Hiring Your First Tester Without Betting the Firm on It

The first hire is the point at which a consultancy stops being a person with clients and becomes a firm with a standard. Most of the risk is not technical, and most of the screening effort goes to the part that is.

Be honest about what you are hiring for

There are two different first hires and they are not interchangeable. One is capacity: somebody to run the work you already sell, to your method, so you can take more of it. The other is coverage: somebody who tests the thing you do not, so you can quote for work you currently decline.

Capacity hires are easier to assess and easier to supervise. Coverage hires are how a firm grows what it can sell, and they carry a risk you should name out loud: you cannot fully review work in a discipline you do not practise. If you take that route, decide in advance who reviews their findings and what happens when you disagree.

Certifications tell you less than a report

Certifications establish a floor and a shared vocabulary, and a client procurement form may require one. What they do not tell you is the thing that decides whether this person can do the job: can they write.

Ask for a redacted report sample, or a public write-up, or a disclosure they have handled. You are reading for whether the finding is reproducible from the text, whether the remediation is specific enough to action, and whether the severity follows from the evidence rather than from the title. A brilliant tester who cannot make a client understand what they found is a person you will spend your evenings rewriting.

The exercise that predicts most

Give them a finding to write up. Not a capture-the-flag, not a box to root: a described scenario with a request, a response and some context, and ask for the finding as it would appear in a report.

An hour of that tells you more than a day of technical questioning, because it exercises everything the job actually involves: judgement about severity, discipline about evidence, clarity about remediation, and the willingness to state what they did not verify. It is also the closest thing to the work, which makes it fairer on the candidate than a puzzle.

If you want a technical exercise as well, keep it short and make it discussable. What you learn from watching somebody explain their reasoning about a weakness is worth more than whether they finished.

Week one is about the method, not the tooling

A new tester will pick up your tooling in days. What takes longer, and what nobody teaches them, is your firm's answers to the questions that have no single right answer.

• What your firm calls each weakness, so two testers do not raise the same thing under two names.
• How you score, and which arguments your firm has already had about severity.
• What evidence you consider sufficient, with examples of both enough and not enough.
• What happens when they find something critical mid-engagement, including who they call and how quickly.
• What they are allowed to decide alone, and what they must escalate.

Write these down before the first hire rather than after. The act of writing them is how you discover which of your standards are actually standards and which are habits you have never examined.

Supervision that does not become a bottleneck

Reviewing everything personally does not scale past the second hire, and reviewing nothing is how a firm discovers its standard has quietly changed. The middle path is to review at the points where a mistake is expensive and irreversible.

Severity and the executive summary are worth your eyes on every engagement, because they are what the client remembers and what gets forwarded. Evidence quality is worth checking early and often with a new tester, then by sample. Descriptions of well-understood weaknesses, once your library is good, need the least attention.

When to hire the second

The signal is not a full pipeline, because a full pipeline is a moment. It is turning down work of a kind you want, repeatedly, for reasons of capacity rather than fit. Two consecutive quarters of that is a pattern; one busy month is a busy month.

The other signal is less comfortable: if the firm cannot deliver an engagement without you personally, you have not hired a tester yet, you have hired an assistant. That is a fine thing to have hired, but it should be a decision rather than a discovery.

Contractors as a first step, honestly assessed

Many firms start with a contractor, and it is a reasonable way to test whether the work is there before taking on a salary. It is worth being clear about what it does and does not prove.

It proves demand. It does not prove that your method survives contact with somebody else, because a contractor usually brings their own and you accept it to get the work delivered. If every engagement comes back in a different shape, you have not tested whether your standard is teachable, which is the thing the first permanent hire will actually depend on.

If you use contractors, use them as a rehearsal: give them your templates, your severity guidance and your evidence expectations, and see what comes back. The gap between what you asked for and what arrived is the most honest assessment you will get of how much of your method is written down and how much is in your head.

What changes about your own week

The part nobody warns you about is that your own utilisation drops, immediately and permanently, and if you have priced on the assumption that it will not, the first hire is loss-making for longer than you planned.

Review takes real hours. So does scoping work you will not deliver yourself, answering questions that used to be internal to your own head, and being available while somebody else is mid-engagement. Budget it as days rather than hoping it fits around the edges, because it does not, and the alternative is reviewing reports at eleven at night, which is where standards quietly go.

The compensation is that the work you keep becomes the work only you can do. If a year after the first hire you are still doing the same engagements you were doing before, with more overhead, something in the arrangement is not working.