Why don't security engineers just recruit other security engineers? Well, they do (𝘩𝘪𝘯𝘵: 𝘪𝘵'𝘴 𝘤𝘢𝘭𝘭𝘦𝘥 𝘢 𝘳𝘦𝘧𝘦𝘳𝘳𝘢𝘭). But this was a post I saw a few weeks ago, asking if there's a need for agency recruiters if folks actively network for themselves and others (especially since engineers typically are friends with engineers of similar domains and stacks). 𝘈𝘯𝘥 𝘥𝘰𝘯'𝘵 𝘸𝘰𝘳𝘳𝘺, 𝘵𝘩𝘪𝘴 𝘪𝘴𝘯'𝘵 𝘢 𝘥𝘪𝘴𝘨𝘶𝘪𝘴𝘦𝘥 𝘨𝘰-𝘳𝘦𝘤𝘳𝘶𝘪𝘵𝘦𝘳𝘴 𝘱𝘰𝘴𝘵. Which in theory, works...maybe? But I don't know a ton of engineers that want to deal with... • Negotiating $ especially when a colleague is offered significantly more than you (or worse, really lowballed) • The fun of scheduling panel interviews • Relaying some brutal feedback from a hiring team (especially when someone thought they did really well) • Rejecting 90%+ of the people you submit • And the list goes on Ultimately, as a lot of us know quite well, job hunting sucks. And even more sucky that those bad experiences are then associated with the colleague or friend that got you in that position in the first place. It's like asking a friend to be your realtor or your lawyer? Stuff can just get messy.
Adding to this that the referral process can, itself, be a problematic organization practice if handled poorly. An example I previously worked at rolled out a referral program, while claiming to be too strapped for cash to match even inflation short of an actual promotion that would have required >1yr of full-on hustle culture. The referral bonuses would have required you to bring on two successful hires to even outpace the lowball cost of living adjustments, they openly didn't want you sharing ranges even internally, and they went so far as to describe the promotions that *did* come with raises as tied to being the sort of engineer that could attract others to come work with them (like through the referral program). The more details that were fleshed out, the more gross it felt on an ethical level -- my immediate impression was that it was encouraging me to take financial advantage of my friends, and that it loosely resembled a pyramid scheme. This all happened *before* there was any dedicated TA staff there, and implementations like it are an argument for hiring people whose actual job that is instead of farming it off onto people who have other ones.
Michael Calderin
3mo
The fact of the matter is that security professionals by and large aren’t great networkers. Plus, if we rely exclusively on internal people to make recommendations, we’re going to get more people like them — not a bad thing at face value, but over time will lead to group think and socially exclusive teams. Not to mention recruiters’ ability to bring in underserved or under-represented candidates.
Adam Martin
3mo
Or when you get internally promoted into a new role and refer a former colleague to your old role only to find out they are paying them more than you in your new role #beentheredonethat #donotrecommend 🤦🏻♂️
Kevin H.
3mo
It gets awkward when you have to ghost your friends, too!
Umair Ali
3mo
Interesting view
Security Engineering Leader
3moThe premise feels silly. We hire security engineers because they are good engineers, and recruiters because they are good recruiters. The skill overlap isn’t terribly high. Even if I got somebody on my team who, by some stroke of luck, had been an agency recruiter for a decade and was an amazing hacker, I wouldn’t have them recruit for me. Three main reasons: 1) I need their energies focused on doing the job I hired them for 2) Having a teammate source a candidate, then interview them, compromises the separation of duties. For example, what if my “recruiter” finds a candidate, then they don’t pan out at interview? Are they motivated to argue for that candidate simply to avoid having their sourcing critiqued? Separating duties avoids this issue. 3) The candidate may divulge details (leave plans, future scheduling needs, for example), that they shouldn’t have to reveal to teammates. Also, at most companies, other people’s compensation details are company-confidential, except to the extent they share voluntarily. Keeping those details within a people function (HR/recruiting/hiring manager) limits disclosure of confidential information and reduces the opportunities for bias to creep into somebody’s decision making.