Recruitment agency forCybersecurity
CISO, Pentester, SOC Analyst, GRC Manager, Security Architect, Cybersecurity Consultant, DPO…
The best Cybersecurity candidates don’t apply for jobs. We approach them directly.
0 trial periods ended early in 2025
- 43
Cybersecurity hires since 2022
- 80,000+
candidates in our network
- 90%
of candidates accept our clients’ offers
Our approach
Why trust us with your Cybersecurity hiring
Targeted search
We reach out directly to the best cybersecurity candidates through our LinkedIn Recruiter license, our candidate pool and referrals. Each candidate is selected for technical skill, production track record and fit with your context.
Our sourcing channels
Assessment
We build a clear scorecard with you, based on your security needs. We verify every achievement a candidate mentions before we present them, and we add structured technical interviews to the assessment.
Sample Cybersecurity scorecard
Long-term partnership
We share our market insights (salary scales, stack trends, signs that a candidate is ready to leave) and our search reports to help you build a strong cybersecurity team.
What we deliver
Tailored search report
Up-to-date salary benchmark
Tracking of candidates open to a move
Closing and onboarding follow-up
Our process
6 steps to hire the right person
Role definition and scorecard
Targeting and search strategy
Screening and assessment
Candidate presentation and reports
Support through to the signed offer
KPI review and continuous improvement
Role definition and scorecard
Targeting and search strategy
Screening and assessment
Candidate presentation and reports
Support through to the signed offer
KPI review and continuous improvement
Our Cybersecurity expertise
Roles we cover, stacks we know, salary ranges and seniority levels.
CISO
Sets the company’s security policy, runs audits and NIS2 or DORA compliance, and reports to senior management.
Cybersecurity Consultant
Works on client engagements: penetration testing, audits, risk governance or security architecture, depending on their specialty.
DevSecOps
Builds security into the development pipeline: code and dependency scanning, secrets management, image hardening.
Data Protection Officer
Maintains the record of processing activities, responds to the CNIL (the French data protection authority) and to individual requests, and oversees GDPR compliance.
Infrastructure Architect
Designs a segmented, monitored infrastructure, with security built into the network and access design from the start.
Systems and Network Administrator
Applies security measures day to day on servers, workstations and the network: patches, accounts, backups, firewalls.
Companies that trust us with Cybersecurity hiring
A dedicated expert, client testimonials and completed hires to back it up.
Cybersecurity client testimonials
Gwendal Delaunay
Project Director · SisID
« A real pleasure to work with Lity. They’re very responsive and persistent. Having been through it both as a candidate and as a recruiter, I find there’s a good balance between defending the interests of the company and those of the candidates, so that everyone comes out ahead. »
Related Cybersecurity case studies
Your Cybersecurity recruitment consultant
More than 10 years recruiting Cybersecurity talent
The cybersecurity market in France is growing very fast in 2026. NIS2 and DORA are creating tens of thousands of jobs. CISOs, pentesters, SOC analysts and GRC managers are the most sought-after profiles in tech.
Tommy Sevim runs our Tech & Engineering practice at Lity. He recruits CISOs, pentesters, SOC analysts, GRC managers and security architects, with detailed knowledge of the regulations (NIS2, DORA, GDPR).
Learn more about our approachShow less
In cybersecurity, profiles have become more specialized. A senior CISO for a large SME or a mid-sized company is not the same as one for a SaaS scale-up. Pentesters and red teamers are in such demand that they get €80-130K, and GRC profiles who know NIS2 and DORA are impossible to find without a network.
Tommy knows the French cybersecurity community (LeHack, FIC, Pass the Salt, Hackerone), the certifications (CISSP, OSCP, CEH) and the real differences between a cybersecurity consultant and an in-house security engineer.
Our method relies on 4 complementary sources. Our LinkedIn Recruiter license for direct outreach. Our cybersecurity candidate pool, updated continuously. Referrals from our network of security experts. And our presence at community events.
We work with companies of every size
Startup, scale-up, SME or large enterprise: we adapt our methods to your stage of growth and your hiring needs.
Startup
1 to 30 employees
At a startup, security is handled by a single DevSecOps engineer or outsourced. The first real security hire often comes at Series A, when B2B customers require it.
Scale-up
30 to 300 employees
At a scale-up, you hire a dedicated CISO, launch a SOC 2 or ISO 27001 program and build a team of 2-4 people (pentest, GRC, product security).
SME
50 to 500 employees
In the expansion stage, security becomes a full function, with a CISO on the executive committee, an in-house or managed SOC and a structured GRC function.
Large companies
Mid-market companies and large groups
In large corporations, the priorities are compliance with multiple regulations (NIS2, DORA, ISO), advanced perimeter defense and protection against APTs.
Further reading
Resources and other Lity practices.
Other Lity practices
All our recruitment practicesRelated
Keep exploring
- Hiring in FranceContracts, salaries and notice periods for US and UK companies.
- Salaries in FranceGross, net and employer cost by role, in euros, dollars and pounds.
- Executive SearchSenior leaders, recruited through a confidential direct search.
- Permanent recruitmentPermanent hires in France and Europe, paid on success.
Answers to your questions about recruiting in Cybersecurity.
What are cybersecurity salaries in France in 2026?
Cybersecurity salary ranges in 2026, by role:
- Mid-level Cybersecurity Consultant: €55-72K
- Pentester: €60-78K mid-level, €78-105K senior
- Mid-level SOC Analyst: €45-58K
- Mid-level GRC Manager: €65-82K
- Mid-level Security Architect: €78-98K
- CISO: €90-120K at a scale-up, €115-160K at a large group
- CISO at a strategic organization: above €150K
NIS2 and DORA compliance is pushing GRC salaries up sharply.
RSSI, Security Engineer, CISO: what’s the difference?
Three complementary roles that are often confused:
- RSSI: the French title for the head of information security, a strategic management role. Security policy, budget, reporting to the executive committee and the board.
- Security Engineer: an operational role. SIEM/EDR configuration, alert response, technical analysis.
- CISO (Chief Information Security Officer): the C-level equivalent of the RSSI, found in large groups and strategic scale-ups.
The RSSI and Security Engineers work together: an RSSI without Security Engineers has no one to carry out the work, and the reverse is also true. The line between RSSI and CISO is mostly cultural (French vs US usage).
How do you assess a pentester without getting it wrong?
To assess a pentester without getting it wrong, check several concrete points:
- Actual certifications: OSCP, CEH, OSWE, OSEP
- CTFs solved: the challenges they completed
- Bug bounties: rewards earned on HackerOne or Yes We Hack
- Real engagements: the work they actually did
- Technical exercise: in a controlled environment (vulnerable machine, code to audit), it shows how deep their skills go
A good pentester talks about exploitation, OSSTMM or PTES methodology and clear reporting, not only the tools they used. Check that they can write an actionable report: this is often where candidates fall short.
NIS2 and DORA: which profiles should you hire in 2026?
NIS2 and DORA set the cybersecurity obligations in 2026:
- NIS2: requires essential and important entities (energy, healthcare, transportation, digital services) to appoint a CISO and document their cyber risks.
- DORA: requires the same measures for the financial sector, with a focus on operational resilience.
Profiles to hire:
- Senior CISO: to lead compliance
- GRC Manager: to structure processes
- Compliance Officer: for audits
- Security Architect: for the technical implementation
Profiles that combine legal and technical skills are rare.
Which cybersecurity tools and stacks matter in 2026?
Cybersecurity tools and stacks in 2026:
- SIEM: Splunk, Elastic, Microsoft Sentinel
- EDR: CrowdStrike, SentinelOne, Microsoft Defender
- SOAR: Splunk SOAR, Palo Alto XSOAR
- Pentest: Burp Suite Pro, Metasploit, Cobalt Strike, OWASP ZAP
- Cloud Security: Wiz, Lacework, Prisma Cloud
- IAM: Okta, Microsoft Entra ID
- Secrets: Vault
AI tools for anomaly detection (Darktrace, Vectra AI) are gaining value. French vendors (Gatewatcher, Tehtris) remain strong in sovereign solutions.
What career paths exist in cybersecurity?
Cybersecurity offers several career paths:
- Technical track: Security Engineer → Senior Security Engineer → Lead → Security Architect → Staff Security Engineer
- Management track: Security Manager → Head of Security → RSSI → CISO
- In-demand specializations: Cloud Security Engineer, DevSecOps, Application Security (AppSec)
- Senior pentester: often moves to Red Team Lead, freelance pentester or consultant at a firm
- GRC Manager: moves on to Head of Compliance or DPO
The Founding Security Engineer role at pre-seed startups is gaining value as compliance gets more attention.
Trust us with your hiring in Cybersecurity.
A hands-on approach for hires that last.
Intro call (30 min)
A video call to understand your needs and walk you through our approach.
On-site visit
We meet you on site to get a detailed understanding of your culture and your hiring plans.
Targeted search
The search starts. We present only the candidates who match your requirements.