Industries
Why software employees leave and how to understand why
Engineers and product staff leave for many reasons beyond salary. How to run an exit conversation in a software company, read the pattern and act on it.
6 min readRead article
Information Technology and Software · Cybersecurity firms
HR for Cybersecurity Firms: Analysts, Testers and Trust
A cybersecurity firm sells expertise and trust, and both walk out when people do. Here is how to run the people side around sensitive work.
Not sure what you need? Tell us about your business in six short steps and we will come to the first meeting prepared.
Share your requirementsA cybersecurity firm helps other businesses find weaknesses, monitor threats and respond to incidents. Its people include penetration testers, security analysts, consultants working on audits and policy, and teams who watch customers' systems in a security operations centre around the clock. The firm handles customers' most sensitive information, so confidentiality and conduct matter more than in most businesses. Skills are scarce, learning never stops, and a good tester or analyst is approached by competitors often. Incident work arrives without notice, and a bad night can follow a quiet week. See also HR for IT and software.
- Plan
- Hire
- Onboard
- Manage
- Develop
- Perform
- Engage
- Retain
- Exit
- Improve
When HR is weak in cybersecurity firms, you may see
- Shift work in the operations centre
- Burnout after incidents
- Confidentiality depends on conduct
- Testers are poached
- Learning time gets squeezed
- Consultants and technical staff are measured differently
- Career paths are unclear
These are the places the people side of this kind of business tends to give way. The rest of this page works through them.
Who does the work in cybersecurity firms
HR here has to work for each of these groups, not only the office. The set-up below is written with all of them in mind.
- Security operations analysts
- Penetration testers
- Security consultants
- Incident responders
- Threat researchers
- Governance and risk consultants
- Pre-sales and solution staff
- Delivery and project managers
Where HR strains in cybersecurity firms
Shift work in the operations centre
Monitoring runs through nights and weekends, and analysts tire of repetitive alerts, so the same seats keep turning over.
Burnout after incidents
Responders work long hours during an attack, and there is rarely a rule for rest, recognition or a quiet period afterwards.
Confidentiality depends on conduct
Staff see customer data and weaknesses, and without clear rules and reminders the firm relies on trust alone.
Testers are poached
Experienced testers and responders receive offers often, and projects are tied to named individuals the customer has met.
Learning time gets squeezed
Skills date quickly, but billable work leaves no hours for research, labs or study, so people feel they are falling behind.
Consultants and technical staff are measured differently
Billing targets suit consultants but frustrate researchers, and one appraisal scheme satisfies neither.
Career paths are unclear
A strong analyst does not know whether growth means a deeper technical role, a lead role or a move to consulting.
HR topics for cybersecurity firms
Start with the topics that matter most here: Policies, Compliance and Governance; Health, Safety and Wellbeing; Retention and Attrition Management. Then work through the rest. Each topic is written for information technology and software, not in general.
Policies, Compliance and Governance
Policies a manager can apply, and obligations with owners and dates.
Health, Safety and Wellbeing
Induction, records, incident reporting and follow-through.
Retention and Attrition Management
Who leaves, when, why — and which of them mattered.
HR Strategy and Workforce Planning
How many people, in which roles, by when — and what they will cost.
Organisation Design
Structure, reporting lines and who is allowed to decide what.
Recruitment and Talent Acquisition
Requisition to joining, the same way every time.
Onboarding and Probation
A first day that is the same for the fifth joiner as the first.
Employee Administration
Records, attendance, leave and the day-to-day HR that must simply work.
Compensation, Payroll and Benefits
Salary structure, payroll inputs and a month that closes on time.
Performance Management
Goals, reviews and ratings that hold up in a conversation.
Learning and Development
Training planned from need rather than from the calendar.
Career and Succession Management
Named backups for the roles that cannot be vacant.
Employee Engagement and Experience
Communication, recognition and the conditions people actually work in.
Employee Relations
Two routes — one for complaints, one for conduct — kept separate.
Exit and Alumni Management
Resignation to relieving letter, in a defined order.
HR Technology and Automation
Records that survive people, and approvals that do not queue.
HR Analytics and Management Reporting
A short monthly pack management actually reads.
HR Operations and Governance
An HR function that runs the same way every month.
What a working HR set-up looks like
The pieces a cybersecurity firms business puts in place, in an order that makes each easier. Open any card for the detail.
Write a plain confidentiality and conduct policy
What staff may do with customer data and access, what must be reported and what happens on a breach, signed and explained at joining.
What this coversHide
Write a plain confidentiality and conduct policy
What staff may do with customer data and access, what must be reported and what happens on a breach, signed and explained at joining.
What this coversHideWhat staff may do with customer data and access, what must be reported and what happens on a breach, signed and explained at joining. HR policies and governance covers drafting; have the final wording reviewed by a qualified professional.
Design the SOC rota to reduce fatigue
Fixed rotation patterns, limits on consecutive night shifts and a path out of monitoring into response or research.
What this coversHide
Design the SOC rota to reduce fatigue
Fixed rotation patterns, limits on consecutive night shifts and a path out of monitoring into response or research.
What this coversHideFixed rotation patterns, limits on consecutive night shifts and a path out of monitoring into response or research. The attendance and shift process records it.
Set a post-incident routine
Rest or time in lieu after long response work, a short debrief and recognition, agreed before the next incident rather than negotiated during it.
What this coversHide
Set a post-incident routine
Rest or time in lieu after long response work, a short debrief and recognition, agreed before the next incident rather than negotiated during it.
What this coversHideRest or time in lieu after long response work, a short debrief and recognition, agreed before the next incident rather than negotiated during it.
Protect time for learning
A fixed number of hours each month for research and certification study, planned into utilisation.
What this coversHide
Protect time for learning
A fixed number of hours each month for research and certification study, planned into utilisation.
What this coversHideA fixed number of hours each month for research and certification study, planned into utilisation. The learning and development process shows how to track it.
Offer two career tracks
A technical track and a consulting or management track with separate measures, so appraisal fits the work.
What this coversHide
Offer two career tracks
A technical track and a consulting or management track with separate measures, so appraisal fits the work.
What this coversHideA technical track and a consulting or management track with separate measures, so appraisal fits the work. See performance management.
Start by checking where you stand
Before changing anything, find out what is true today. These checks take an afternoon and tell you which of the topics above to start with.
Share your requirements- Read your confidentiality terms and check that every staff member has signed and understood them.
- Count consecutive night shifts for each SOC analyst over the last two months.
- Write down what rest or time off followed the last major incident.
- Ask technical staff how many hours last month went to learning rather than billing.
- List your testers and responders who hold direct customer relationships.
- Confirm with a qualified professional the employment, data-protection and confidentiality obligations that apply to your cybersecurity business.
Confirm with a qualified professional. What applies to you depends on your business, your state and your arrangements, and it changes. This page describes practice. It does not state a legal position.
How GullyHR helps
The services below fit this kind of business best. Each starts by recording where you stand, and every later report compares against that. We do not promise outcomes.
- HR policies and governance
Clear, written rules on confidentiality, device and access use, and conduct that staff can follow.
- Attendance, shift and leave
A fair SOC rota with limits on night work and a record that supports payroll and rest.
- Learning and development process
Protected learning hours and a plan for the certifications and skills the firm needs.
- Performance management process
Appraisal measures that suit analysts, testers and consultants differently.
Start with a free conversation, or see the paid HR Diagnostic.
Our HR transformation approach
- 1
Assess
Understand the business, its workforce, current processes and HR challenges.
- 2
Identify gaps
Find the missing, weak, inconsistent or person-dependent processes.
- 3
Design
Create the structure, processes, policies, SOPs, dashboards and systems needed.
- 4
Implement
Help HR and department managers actually adopt the new system.
- 5
Automate
Digitise repetitive and approval-based workflows where it is worth doing.
- 6
Measure
Track hiring, attendance, employee cost, performance, training and attrition.
- 7
Improve
Strengthen the people-management system continuously, not once.
Blogs worth reading first
From the GullyHR blog: one on HR in information technology and software, and one on each of the topics this page points to.
HR Process
What should an employee handbook include?
A practical contents list for an employee handbook in a growing Indian business: what to cover, what to leave to policies, and how to keep it usable and current.
5 min readRead article
HR Management
The safety poster nobody reads
A laminated notice, an annual drill, and an incident register with three entries in two years. What workplace health and safety looks like when it is real.
7 min readRead article
HR Management
How to recognise and address employee workload problems
How to spot an unmanageable workload before it becomes an exit or an error, what to look at, how to talk about it and what to change, without guessing.
5 min readRead articleMore on the GullyHR blog.
Questions owners ask
Limit consecutive night shifts, rotate people through different types of work and show a path from monitoring to response or research. Repetitive alerts on fixed seats are the usual reason people leave.
How customer data and access may be used, what to do on a suspected breach, rules on devices and storage, and what happens after leaving. Have a qualified professional review the wording.
Agree in advance how extra hours are recorded and compensated, and give rest afterwards. Deciding it during an attack leads to disputes and resentment.
No. Consultants are naturally measured on delivery and billing, while researchers and testers need measures of depth, findings and contribution. Separate tracks keep both fair.
Offer interesting work, learning time, a visible path and market-aware pay. Review it each year rather than when an offer arrives.
We would go through confidentiality terms and whether everyone has actually signed and understood them, the run of night shifts in your operations centre, and what rest followed your last major incident. A practical first piece of work is a plain confidentiality and conduct policy, plus a rota that limits fatigue. Scope is agreed in writing after we talk.
More on HR for information technology and software
All 5 business types in information technology and software · Find another business type
Cloud computing companiesRobotics companiesComputer repair shops3D printing companiesPolicies, Compliance and Governance in information technology and softwareHealth, Safety and Wellbeing in information technology and softwareRetention and Attrition Management in information technology and software
See all HR topics for information technology and software, or another industry.