In a portfolio company the security hire is often two jobs at once, and that’s where the brief goes wrong. Someone has to stand the controls up with their own hands. Someone else has to sit with a board or an investor and explain what could go wrong in terms the business can act on. In a large organisation those are two people. In a lean PE-backed business they’re frequently the same person, and the brief is where that gets decided.
One role, and the wrong half of it
The framing we work to separates security leadership into a small number of archetypes that build on each other, and the one that fits a portfolio company is the Builder: senior enough for the boardroom and still hands-on enough to stand the controls up. That description is doing a lot of work, because the two halves attract different people and the market holds more of one than the other.
The mismatch runs in both directions, and both are expensive. Hire a leader whose career has been spent at the governance end and you’ve bought judgement for a function that still needs building. Hire one who is excellent with the controls and has never had to carry a board’s confidence and you’ll get a working control environment with nobody able to argue for it.
Where the brief goes wrong
The brief tends to describe one half. It asks for a strategist, because that sounds like the senior answer, when what the business needs is someone who will get the controls in first and earn the right to be strategic later. What comes back is a shortlist of people who can hold a board and not much else, and the search gets the blame for a brief that was written for a business the client doesn’t have.
I push back hardest on niche technical requirements, because hard requirements around a few tools usually tell you more about the person writing the brief than about the job. The security version is a brief built around frameworks and certifications, which describes someone who can pass an audit rather than someone who can change how the business holds risk.
It’s the same thing that happens with technology leadership hires generally. People cheap out on the role that needs to be bigger and make concessions that were always going to be a problem. They ask for someone hands-on because the team is small, and what they get is someone hands-on who can’t lead and can’t structure the work so the existing team moves the needle. In security that failure is quiet, because nothing visibly breaks, and you’ve paid for a control environment and bought a technician.
What the build-out record shows
The security role rarely arrives on its own, and scoping it as though it will is where these searches start badly. In a PE-backed healthcare group we ran a technology leadership build-out that covered the whole function: the CIO, a chief architect, the head of data, the head of security, and the operational roles beneath them. The security hire went in as one of a set of appointments rather than as a single fix.
Where the rest of the function is being settled at the same time, the security brief gets written against something concrete: what’s regulated, what the board has to be able to say, and what the function has to do itself rather than buy. Where the security hire goes into a business that hasn’t decided any of that, the brief turns into a wish list and the hire ends up judged against expectations nobody wrote down.
What to settle before you approach anyone
Four things are worth settling before anyone is approached.
What the board is carrying. Not the risk register. The question someone on the board would actually ask if something went wrong. If nobody can answer it, the hire will define their own mandate, and that’s a coin flip.
How much function already exists. An early build wants someone on the tools. A business with a working control environment and a board asking harder questions wants a different person, and the title is identical in both briefs.
Whether one person can carry it. Some portfolio companies do need both ends covered, and the honest answer is occasionally that the role has to be funded properly rather than handed to someone in a job with two incompatible halves.
What the reporting line says. Security sitting under the CIO reads as a function of IT, which is right in some businesses and wrong in others, and candidates read that line closely.
Frequently asked questions
What it costs to get wrong
Security is a hire where getting it wrong doesn’t announce itself. The business keeps running, the reporting keeps going up, and the gap tends to surface at the worst possible moment, usually when a buyer’s diligence team starts asking questions the business can’t answer.
Which is why this one is worth writing properly, and writing it properly means deciding which half of the job you’re really hiring for, or admitting you need both and funding the role that way. If you’re about to write that brief, [we run these searches](/what-we-do/executive-search/) and the conversation is more useful before it’s settled than after.
