The First Security Hire: Define the Job Before You Post It

The board minutes say 'hire a security person,' and three months later the job posting says everything: ten years of experience, hands-on with every tool the company owns, strategic enough for the board and tactical enough to reset passwords. The applicants it attracts will either be unaffordable or unserious.

The first security hire fails at the job description, not the interview. 'Do security' is not a role; it is an anxiety. The companies that get this hire right define the work first: what the person will actually do in year one, what authority they carry, and what stays outside the role for now.

That definition also answers the question hiding underneath: whether the company needs a hire at all, or a different shape of help.

TLDR

• Define the first year's work before writing the job description, not after the hire starts.

• Decide whether the role is a builder, an operator, or a leader; one person is rarely all three.

• Write the authority into the role: what they can decide, stop, and require.

• Budget for the tools and help the role needs, not just the salary.

• Consider whether fractional leadership plus this hire beats one unicorn.

Write the work, not the wish list

Start with the next twelve months, not the ideal candidate. List what must actually get done: the assessment nobody has run, the incident plan that does not exist, the vendor reviews piling up, the board reporting that needs a voice. The job description is that list with a title on it.

The list also reveals the seniority the role needs. A year of building foundations is a builder's job. Running a mature program is an operator's job. Standing in front of the board and changing how the company decides is a leader's job. Posting all three attracts someone good at one and patient with none.

The signs that it is time to hire at all are a separate question worth settling first; the discussion of whether you need a CISO frames it well.

Authority is part of the job description

A security hire without authority is a reporting function. Write into the role what they can decide: which findings block a launch, which vendors need review before signature, what they can require of other teams.

This fictional example shows the authority section of a first-hire charter. It is an illustration, not a prescription.

Area	The hire can	Executive sign-off needed
New vendors	Require a security review	Reject a critical vendor
Product launches	Set launch-readiness conditions	Delay a committed launch date
Policies	Write and publish	Change employment terms
Spending	Manage the security budget line	New budget above the line

Without this, every decision the hire makes is negotiable, and the role becomes a very expensive suggestion box.

Budget for more than the salary

The salary is the visible cost. The invisible ones kill the hire's first year: the tooling the role needs, the assessment you will want done, the training budget, the external help for the work one person cannot cover.

A rule of thumb from the companies that get this right: plan for the fully loaded role to cost one and a half times the salary in year one. A hire with no budget is a person who spends their first year justifying their own existence.

The shape that often works better

For many mid-market companies, the honest answer is a combination: fractional or interim senior leadership to set direction and face the board, plus a hands-on hire to build and run the program. The senior half brings the pattern recognition the first-time hire cannot have; the hire brings the daily presence a fractional leader cannot.

The trade-offs in choosing between fractional and full-time security leadership apply directly here, with the first hire's definition as the missing input most companies skip.

The related discussion of do i need a ciso is worth your time alongside this one. The related discussion of fractional ciso vs a full-time ciso is worth your time alongside this one.

Frequently asked questions

What should the first security hire's title be?

Match the actual authority. 'Security manager' for a builder reporting to IT, 'director' or 'CISO' only if the role carries real decision authority and executive access. Title inflation without authority creates frustration in both directions.

Should the first hire be technical or a communicator?

Both matter, but weight toward the work of year one. If the year is building foundations, weight technical. If the year is standing up governance and reporting, weight communication. You are hiring for the list you wrote, not for the eventual team.

How do we interview for a role we do not fully understand?

Use scenario questions from your own environment: our last vendor incident, our current access mess, our next product launch. Candidates reveal themselves in how they would approach your actual problems, and outside help for the interview loop is money well spent.

A Defensible Next Step

Before the job posting goes out, write the one-page charter: the first year's work, the decision authority, and the budget beyond salary. If writing it is hard, that difficulty is exactly what the hire would have walked into. Book a Decision-Clarity Call if you want the charter built with you.