Reads code
They can find the hole in a pull request, not just in a scan report.
Security engineers who make yes safe.
Your next enterprise deal will come with a security questionnaire. We find the people who can answer it honestly, then fix what it finds.
When startups make this hire.
Usually when an enterprise customer asks for SOC 2 or ISO 27001, or right after a near miss. Rush it and you get a policy writer who can’t read code, or a pentester who has never had to live with the fixes.
What great looks like.
Fixes, not findings
They hand engineers a patch or a clear path, not a 40-page PDF.
Cloud fluent
They know identity, networking and secrets on the cloud you actually use.
Calm in an incident
They’ve handled a real one and can walk you through the timeline.
How we vet this role.
-
A live session on a real problem
A small app with real weaknesses and a cloud setup with a few bad habits. They find, rank and fix them live, while our anti-cheat checks the interview.
-
An incident, walked through
In the same interview we ask about one they handled: who knew what, when, and what changed after. Real incidents come with real detail.
-
History and references
Employment history checked. References confirmed through work email, which matters more than usual in this job.
-
ID and right to work
Checked before you meet them.
What it costs in the UK.
Base salary at venture-backed startups. Draft figures, pending Jono’s sign-off.
| Level | London | Rest of UK |
|---|---|---|
| Junior (0-2 yrs) | £45k-£60k | £35k-£50k |
| Mid-level (2-4 yrs) | £65k-£85k | £52k-£70k |
| Senior (5+ yrs) | £85k-£115k | £70k-£95k |
| Staff / lead | £110k-£145k | £90k-£115k |
Questions, answered.
How much does it cost to hire a security engineer through Candit?
Our fee is fee and payment terms. With Pay as they stay you can spread it across your hire’s first months, so your runway stays yours.
Do we need a security engineer or a compliance consultant?
If you need a certificate once, maybe a consultant. If you’re selling to enterprises every quarter, you need someone in-house who can fix things. We’ll tell you which.
Can a security engineer get us through SOC 2?
A good one can own it, and make sure the controls are real rather than written down. We look for people who’ve been through an audit before.
How fast can we meet people?
You get 3-5 vetted candidates by a date we agree upfront, usually within 10 days of signing off the brief.