CH
PL
Why a vague briefing becomes expensive
A generic job profile attracts generic applications. As a result, the business unit, HR and candidates talk about different expectations. The consequences are long selection processes, candidates withdrawing after the second interview, or a hire who, three months in, does not match the actual tasks.
In cybersecurity, experienced professionals are in high demand. Companies that cannot describe their requirements clearly lose strong candidates to those who can. A precise briefing is therefore not a formality but a competitive advantage.
Four roles, four ways of working
The ECSF describes twelve role profiles. For many companies in the DACH region, however, the most frequent requests can be condensed into four areas.
1. SOC: detect and respond
Professionals in a security operations center monitor systems, assess alerts, and respond to security incidents. They work with SIEM and EDR tools, analyse log data, and escalate incidents according to defined procedures. Typical questions for the briefing: Is there on-call duty or shift work? Which tools are in use? Up to which level may the person take action independently?
2. Pentest: find vulnerabilities deliberately
Penetration testers examine applications, networks or cloud environments from an attacker's perspective. They plan tests, document findings and explain the resulting risks to the people responsible. Important for the briefing: Is the focus on web applications, infrastructure, cloud or social engineering? Will tests be performed in-house, or will the person oversee external providers?
3. GRC: turn requirements into measures
Governance, risk and compliance connects regulation with operations. Professionals in this field assess risks, prepare audits and translate requirements such as NIS2 or ISO/IEC 27001 into policies and processes. They need less tool knowledge and more communication skills, as well as experience working with management, business units and auditors.
4. Security architecture: design secure systems
Security architects are involved early in projects. They define access concepts, assess cloud and interface architectures and make sure security is not bolted on at the end. What matters most in the briefing: In which projects will the person work, and what decision-making authority do they have towards development and operations?
Three questions before every search
Before you publish a profile or pass it on to a partner, three questions help to sharpen the role.
- Who decides on measures? May the person isolate systems, refuse approvals or set policies, or do they prepare decisions for others?
- Who does the role work with every day? IT operations, development, data protection, management or external providers: the key interfaces determine which experience and which communication skills are needed.
- What should concretely work after 90 days? A working escalation process, a completed pentest or an audit-ready risk register: a concrete goal makes the role measurable and the conversation with candidates more honest.
Permanent hire, project, or a mix?
Not every cybersecurity task requires a permanent hire right away. A pentest or audit preparation is often a time-bound project. Building a SOC or a permanent GRC function, on the other hand, requires continuity. Many companies combine both: external specialists start an initiative while the internal role is filled in parallel.
The key is to clarify this question early. It affects budget, timeline, and how you approach candidates. A project-based search reaches different profiles than a company offering a long-term position.
Common pitfalls in the briefing
In our experience, certain patterns keep recurring:
- Too many roles in one profile: SOC experience, pentest certifications and audit expertise in one person are rare and expensive.
- Certificates instead of tasks: a list of certifications does not replace a description of what the person will actually do.
- Missing authority: people who carry responsibility but cannot make decisions tend to leave quickly.
- Unclear availability: on-call duty and weekend shifts belong in the briefing, not in the third interview.
What the ECSF means in practice
The European Cybersecurity Skills Framework creates a common language for roles and skills across Europe. For companies, it offers useful guidance to describe tasks, deliverables, and capabilities in a structured way. The ongoing revision, which is also a topic at the ENISA conference, shows that requirements keep evolving, for example, through AI-supported attacks and defense tools.
For your briefing, this means: use the framework as a checklist, but do not copy it one to one. What matters are your systems, your processes, and your goals.
An example from practice
A mid-sized company contacts us with the request "Security Engineer, full-time, immediate start". In the conversation it turns out that the actual trigger is an upcoming NIS2 audit. A risk register, documented responsibilities and an incident process are missing. So the company is not primarily looking for someone to harden systems, but for a person with GRC experience who builds structures and can talk to management and IT operations alike.
This clarity changes everything: the job description, the candidates being approached and also the engagement model. In this case, an experienced GRC specialist started on a six-month project basis while an internal role for ongoing operations was built up in parallel. The audit was prepared, and afterwards the company knew exactly which profile it needed in the long run.
A checklist for your briefing
A good cybersecurity briefing answers at least these points:
- Trigger: Why are you searching now? Audit, incident, growth, new project or replacement?
- Main task: Which of the four roles is central, and which tasks are explicitly not part of the role?
- Environment: Which systems, tools and cloud platforms are in use?
- Authority: Which decisions may the person make independently?
- Interfaces: Which teams and external partners do they work with every day?
- Framework: location, share of remote work, on-call duty, languages, security clearance.
- Goal after 90 days: How will you know that the hire is working?
This list fits on one page. It supports internal alignment and external outreach, because candidates immediately see what the role is really about.
Conclusion: define the role first, then search.
Cybersecurity is not a single profile but a field with clearly distinct roles. If you define before the search which task is central, who decides and what should work after 90 days, you save time and find people who really fit.
At Suppliance, we help companies sharpen cybersecurity roles and find the right specialists, whether for a project or a long-term collaboration. Which role are you looking for right now? Let's sharpen the role profile together.