Looking for a Cybersecurity Job? Here’s What Recruiters Actually See
Lara B. — Building Cyberr
If you are looking for a cybersecurity job right now, there is a good chance you are spending a lot of time thinking about your CV, certifications, social profile, interviews and whether you are asking for too much money.
What you probably don't know is what happens on the other side.
What does a recruiter actually look at first? What makes someone credible? What gets ignored? Why do technically strong people still lose opportunities? And how much of the hiring process is actually outside the candidate's control?
So I spoke with Agathe Malkani , who has been recruiting cybersecurity professionals for around five years and has recently spent a lot of time sourcing pentesters and team leads.
The conversation was very practical, very open, and probably more useful than another list of CV tips.
If you are looking for a cybersecurity job right now, this is what I think is worth knowing.
Make it ridiculously easy to understand whether you fit the role
Candidates can spend hours perfecting a CV, while the first review can happen very quickly.
Agathe starts with the things the company has actually asked for: years of experience, specific technologies or tools, language skills and leadership experience where relevant.
“It’s very quick. I’m going to check the number of years of experience because I know this is often mandatory for the clients. When they say five years, I need to find five years...”
She also checks for specific tools, language requirements and evidence of leadership when the role requires it. If team-leading experience isn't obvious from the title, she looks through the actual missions and responsibilities to see whether it is there.
The important information shouldn't be buried somewhere on page three.
If you have five years of relevant experience, make it obvious. If you led a team, explain what you were responsible for. If a specific technology was central to your work, show where and how you used it.
And apparently you can spend slightly less time worrying about making the CV beautiful.
Agathe doesn't care about colours or sophisticated design. Structure matters because it helps her find the information faster. She also admitted that she usually doesn't read the little personal introduction at the top.
What makes experience credible?
One of my favourite parts of our conversation came when I asked what makes a cybersecurity candidate look credible.
Agathe's answer was very simple:
“You can put everything you want in a CV.”
She looks at the history behind the claims: the companies, the length of engagements and whether the overall career history makes sense.
Someone who has completed several substantial engagements and stayed long enough to actually build experience can create a strong level of trust. The written description still needs to survive the conversation afterwards.
For me, this is where context becomes important.
What were you actually responsible for? What kind of environment did you work in? How deep was your involvement? What problems did you solve? What changed because of your work?
A list of tools tells me what you want me to believe you know.
The context tells me much more about whether you actually used them.
Keep your professional story consistent
Your CV may not be the only place someone checks.
“I’m going to compare with LinkedIn to see if the information is the same.”
For her, the public nature of the profile makes it useful for comparing dates, companies and experience.
Your wording doesn't need to be identical everywhere, but the basic story should make sense.
This also becomes more relevant as people increasingly use AI to rewrite and optimise CVs. Use it to make your experience clearer if it helps. Make sure the final version still describes a person who can answer questions about everything written there.
What do certifications actually tell a recruiter?
Cybersecurity loves certifications, so of course I asked.
Do recruiters care?
Yes.
If a company requires a particular certification, Agathe searches for people who have it. She has also spent enough time recruiting in cybersecurity to know that some certifications require considerably more work than others.
“We know the certifications which are very hard to obtain.”
That effort can carry weight because it tells her something about what the person has invested in developing their skills.
If you have certifications, make sure the rest of your profile shows what you can actually do with that knowledge.
The certificate is one part of the picture. Your experience gives it context.
Learn how to explain what you know
There are technically excellent cybersecurity people who are missing opportunities because their technical ability doesn't translate well into an interview.
Agathe sees this regularly.
“Sometimes they are very good in technique, but they are missing opportunities because they don't know how to present themselves, their skills, what they can do.”
This becomes particularly important in pentesting because many roles involve speaking with customers, explaining findings, discussing risk and communicating with people who don't share the same technical background.
You need to be able to explain your own work clearly.
Tell me what you did, what was difficult, what you discovered, what your responsibility actually was and why the work mattered.
Technical depth is incredibly valuable. Being able to make that depth visible to the person sitting across from you is part of getting hired.
The job description may only tell half the story
This part of the conversation will probably sound familiar to quite a few candidates.
You read the job description, speak with the recruiter and move forward. Then you meet the hiring manager and suddenly hear about requirements that weren't mentioned anywhere before.
Agathe sometimes receives only a few lines describing what the company needs.
“There is a contrast between the job description and the reality of the mission.”
She tries to give candidates as much information as possible at the beginning, including the contract structure, requirements and salary range, while acknowledging that the initial brief doesn't always describe the full reality of the job.
That is useful context when you are job searching.
Hiring requirements evolve, information gets lost between people, and occasionally the person who first contacts you simply hasn't been given the full picture.
What if the recruiter doesn't understand cybersecurity?
I couldn't have an honest conversation with a cybersecurity recruiter without asking this.
I've heard CISOs complain that recruiters don't understand cybersecurity well enough to properly evaluate candidates. They struggle with the differences between technical roles, miss good profiles and sometimes become the first filter for expertise they aren't equipped to assess.
I asked Agathe if that criticism is fair.
“Yes, it's a reality. It's the truth.”
When she started recruiting cybersecurity professionals around five years ago, she deliberately spent time learning the market: the tools, functions, terminology and differences between roles.
She believes that level of specialisation is still missing from parts of cybersecurity recruitment.
There is another problem on the company side.
Recruiters are sometimes expected to find highly specialised people without being involved deeply enough in the original conversation about what the company actually needs.
Agathe would prefer to sit directly with the client at the beginning, understand the requirement herself and then go into the market.
That sounds incredibly obvious.
It apparently still doesn't happen enough.
If you are looking for a job right now
Make your experience easy to understand. Give enough context for someone to see what you have actually done. Keep your professional history consistent. If you have certifications, connect them to real experience. And practise talking about your work with the same confidence you have when doing it.
The other important thing I took from my conversation with Agathe is that hiring is an imperfect process.
A recruiter is interpreting your experience. They may be working with an incomplete brief. The hiring manager may have expectations that never made it into the original job description. Different people are making decisions at different stages, often using incomplete information.
Good cybersecurity people do get missed. Understanding how the process works at least gives you a better chance of making sure you aren't one of them.
13 reactions · 2 comments
Comments
Lara B.: sharing insights from conversation with amazing Agathe MALKANI
Jonathan B.: Very insightful! I've recently spent a lot of time trying hard to get my experience all on one page (I used to have a 2 pager), since the vast majority of tips I had been getting told me to do so. But it seems here that some have multiple pages, thus are able provide a lot more background. I get that things need to be good for a quick view near the start of the resume, but seems that more might be