I was recently promoted to team lead role on the Security Operations team where I work, and will be qualified to have direct reports. Today, I was meeting with my manager to review / discuss the proposed budget for the SecOps team next year. This budget will be submitted to senior management for approval. I anticipate the entire review and approval process to take about 2 - 3 months based on historical experience.

During Q1 of next year, we are planning to onboard several new team members to include 1 - 2 DevSecOps engineers, several junior security analysts, and several SDET, specializing in security automation testing, and security controls as code, following the DevOps style.

I know cybersecurity roles are in high demand, and firms are often competing for high quality candidates. Its also my experience that cybersecurity candidates often have multiple choices about where to work and the job market is highly mobile.

I fear that if me / my manager waits to start looking at candidates until budge is approved, the best candidates will already be taken, yet if we advertise too early, not all proposed budge may be approved, leading to candidate disappointment and lost reputation if an offer needed to be recalled, due to budget shortage. I am looking at how to best balance these 2 risks.

Edit to respond to comments

@Mu - Our company have hired security engineers in the past, but under different circumstances. We were operating more of a waterfall model back then and did not really consider the more modern DevSecOps approach of implementing security as code, of building in security as a fundamental aspect during development, rather than an add - on. Also, during those hiring cycles, we had surplus budget already approved, so the uncertainty now is a non - issue.

@Joe - We hired SecOps engineers in the past at a lower pay level and it did not work out well. The employees'skills just were not as advertised, and they left not longer after joining. Given the competitiveness of the cybersecurity field, really experienced candidates demand commensurate pay, that our team may not be able to afford, depending on budget outcome.


  • How can I accommodate budgetary uncertainty when hiring in a niche role of the IT job market, such as cybersecurity?

  • How can I assess the risk of waiting and losing out on candidates versus having to forego open roles due to lack of budget?

  • 7
    why would there be a specific timepoint where the best candidates are taken? Are you considering graduates in particular? In general the job market is in constant flow: People take jobs and others start looking, so unless you're aiming at a particular group of employees that is available for the job market in a certain time-frame, there really is no way to know when the best candidate pool is available. Commented Sep 11, 2019 at 0:12
  • Is this the first time your organization is hiring for such number of roles? I would say there will be precedent for how the other teams in your org work around hiring requirements internally while awaiting budget approvals. Commented Sep 11, 2019 at 0:33
  • 1
    @mu無 - See my response in edit just now
    – Anthony
    Commented Sep 11, 2019 at 1:01
  • @JoeStrazzere - See my response in edit. True, I can probably find engineers at a lower budget, but I would also expect their experience to be less, commensurate with that lesser pay. I can fulfill the role, yes, but the candidates would not necessarily meet our expectations for the open role we are looking to fill. My experience is that candidates in IT are highly aware of what they are worth
    – Anthony
    Commented Sep 11, 2019 at 1:06

1 Answer 1


If I'm reading the situation right, you are a (new) team lead who wants to hire some specialized roles, who is working around budgetary requirements, expecting the process to take 2-3 months.

Here is what I would suggest:

  1. Build a pipeline of candidates: If you want to hire N candidates over a period of Y months, you will need to get the ball rolling with recruiters etc to get the profile. Shortlisting is not equal to final offer. This building of pipeline is a lengthy time consuming process, and can easily span months.

  2. Ensure you have managerial alignment: While budget is the hard approval, ensure that your managers are aligned with your vision of DevSecOps employees. They have already burnt their hands with something they didn't understand by hiring low paid employees earlier, they may be very careful for the same thing hiring overpaid ones now.

  3. Build relation with your internal recruiters: You are new to the role. Try to get perspectives from your internal recruiters as to how much time they think they will need to work these requirements. You can expect recruiters to not have much clue if the role is outside their regular hiring, so set the standards for resume shortlisting/hiring assignments etc right. Everyone may need learning, you from them, they from you.

  4. Keep realistic limits on what you are ready to pay: While niche skills can command fat packages, they still need to be quantifiable as you won't receive a blank cheque in budget approvals. Keep that in mind in all conversations above.

  5. Don't hire all the N candidates at once: Since you are looking niche skills, expect the recruitment to be staggered and long drawn process. While you may not have budget to hire N candidates, with a sufficient budget, you may be able to have surplus for one or two hires. Use it.

If you do all of the above, I would say you will anyway end up spending 1-2 months in setting the stage itself, which will bring you very close to the time when you have actual numbers available.

How can I accommodate budgetary uncertainty when hiring in a niche role of the IT job market, such as cybersecurity?

Keep a ballpark range in mind - the minimum budget that you believe will get approved after all your discussions above. Work with it for initiating hiring. If minimum is zero/insignificant, you need to make your case for budget grant stronger.

How can I assess the risk of waiting and losing out on candidates versus having to forego open roles due to lack of budget?

You forgo open role only when you rescind an offer. If you do that, you obviously attract negative news, glassdoor reviews, blog posts etc - which is something that will hurt your own standing with recruiter, seniors etc.

So rather than foregoing, delay the offer if that is really required. Every one understands that business circumstances change beyond control of one person, due to which roles can get closed, so no bridges are burnt.

Not the answer you're looking for? Browse other questions tagged .