teamwork, then assign a level from our engineering framework. For security roles the notes record which areas the person is deep in, because nobody is equally strong across all of them.
-
Then
Your shortlist
Assessed candidates, with notes and scores.
The engine
Evalia
Assessments run on Evalia, the assessment platform we built ourselves. Across the ProDevs network, more than 100,000 assessments have been completed.
The levels we assign are public. Read the engineering framework, or see how a hire runs from brief to offer.
05 Seniority
Three levels. What each one can own.
The title on a CV tells you little. What matters is how much a cybersecurity engineer can be handed without someone checking each step.
Junior
Owns triage and defined checks
- Triages scanner and alert output and escalates what looks real
- Runs access reviews, patch tracking and evidence collection to a checklist
- Reproduces known vulnerability types and writes them up clearly
- Needs a senior engineer to judge risk; not a sensible first security hire
Mid-level
Owns a security domain
- Runs application or cloud security for a product area without supervision
- Reviews designs and pull requests and proposes fixes developers accept
- Writes and tunes detections, and leads the response to a contained incident
- Automates checks in CI so the same issue is not found by hand twice
Senior
Owns the security programme
- Sets priorities from a real threat model of the business, not a framework checklist
- Designs identity, network and data controls across the whole estate
- Commands a serious incident and briefs leadership, customers and regulators
- Takes the company through an audit and tells the board which risks remain
06 Interview questions
Seven questions, worth asking a cybersecurity engineer.
For your own interviews, after ours. Each question comes with what a strong answer tends to show.
-
Threat-model a feature that lets customers upload documents and share them by link.
A good answer shows: A structured walk through assets, entry points and trust boundaries: file type and size handling, malware, access control on the link, expiry, enumeration, storage permissions. A weak answer is a list of buzzwords with no order of importance.
-
A scanner reports 400 findings on our main repository. What do you do first?
A good answer shows: Triage by reachability and exposure, not by the tool’s severity label. They remove noise, group findings by root cause, fix classes of bug at the framework level and agree a service level for the rest. Forwarding all 400 to developers is the wrong answer.
-
A cloud access key was committed to a public repository last month. What now?
A good answer shows: Revoke and rotate first, then establish what the key could do and what it did, using audit logs such as CloudTrail. They talk about scope, persistence the attacker may have left, notification duties, and preventing a repeat with secret scanning and short-lived credentials.
-
How would you give engineers production access without anyone holding standing admin rights?
A good answer shows: Single sign-on, role-based access, short-lived credentials and just-in-time elevation with approval and logging, plus a break-glass route for emergencies. Good candidates mention the cost to developers and how they keep it low.
-
Tell me about a vulnerability you found. How did it get fixed?
A good answer shows: A specific finding, its real impact, and the work of getting it fixed: a clear reproduction, a proposed patch, a regression test. Listen for respect towards the developers involved. Contempt for them predicts a security function that gets ignored.
-
We pass our SOC 2 audit. Does that mean we are secure?
A good answer shows: A clear no, with reasons. An audit shows that stated controls operated over a period; it says little about whether they are the right controls. Strong candidates use compliance as a floor and can name risks an auditor would not look at.
-
You join as our first security hire. What do you do in the first 90 days?
A good answer shows: An inventory of assets and access before any tooling purchase, then the unglamorous basics: multi-factor authentication, removal of stale accounts, backups, logging, patching. A plan that opens with buying a platform or a red-team exercise is premature.
07 Ways to engage
Four ways to bring a cybersecurity engineer in.
A permanent hire is the usual route, not the only one. Choose by how long the work lasts and who should employ the person.
- Placement fee, of first-year salary. One-time.
- 10–15%
- Replacement guarantee on direct hires.
- 2 weeks
- To a first shortlist, for most roles.
- 48h
-
Direct hire
A permanent employee on your contract and your payroll. One-time placement fee of 10–15% of first-year salary.
Tech hiring -
Dedicated team
A cybersecurity engineer inside a team we assemble and run for you: product, design and engineering on your roadmap, for a monthly retainer.
Dedicated teams -
Outsourcing & payroll
A full-time person in a country where you have no legal entity. ProDevs employs and pays them: 20% of salary if we find the person for you, or 5% of salary, capped at $500 a month, for payroll and compliance on someone you have already chosen.
Outsourcing -
Freelance project
A defined piece of work with a clear end. You pay the agreed price per milestone through escrow, plus a 5% client fee. Free to post.
Freelancers
08 Around the role
A cybersecurity engineer is one seat. These are the others.
A cybersecurity engineer has little direct authority over the systems they are meant to protect. Most of the job is done through other people’s backlogs, so the good ones sit close to engineering, make the secure route the easy one, and save a hard “no” for the cases that deserve it.
- Software developers
- Reviews risky changes, explains findings with a reproduction and a fix, and builds guardrails into the pipeline.
- DevOps and cloud engineers
- Agrees baselines for accounts, networks and secrets, and has them enforced in infrastructure code.
- Site reliability engineers
- Shares logging, on-call and incident process, so a security incident is run like any other.
- Legal and compliance
- Translates contractual and regulatory duties into controls, and supplies audit evidence.
- Leadership
- States the main risks in plain terms and what it would cost to reduce each one.
09 Client testimonials
Hear it first-hand, from companies that hired.
Founders, operators and executives describe working with ProDevs, in their own words.
Play video: Client testimonial: Olufemi Seyi, COO, Casafina development company
Play video: Client testimonial: Aproko Doctor, Building AwaDoc
Play video: Client testimonial: JT Liddell, Promenade CEO
10 Questions
Hiring cybersecurity engineers, answered.
Something else? Book a call (opens in a new tab) and ask us directly.
-
What does a cybersecurity engineer do day to day?
They review designs and code changes for security problems, tighten access to cloud accounts and production systems, maintain scanning in the delivery pipeline, tune alerts and investigate the ones that fire. They also handle customer security questionnaires and prepare audit evidence. In a small company one person covers all of this; in a larger one the work splits into specialisms.
-
What is the difference between a security engineer, a penetration tester and a SOC analyst?
A penetration tester attacks a system for a fixed period and reports what they found. A SOC analyst watches alerts and investigates suspicious activity. A security engineer builds and maintains the controls: secure design, access, pipeline checks and detection. Many engineers have done one of the other two jobs, but the roles are hired and assessed differently.
-
Do we need a full-time security engineer or just a penetration test?
A penetration test tells you where you stand on one date. If you release weekly, hold regulated data or sell to enterprises, the findings return unless someone owns security between tests. A common path is an external test first, then a permanent engineer once there is a steady flow of remediation, reviews and customer assurance work.
-
Which security certifications should we look for?
Treat them as supporting evidence. OSCP indicates hands-on offensive skill, CISSP indicates breadth and experience, and the AWS, Azure and Google Cloud security certificates show platform knowledge. None of them proves the person can prioritise or get fixes shipped, which is why we assess practical work and judgement directly.
-
How quickly can I hire a cybersecurity engineer through ProDevs?
For most roles you see a first shortlist within 48 hours of agreeing the brief, and most companies find their hire within two to three weeks. Security is a narrow field with distinct specialisms, so tell us whether the priority is application security, cloud, detection or compliance. A vague brief is the usual cause of delay.
-
How is a remote security engineer employed and held accountable?
A direct hire is your own employee, on your contract, bound by your confidentiality terms and access policies. If you have no legal entity in their country, ProDevs can employ them for you through outsourcing and payroll. Direct hires carry a one-time placement fee of 10–15% of first-year salary and a two-week replacement guarantee.
Talk to ProDevs
Tell us about the role.
Tell us the level and the stack. We will tell you how quickly we can put assessed cybersecurity engineers in front of you.
Project work
Need it for a project instead?
Not every job needs a full-time hire. Describe the work, get proposals from vetted freelance security engineers, and pay per milestone through escrow. Free to post.