You want to hire a security engineer, but how do you know you are getting the right one? Security is not an ordinary IT role. You give someone access to exactly the systems you want to protect.
In this article you will learn what to look for when hiring a freelance security engineer. Which profile do you need, which certifications mean something, and how do you handle screening and access? The Dutch DBA Act is covered too.
This blog is for clients: IT managers, CISOs and CTOs who need security expertise temporarily. It is about selection, not prices. Want to know what it costs? Then read our blog on the cost of a security engineer.
Why is hiring a security engineer so hard right now?
Because demand is rising faster than supply. Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet) has applied, the Dutch implementation of NIS2. More than 8,000 organisations must now demonstrably meet digital resilience requirements. In the financial sector, DORA applies as well. All those organisations are looking for the same scarce specialists at the same time.
The Cybersecurity Act requires, among other things, registration, a risk analysis, appropriate measures and reporting incidents within 24 hours. Directors are personally responsible. Suppliers also often get stricter requirements through their clients.
The result: good security engineers are gone fast. Those who start too late or search too vaguely miss out or settle for less.
Which security profile do you actually need?
That depends on your question, and "security engineer" covers many roles. A specialist who sets up your SIEM is someone different from a pentester or an IAM specialist. So start with the problem you want to solve, not with the job title. A sharp question leads to a better match.
The most common profiles:
- Security engineer: builds and manages security measures, such as firewalls, EDR and SIEM
- Cloud security engineer: secures your cloud environment, focusing on configuration and access
- IAM specialist: handles identities, rights and access management
- Pentester or ethical hacker: tests your systems by attacking them in a controlled way
- Security architect: designs the security of your whole environment
- Interim security officer: helps with policy, risk analysis and compliance such as NIS2
For NIS2 compliance you often need a combination. An architect or officer for the risk analysis and policy, and an engineer for the technical measures. Decide in advance which part you want to outsource.
Which certifications mean something?
Certifications are a useful signal in security, because they often require experience. Examples are CISSP and CISM for broader security and management roles. OSCP shows practical pentesting skill. Cloud providers have their own security certifications for their platforms.
A certificate is an indication, not a guarantee. Always probe on concrete experience. What has someone done in a comparable environment? Which incidents have they handled? Which choices did they make, and why?
Also check the match between certificate and role. A CISSP says a lot about broad knowledge, but little about hands-on pentesting. An OSCP, in turn, says little about policy and governance.
How do you screen a security engineer?
More thoroughly than an ordinary IT professional. A security engineer often gets access to sensitive systems and data. Under the Cybersecurity Act, screening is also a recognised measure for personnel security. So ask for a certificate of conduct (VOG) and check references with previous clients.
In the intake, also talk about integrity and working method. How does someone handle confidential information? What do they do if they find something outside the scope? A good security professional has a clear and calm answer. Want to know how to run such a conversation? Read our blog on assessing a freelancer in an intake.
How do you arrange access and confidentiality?
With clear agreements before someone starts. Grant only the rights needed for the assignment, and revoke them as soon as it ends. Record confidentiality in the contract. For a pentest, agree in writing what may and may not be tested.
A few practical points:
- Work on least privilege: no more access than needed
- Log what the external specialist does in your environment
- Record confidentiality and liability in the agreement
- For pentests, agree a scope and time window, in writing
- Arrange offboarding: revoke rights, rotate keys, return data
These are not signs of distrust. A good security engineer even expects them. Anyone who makes a fuss about them is a signal to be careful.
What about the Dutch DBA Act in security hiring?
That depends heavily on the type of assignment. A pentest is defined and result-driven, and fits independence well. An engineer who works in your security team for months, or an interim security officer in a fixed role, runs more risk of embedding and authority. It is exactly those long-running roles you need to watch.
So steer on a defined result: a configured SIEM, a completed risk analysis, a delivered report. Avoid the specialist effectively becoming a permanent team member. Want to know how the assessment works? Read our guide to the 9 assessment factors of the Dutch DBA Act.
For long-running security assignments, the intermediary construction can be sensible. Maedium then sits contractually in between and takes on the risk. The specialist stays an independent entrepreneur, without authority or embedding. That is a commercial agreement, not a legal guarantee: the Tax Authority always looks at actual practice.
What does a freelance security engineer roughly cost?
Security is among the more expensive IT profiles. As an indication, a freelance security engineer charges somewhere between 65 and 115 euros per hour. Specialist roles and scarce combinations sit at the top end. See this as a range, not a fixed price; it depends on experience, specialism and market.
Weigh the rate against the risk. A cheap specialist who misses a vulnerability is ultimately the most expensive choice. In the financial sector, DORA adds extra requirements. Read more in our blog on IT hiring in the financial sector.
Frequently asked questions about hiring a security engineer
Which security profile do I need for NIS2?
Often a combination. For the risk analysis and policy, a security architect or interim security officer. For the technical measures, a security engineer. First determine what you already have in house and which part you want to outsource.
Should a security engineer have a certificate of conduct?
It is strongly recommended. A security engineer gets access to sensitive systems and data. Under the Cybersecurity Act, screening is a recognised personnel security measure. Besides a VOG, also ask for references from previous clients.
Are certifications like CISSP or OSCP enough?
No, they are an indication, not a guarantee. Check whether the certificate fits the role, and probe on concrete experience. A CISSP says a lot about broad knowledge, an OSCP about practical pentesting. Experience in a comparable environment weighs most.
How fast can I hire a security engineer?
That depends on the profile and the market. Since the Cybersecurity Act, demand is high and supply is tight. So start well in time. A sharp profile description and an intermediary with a security network speed up the process.
Is a pentest DBA-proof?
Usually easy to arrange, because a pentest is defined and result-driven. There is a clear scope, a final report and an end date. The risk lies mainly in long-running security roles where someone effectively becomes a permanent team member.
Conclusion: start with the problem, not the title
Hiring a good security engineer starts with a sharp question. Which problem do you want to solve, and which profile fits it? Then you test for experience over certificates, screen thoroughly and set strict rules for access and confidentiality. Arrange the Dutch DBA Act too, especially for long-running work.
For whom is this most urgent? For organisations covered by the Cybersecurity Act or DORA that need to move fast now. For whom less? For those who only need a one-off, defined pentest.
My advice: start earlier than you think. In this market, time is the scarcest resource.
Help finding the right security specialist?
Want to spar about which security profile you need, or hand over the pre-selection? Plan a no-obligation call with me.
Note: this article is general information, not legal advice. Rates are indicative. Regulations around the Dutch DBA Act, NIS2 and DORA may change; consult rijksoverheid.nl, ncsc.nl or belastingdienst.nl for current information.
