First Week
New employees meet the team, get familiar with the workplace, learn about the company’s goals, and understand what is expected of them.
Hiring Lifecycle Playbook
In today's fast-paced world of technology and security, people are our most important resource. How we bring them in, help them get started, And eventually, leaving the company is just as important for keeping our organization strong and secure. For leaders like CISOs, CTOs, and HR heads, handling the employee journey carefully and thoughtfully is essential. This guide focuses on three key areas: Job Advertising, Onboarding, and Offboarding/Termination.
Job Advertising:
- What is it? It's the process of making a public announcement to attract the right people for a job opening. It's like marketing for hiring, where you take the internal job details and turn them into an engaging story that draws in the right candidates.
- Why does it matter? A good job ad doesn't just fill a position; it helps shape the group of people who apply, strengthens your company's image as an employer, and sets up the hiring process for success by bringing in people who fit your company's values and goals. A weak ad brings in the wrong people, makes hiring slower, and can damage your company's reputation.
- Typical contents: A strong job ad includes a clear description of the job's importance, responsibilities presented as results, clearly stated requirements (like must-haves versus nice-to-haves), information about your company’s culture, and clear details about legal terms such as Non-Disclosure Agreements (NDA) or Non-Compete Agreements (NCA).
Job Interview:
What is it? A job interview is a planned way to check a candidate's abilities, past work, skills, experience, how they act, and if they fit with the company's needs, values, and safety rules. It helps confirm the details from the job listing and initial screening, and decides if the person is a good match for the job and the company.
Why Does It Matter? The job interview is a key moment in the process of hiring someone. It has a big effect on how well the person fits the job, how the company performs, and how safe the company is.
- Ensures the right fit: Confirms technical competence, soft skills, and cultural alignment before access to systems and data is granted.
- Reduces hiring risk: Poor hiring decisions increase turnover, insider risk, and operational disruption.
- Improves onboarding outcomes: Well-selected candidates integrate faster and require fewer corrective actions post-hire.
Onboarding:
- What is it? The organized way of helping a new employee get started at the company, from when they accept the job offer up to their first 60 to 90 days.
- Goal: Help them start working effectively and safely (without going into details about tools, training, or company culture).
- Key Elements: Setting up their account and equipment; signing agreements like the NDA/NCA and code of conduct; setting up security like MFA, MDM, and EDR; giving them access based on their role; creating a 30/60/90-day plan; introducing them to the team; and providing training specific to their job.
Offboarding / Termination:
- What is it? The process of carefully removing a person from the organization, whether they resign, their contract ends, or they are let go because of performance issues, behavior problems, or job cuts, in a way that keeps the business safe and makes sure important knowledge is captured and transferred to other co-workers.
- Goal: Quickly remove access, get back company assets, pass on work responsibilities, and maintain professional relationships.
- Focus areas: Following the law, being polite when talking to people, taking quick steps to protect company information, and making sure all records are correct.
- Key Elements: Removing access to accounts like SSO, username and password, and VPN; returning or wiping devices; changing passwords and keys; handing over documents; final pay and benefits; and communicating with the employee during their departure.
Job Advertising Essentials
A job advertisement is your company's first chance to attract top talent. For leadership positions, missing information or unclear details can look unprofessional and turn away the best candidates. Here's a complete look at every important part of a job advertisement.
Job Title
Purpose: The first impression should be clear, straightforward, and follow standard industry practices. Don't use vague or too creative titles.
- Use standard job titles that are commonly recognized in the industry, like "Chief Information Security Officer" or "Principal DevOps Engineer" instead of “Security Ninja”.
- Clearly state the job level, such as "Senior," "Lead," "Director," or "VP."
Job Description
Purpose: A short summary of what the role is about, outlining purpose, scope, and importance.
- This is not a list of specific tasks. It should be a 3-4 sentence summary and easy to understand.
- It answers "Why is this role important? And what are you going to do?"
- Example: “As our new CISO, you will be in charge of changing our security approach, creating a forward-thinking cyber defense plan, and helping to build a culture where everyone values security, all to keep our strong position in the market.”
Location
Purpose: This tells candidates where they will work, helping them decide based on travel or moving needs.
- Local Location: Head Office, Security Department, New York, USA.
- Global Location: We operate in 10 other countries.
- Other Location: Work at least 3 days a week in our London office (If needed).
Timing
Purpose: This tells candidates whether the role is full-time, part-time, shift-based, or offers flexible hours.
- Full-time: Sunday to Thursday, 8:00 AM – 5:00 PM.
- Part-time: Only Sunday, Monday and Friday.
- shift-based: 2 weeks on (Day, Noon, Night), 2 weeks off.
- flexible-time: Work 5 days a week, 9H a day.
- On Call: You will be called based on job tasks.
Contract Type
Purpose: This helps to clarify the type of work agreement, such as permanent, temporary, project-based, freelance, or through a third party.
- Permanent/Direct Hire: A full-time position with benefits.
- Project-Based: Contract for the ERP implementation project (about 18 months).
- Sub-Contract: Make sure to mention if the person will be hired through another company.
Qualifications
Purpose: The basic knowledge, background, minimum education and work experience required.
- Education: A bachelor’s degree in Computer Science, Engineering, or a related field. A master’s degree or MBA is a plus.
- Experience: Be clear and use numbers, EX:
- More than 10 years of experience in information security, with a clear career progression.
- At least 5 years in a leadership position, including 2 years in a Director or higher role.
Certifications
Purpose: This is used to mention the professional qualifications that are needed or would be helpful. Make it clear whether a certification is required or just an added benefit.
- Required: Must have an active CISSP (Certified Information Systems Security Professional) certification.
- Preferred: Having a CISM (Certified Information Security Manager) or CISA (Certified Information Systems Auditor) certification is a big plus
Job Responsibilities
Purpose: This section lists the main duties the employee will do every day or week. It should be in bullet points.
- Watch for security alerts in the SIEM system and take action on security issues.
- Check for weaknesses and test how secure systems are.
- Create security rules and train people on staying secure.
Technical Skills
Explanation: These are the specific hard skills needed for the job—tools, technologies, and knowledge that are directly used in performing the role.
- Good knowledge of SIEM tools like Splunk, QRadar, and Elastic.
- Knowledge of methods and tools used in penetration testing, such as MITRE ATT&CK.
- Experience working with firewalls, intrusion detection/prevention systems, and security solutions for endpoints.
Soft Skills
Explanation: These are personal and people-related skills that help someone work well in a team and adapt to different work environments.
- Ability to think critically and analyze incidents quickly.
- Ability to solve problems effectively during high-pressure security situations.
- Ability to work well with IT, development, and management teams.
- Willingness to learn and adapt to new threats and technologies.
- Note: Salary & Benefits: Including salary and bonuses in a job advertisement is not required. Many companies choose to skip this part because pay can change based on the candidate's skills, certifications, and experience. Instead, you can say something like "competitive salary" or "salary based on experience" to allow more room for discussion during talks.
- Note: Job Sensitivity & Confidentiality: It's usually not common to include in a job advertisement whether the position involves handling sensitive or confidential tasks. This kind of information is typically covered during the interview and clearly outlined in the employment contract. Omitting it from the public advertisement helps keep the company's security measures safe while still drawing in the right people for the job.
Example of job advertisement: Penetration Tester/Red Team
Location
New York, USA (Head Office)
Contract Type
Full-time, Permanent
Work Setup
Hybrid (3 office / 2 remote)
Timing
Mon–Fri, 8:00–17:00
Level
Mid-level, reporting to Red Team Lead/CISO
Qualifications
- Bachelor’s degree in Computer Science, Information Security, or related field
- 3+ years of experience in penetration testing or red teaming
Certifications (Preferred)
CEH
OSCP
OSEP
CRTO
Key Responsibilities
- Conduct penetration tests on applications, networks, and cloud infrastructure.
- Simulate advanced persistent threats (APT) in red team exercises.
- Develop and execute custom exploits, payloads, and evasion techniques.
- Produce detailed technical reports and executive-level summaries.
- Provide recommendations to remediate identified vulnerabilities.
Technical Skills
- Strong knowledge of offensive security tools (Cobalt Strike, Metasploit, Burp Suite, BloodHound, Empire).
- Expertise in Windows and Active Directory exploitation.
- Familiarity with exploit development and custom malware tooling.
- Proficiency in scripting and automation (Python, PowerShell, Bash).
- Deep understanding of MITRE ATT&CK and TTP simulation.
Soft Skills
- Analytical and creative problem-solving in complex attack simulations.
- Strong written and verbal communication for technical and executive audiences.
- Ability to work independently under minimal supervision.
- Collaboration with cross-functional security and IT teams.
- Continuous learning and adaptability in a fast-evolving threat landscape.
Salary & Benefits
Competitive salary (based on experience), medical insurance, training budget, and performance bonus.
Note: salary details can vary depending on candidate qualifications.
Company
XYZ Security Solutions, a regional leader helping enterprises strengthen cyber defenses.
Job Sensitivity / Confidentiality
The specific sensitivity or confidentiality of the role is not detailed in the advertisement. This will be discussed during the interview and formally outlined in the employment contract.
Job Interview
Onboarding a New Employee
3) Why is onboarding important?
All new employees go through an onboarding process, but how well it's done matters a lot. Often, onboarding just means giving someone a bunch of forms and letting a
supervisor or HR person shows them around, with random introductions. But when onboarding is done properly, it sets the stage for the employee's long-term success and also
helps the company. It can make employees more productive, feel more loyal and engaged, and help them do well in their jobs from the start. A strong onboarding experience
increases retention, productivity, and employee satisfaction. According to SHRM,
new hires with structured onboarding are far more likely to stay beyond three years. A good onboarding plan is a great chance to increase employee engagement. For example,
it can help new hires build strong relationships with management, show that the company is committed to helping them grow, and let them know their talents are appreciated.
- Reduces early turnover, many employees leave within 6 months if onboarding is poor.
- Boosts engagement and overall happiness at work.
- Helps new employees become productive faster.
- Helps new hires feel like they belong and are loyal to the company.
- Makes sure employees understand and follow company rules, safety guidelines, and legal requirements.
4) How to Onboard a New Staff Member
A) Before the First Day (Manager, HR & IT)
- Introduce the new team member in the channel or via email to set expectations and create excitement.
- Ensure contracts, NDAs, and HR forms are completed; schedule benefits or payroll briefings if needed.
- Set up technology in advance: laptop/PC, email, SSO/MFA, VPN, password manager, and required software.
- Prepare security access such as ID badge, access card, parking pass, or visitor protocols.
- Confirm workspace readiness: desk, ergonomic chair, monitor, docking station, and phone/headset.
- Prepare stationery and a welcome kit (notebooks, pens, policy handbook, branded items).
- Define 30–60–90 SMART goals to give the new hire a clear roadmap from the start.
- Assign a buddy or mentor, clarify their role, and notify them in advance of expectations.
- Pre-schedule first-week meetings (team introduction, manager 1:1s, orientation).
- Provide a personal welcome note from the manager along with a “Day-1 checklist” and quick-start resources.
- Share cultural material in advance (values, mission, intro video, or employee handbook) to set context.
B) After the First Day (Manager & HR)
Welcome the new hire personally on Day 1, share the agenda, and set clear expectations.
A) Office Space:
- Ensure the employee has their own desk, chair, and storage space.
- Show them department locations and meeting rooms.
- Explain office hours, parking, and visitor policies.
B) Stationery & Supplies:
- Provide notebooks, pens, sticky notes, and filing materials.
- Give access to shared printers and the office supplies cabinet.
- Explain the process for ordering additional supplies.
C) Technical Setup:
- Provide a laptop/PC with proper configuration and internet access.
- Ensure email, calendar, and other needed tools are working.
- Issue access card, ID badge, and door codes if required.
- Verify that access to the office's internal systems is accessible.
- Set up office phone, headset, and other relevant tools.
D) Walk Around:
- Tour the building facilities such as the pantry, cafeteria, and restrooms.
- Show emergency exit doors, fire extinguishers, and evacuation routes.
- Highlight restricted areas, secure labs, or data centers.
- Explain building access policies and the visitor sign-in process.
E) People & Culture:
- Introduce direct managers and team members personally.
- Connect them with cross-department staff and key stakeholders.
- Share organizational chart or team directory for easy navigation.
F) Culture & Training:
- Review company mission, values, and workplace culture.
- Provide orientation on HR policies, code of conduct, and compliance requirements.
- Assign mandatory training (safety, security, data protection).
- Schedule regular check-ins during the first 90 days.
G) Company Policy, Guidelines and Procedures
- Provide a clear overview of company policies, rules, and code of conduct.
- Share employee handbook and key HR documents in digital or printed form.
- Explain procedures for leave, expense claims, overtime, and remote work.
- Review health, safety, and workplace security standards.
- Ensure the employee knows where to find updated policies and whom to contact for clarification.
H) Confidential, NDA & NCA
- Review the Non-Disclosure Agreement (NDA) signed during hiring and reinforce its importance.
- Explain the Non-Compete Agreement (NCA) terms if applicable, including restrictions and duration.
- Provide training on handling confidential and sensitive company information.
- Clarify employee obligations regarding intellectual property, client data, and trade secrets.
- Outline consequences of policy violations to ensure awareness and compliance.
Onboarding in a Nutshell It starts before day one, with HR, IT, and management working together to prepare how to introduce the new person to the team, setting up their access, getting their workspace ready and setting clear goals. On the first day and after that, the focus is on getting them started by welcoming them, helping them set up their technical tools, showing them around the office, connecting them with colleagues, giving them training, and making sure they understand the company culture. During their first 90 days, there should be regular check-ins, meaningful projects to work on, opportunities to give feedback, and preparation for a proper evaluation. It’s important to include reviews of the company policies, confidentiality agreements like NDAs or NCAs, and to show them a clear way to grow and develop in their role.