The First Security Hire Is a Unicorn Hire

About

Archives

Search

Book Reviews

Books Up Next

Podcasts

Dark Mode

Table of contents

The First Security Hire Is a Unicorn Hire<br>The head of security role, usually a company's first security hire, expects one person to be a unicorn with real depth across every security domain. Genuine unicorns are rare, and no two have the same powers. Whether you're hiring one or becoming one, matching those powers to a company's real risk matters more than the myth.

The first security hire at a company is asked to be seven specialists at once.<br>Read the job description for a head of security role, especially at a company making its first dedicated security hire, and you&rsquo;ll find a wish list that spans the entire field. Governance. Risk and compliance. Third-party risk management. Cloud security. Identity and access management. Product security. Security architecture. Each of those is a career. Each one has people who have spent fifteen years going deep on that single discipline and still feel like they&rsquo;re learning. The req asks for one person who can do all of them well.<br>The industry has a word for the person who can: a unicorn. It gets said half as a compliment and half as a quiet admission that the role, as written, might not be fillable. And once you&rsquo;ve reached for that word, the honest question is the one the hiring side would rather not sit with. How many unicorns actually exist?<br>Seven Jobs, One Headcount<br>When a company makes its first dedicated security hire, it isn&rsquo;t hiring a specialist. It&rsquo;s hiring a function. There is no team to absorb the parts of the job the new person isn&rsquo;t strong at, because the new person is the team. Whatever they can&rsquo;t do well enough either doesn&rsquo;t get done, or gets done badly by someone whose actual job is something else.<br>That&rsquo;s what makes the breadth real instead of aspirational. In a mature security org, the head of security sits above seven or eight specialist functions, and the depth lives in the people below them. As the first hire, there is no below. The governance program, the vendor reviews, the cloud posture, the identity model, the product security questions coming out of engineering, the architecture decisions getting made with or without them. All of it lands on one desk.<br>And these aren&rsquo;t variations on a single theme. Governance is mostly a writing-and-influence job. Cloud security is a hands-in-the-console job. Third-party risk management lives in process and negotiation. Product security is, genuinely, an engineering job. The skills don&rsquo;t transfer cleanly between them. Being excellent at one tells you remarkably little about whether someone is even competent at the next.<br>The Job Doesn&rsquo;t Stay Inside Security<br>The seven domains, as broad as they are, are all still security. The job doesn&rsquo;t stay inside that boundary. At most companies, and especially at any company selling software to other businesses, the first security hire ends up spending real time in two places that appear on no security domain list: revenue and legal.<br>Start with revenue. Modern enterprise deals have a security gate. Before a prospect signs, someone on their side wants to know how your company protects their data, and they want to hear it from a person who owns security, not from an account executive reading a script. So the first security hire becomes a part-time sales engineer. They join customer calls, walk prospects through the security posture, and answer the hard follow-up questions in a way that keeps the deal moving. When the deal reaches paper, they&rsquo;re in the contract negotiation: the security exhibit, the data processing addendum, the breach-notification windows, the audit rights, the liability language tied to a security incident. The deal often cannot close until those terms are settled, which makes the head of security part of the sales team in a real and recurring way.<br>Then there&rsquo;s the questionnaire tax. Enterprise customers send security questionnaires, sometimes a standard one, often a bespoke spreadsheet three hundred rows long, and a wrong answer is both a lost deal and a misrepresentation risk. Someone has to own answering them accurately and consistently. That someone is usually the first security hire.<br>And the job spills into legal. Privacy regimes like GDPR sit right next to security, share a lot of vocabulary, and almost always land on the security person&rsquo;s desk at an early-stage company, because there is no dedicated privacy counsel yet. Privacy is a genuine discipline of its own, with its own lawyers at larger companies, and the first security hire inherits it anyway. They end up negotiating legal terms, interpreting regulatory obligations, and deciding which commitments the company can actually keep.<br>None of this is what people picture when they picture a security leader. It&rsquo;s also, at a B2B software company, frequently where the...