I was recently promoted to team lead role on the Security Operations team where I work, and will be qualified to have direct reports. Today, I was meeting with my manager to review / discuss the proposed budget for the SecOps team next year. This budget will be submitted to senior management for approval. I anticipate the entire review and approval process to take about 2 - 3 months based on historical experience.
During Q1 of next year, we are planning to onboard several new team members to include 1 - 2 DevSecOps engineers, several junior security analysts, and several SDET, specializing in security automation testing, and security controls as code, following the DevOps style.
I know cybersecurity roles are in high demand, and firms are often competing for high quality candidates. Its also my experience that cybersecurity candidates often have multiple choices about where to work and the job market is highly mobile.
I fear that if me / my manager waits to start looking at candidates until budge is approved, the best candidates will already be taken, yet if we advertise too early, not all proposed budge may be approved, leading to candidate disappointment and lost reputation if an offer needed to be recalled, due to budget shortage. I am looking at how to best balance these 2 risks.
Edit to respond to comments
@Mu - Our company have hired security engineers in the past, but under different circumstances. We were operating more of a waterfall model back then and did not really consider the more modern DevSecOps approach of implementing security as code, of building in security as a fundamental aspect during development, rather than an add - on. Also, during those hiring cycles, we had surplus budget already approved, so the uncertainty now is a non - issue.
@Joe - We hired SecOps engineers in the past at a lower pay level and it did not work out well. The employees'skills just were not as advertised, and they left not longer after joining. Given the competitiveness of the cybersecurity field, really experienced candidates demand commensurate pay, that our team may not be able to afford, depending on budget outcome.
How can I accommodate budgetary uncertainty when hiring in a niche role of the IT job market, such as cybersecurity?
How can I assess the risk of waiting and losing out on candidates versus having to forego open roles due to lack of budget?