Hiring the Next Security Hire: Operator or Translator?

The job description says ten years of experience, five certifications and proficiency in forty tools. It describes nobody, and it will hire the wrong person slowly.

Most security job posts are written by copying the last one. The better starting point is the operating model: what is actually missing - someone to run the controls, someone to translate risk for the business, or someone to run response when things go wrong.

Those are three different people. Naming which one you need changes the whole search.

TLDR

• Hire for the gap in the operating model, not the job board default.

• Operators run controls; translators turn risk into business decisions; responders run incidents.

• A small team rarely needs all three at once - pick the gap that hurts now.

• Consider build-versus-buy: some gaps are better covered by a service than a hire.

• Write the role around the outcomes you expect in the first year.

Three kinds of gap

The operator keeps the machine running: patching, access reviews, monitoring follow-up, vendor questionnaires. Without one, controls decay quietly.

The translator sits between the technical team and the business: turning findings into decisions, writing the board pack, negotiating priorities with product and finance. Without one, good work stays invisible and unfunded.

The responder owns the bad days: detection, containment, the first seventy-two hours of an incident. Without one, every incident is improvised.

The role-shape decision guide

Map your current state before writing the ad. The example below is illustrative.

Question (illustrative)	If the answer is weak	Role shape
Are basic controls run on time, every time?	Patching slips, reviews stall	Operator
Does leadership act on security findings?	Reports unread, budget stalled	Translator
Could you run a real incident tomorrow?	No rehearsed plan, unclear roles	Responder
Is the gap temporary or sub-scale?	Project-sized or part-time need	Service, not hire

The NICE Workforce Framework (NIST SP 800-181 Rev. 1) defines the work roles and tasks behind these shapes, which is useful for writing the description once you know the shape.

Build versus buy

Not every gap justifies a salary. A translator gap at a forty-person company may be a fractional executive two days a week. A responder gap may be a retainer with a firm that does this daily. Hiring is right when the work is continuous, core to the business and big enough to fill a year.

Write the year, not the wishlist

Describe what the person will have delivered in twelve months: the review cadence that runs on time, the board reporting that lands, the tabletop that happened. Candidates who can do the work recognize it; candidates who collect certifications apply to everything. For how role expectations show up in a contract, see interim CISO contract: roles, deliverables and KPIs.

Frequently asked questions

Can one hire cover two of the three shapes?

Sometimes, at small scale. Operator-translator combinations exist; translator-responder is rarer. Be honest about which shape is primary, or the hire serves neither well.

How senior should the first security hire be?

Senior enough to work unsupervised in the shape you chose. A junior hire into a translator gap frustrates everyone, including the hire.

When is a fractional or interim executive the better answer?

When the gap is leadership rather than hands, when you need coverage now, or when the permanent role is not yet fully defined.

Should the board weigh in on this hire?

On the shape and seniority, yes - the hire determines what security information reaches them. Leave candidate selection to management.

A Defensible Next Step

Before posting anything, answer one question internally: which of the three shapes is our real gap? If the room disagrees, that conversation is the work. Book a Decision-Clarity Call if you would like help running it.