The context
A Dutch grid-adjacent utility was standing up its own detection capability under regulatory pressure. Existing candidates knew SIEM tooling but had never worked in an environment where you cannot simply isolate a device.
← All cases & insights
Case: staffing a utility's security operations build
An anonymised example from our Security community, where the hard part was finding people who could read both a network diagram and a substation.
Start a conversationClient case · 11 March 2026
The approach
We scoped the roles around OT exposure rather than tool names and drew on specialists from industry and energy backgrounds, including people not actively looking. Screening included a scenario conversation with the client's OT lead.
The outcome
A lead detection engineer and two analysts joined over four months, and the first playbooks were written with plant operations in the room. The client now runs the recruitment for junior analysts internally, which was the intended end state.
More reading
NIS2: what it actually changes for security hiring
The directive created demand for two very different profiles, and most organisations only budget for one of them.
Case: a Business Continuity Management consultant for a large insurerA large insurance company had searched for months for a BCM consultant who fitted a medior budget.
Case: a Telco Engineer for a public media organisation's new buildingA large public media organisation needed a rare connectivity specialist for its IP-based media infrastructure.