How to Hire for CNAPP and Cloud-Native Security Roles

Cloud-native security has moved from a niche specialty to a board-level priority. As organizations accelerate their shift to multi-cloud and containerized environments, the demand for professionals who understand Cloud-Native Application Protection Platforms has grown sharply. The challenge is that CNAPP hiring sits at the intersection of several disciplines, including cloud infrastructure, DevSecOps, runtime threat detection, and compliance, making it one of the most technically complex areas of cybersecurity hiring today.

This guide walks you through every stage of building a CNAPP hiring process that works, from mapping the roles you actually need to retaining the engineers you work hard to recruit. Whether you are building a cloud security function from scratch or expanding an existing team, the steps below will help you hire with precision and speed.

Map the skills and roles within CNAPP hiring

Before you post a single job description, you need a clear picture of what CNAPP actually covers and which skills map to which roles. CNAPP is not a single product category; it is a converged platform that typically spans Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), Cloud Infrastructure Entitlement Management (CIEM), and often Kubernetes security and shift-left application scanning. Each of these domains draws on a different skill set, and hiring for one without understanding the others leads to gaps in your security posture.

Start by auditing your current cloud environment and identifying where your protection gaps are. That audit will tell you whether you need a generalist cloud security engineer who can operate across the full CNAPP stack, or a specialist focused on a specific layer such as runtime container security or identity and entitlement management. Common roles in this space include:

• Cloud Security Engineer with CNAPP platform experience (Wiz, Orca, Prisma Cloud, Lacework, or similar)
• DevSecOps Engineer responsible for embedding security into CI/CD pipelines
• Cloud Security Architect designing the overall posture management strategy
• Security Operations Analyst focused on cloud-native threat detection and response
• Cloud IAM/CIEM Specialist managing entitlements and least-privilege enforcement
• Application Security Engineer handling shift-left scanning and code-to-cloud visibility

Once you have identified which roles align with your gaps, you can build a hiring roadmap that sequences your recruitment in order of operational priority rather than hiring reactively when an incident exposes a weakness.

Define your job requirements with precision

Vague job descriptions are one of the most common reasons cloud-native security recruitment stalls. When a posting asks for “experience with cloud security tools” without specifying which platforms, workflows, or environments, it attracts a wide range of candidates, most of whom are not a strong fit. Precision in your requirements saves time for your team and signals to serious candidates that you understand the domain.

Build your job requirements around three categories: technical depth, platform familiarity, and cross-functional context. For a CNAPP engineer role, that might look like this:

1. Define the cloud environments in scope, whether AWS, Azure, GCP, or a multi-cloud setup, and specify the services your team uses most heavily.
2. Name the CNAPP or adjacent tools your team already uses or plans to adopt, so candidates can self-qualify based on real experience.
3. Describe the engineering context, such as whether the role is embedded in a product team, sits within a central security function, or reports into a DevOps organization.
4. Separate must-have technical skills from nice-to-have ones, and be honest about which is which.
5. Include soft skills that genuinely matter for the role, such as the ability to communicate risk findings to non-technical stakeholders or to influence engineering teams without direct authority.

After drafting the requirements, pressure-test them by asking whether a strong candidate reading this description would immediately understand what their first 90 days would look like. If the answer is no, revise until the picture is clear. Explore the open cloud security roles we work with to get a sense of how well-structured descriptions look in practice.

Source CNAPP talent from the right channels

CNAPP talent is scarce because the platform category itself is relatively young, and the professionals who have hands-on experience operating these tools at scale are a small pool. Posting to a generic job board and waiting is rarely effective. Reaching this audience requires deliberate sourcing through channels where cloud-native security professionals actually spend their time.

Consider the following sourcing approaches in combination rather than relying on any single channel:

• Practitioner communities: Forums, Slack groups, and Discord servers focused on cloud security, DevSecOps, and Kubernetes security attract working professionals who may not be actively job hunting but are open to the right opportunity.
• Open source and GitHub: Contributors to cloud security tools, policy-as-code frameworks, and CNAPP-adjacent projects demonstrate hands-on skill in a verifiable way. Reviewing contributor lists can surface strong passive candidates.
• Conference networks: Events such as KubeCon, fwd:cloudsec, and cloud provider security summits bring together practitioners who are deeply invested in the space.
• Referrals from your existing team: Cloud security professionals tend to know each other. A structured referral program that rewards your current engineers for introductions is often the fastest route to qualified candidates.
• Specialized recruitment partners: For hard-to-fill roles, working with a recruitment firm that focuses specifically on cybersecurity hiring gives you access to a pre-vetted network of cloud-native security talent that is not visible on the open market.

With your sourcing channels active, the next step is building an interview process that accurately evaluates the skills you have defined without creating unnecessary friction that causes strong candidates to drop out.

Design a technical interview process that works

The interview process for cloud-native security roles needs to test real-world judgment, not just theoretical knowledge. Candidates who can recite how a CSPM works are not necessarily the same candidates who can triage a misconfiguration alert, prioritize remediation across hundreds of findings, or work with an engineering team to fix the root cause without disrupting a release cycle.

Structure the process in stages

A well-structured CNAPP interview process typically runs across three to four stages. Keep each stage purposeful and avoid duplicating what a previous stage already assessed:

1. Initial screen: A 30-minute conversation to confirm baseline experience, understand the candidate’s cloud environment exposure, and assess communication clarity.
2. Technical discussion: A deeper conversation with a senior engineer or security architect that explores how the candidate has approached specific cloud security problems, such as managing posture drift, reducing alert noise, or implementing least privilege at scale.
3. Practical exercise: A scenario-based task or take-home exercise that reflects real work, such as reviewing a set of misconfiguration findings and explaining how they would prioritize and remediate them.
4. Cross-functional interview: A conversation with stakeholders from engineering, DevOps, or product to assess how the candidate collaborates across teams.

Avoid common interview design mistakes

Keep the total process to a reasonable length. Processes that stretch beyond four weeks or require more than five separate interviews signal poor organizational decision-making to candidates who are likely fielding multiple offers. Also avoid relying heavily on abstract whiteboard exercises that do not reflect the actual work of operating a CNAPP platform. Scenario-based questions grounded in realistic situations produce far more useful signal.

After each stage, ensure interviewers submit structured feedback against the same criteria rather than general impressions. Consistency in evaluation reduces bias and makes the final hiring decision easier to defend.

Close offers in a competitive talent market

Experienced CNAPP engineers and cloud security architects are in high demand, and the best candidates rarely stay available for long. A slow or poorly communicated offer process is one of the most common reasons strong hires are lost at the final stage.

Move quickly once you have made a decision. Ideally, you should be able to extend a verbal offer within 24 to 48 hours of completing final interviews. To do that, you need to have the compensation range, equity structure, and benefits package confirmed internally before the final interview stage begins, not after. Waiting until a candidate has verbally accepted to begin internal approvals introduces delays that signal disorganization and erode confidence.

When structuring the offer itself, consider what matters most to cloud-native security professionals beyond base salary:

• Clarity on the technology stack they will work with and the tools they will have access to
• The scope of their impact and whether they will have genuine ownership over cloud security strategy
• Remote or hybrid flexibility, which remains a significant factor in cybersecurity hiring
• Learning and development budget, particularly access to hands-on labs and platform training
• Team culture and the quality of the engineering organization they will be joining

If a candidate is weighing your offer against a competing one, a direct conversation about what matters most to them is almost always more effective than a counter-offer made without context. Ask, listen, and respond to what they actually value. For more guidance on building a compelling employer proposition for cloud security talent, visit our hiring solutions for organizations.

Retain cloud security hires for the long term

Retention in cloud-native security starts before the hire’s first day. The onboarding experience, the clarity of their role, and the quality of their early relationships with the team all shape whether a new hire becomes a long-term contributor or starts looking elsewhere within six months.

Build a structured onboarding plan that gives cloud security hires meaningful work early while also giving them the context they need to operate effectively. This means access to documentation, architecture diagrams, and existing runbooks from day one, along with clear 30-, 60-, and 90-day goals that are agreed upon with the hiring manager. Avoid the common mistake of leaving new hires in an onboarding limbo where they spend their first weeks in passive orientation without touching real work.

Beyond onboarding, the factors that drive long-term retention in cloud security roles include:

• Technical growth: Cloud-native security evolves rapidly. Engineers who are not learning feel stagnant. Create space for experimentation, tool evaluation, and contribution to internal knowledge sharing.
• Visibility and influence: Cloud security professionals who can see the direct impact of their work and who have a voice in shaping security strategy are far more engaged than those executing tasks handed down from above.
• Career progression: Define clear paths for advancement, whether that means deepening technical specialization, moving into architecture, or stepping into a leadership role.
• Manager quality: The relationship between a cloud security engineer and their direct manager is consistently one of the strongest predictors of retention. Invest in manager development alongside technical development.

Retention is also a signal about the quality of your hiring process. When you hire people who are genuinely well matched to the role, the team, and the organization, they stay. When there is misalignment on any of those dimensions, no retention program will fully compensate for it.

How Iceberg helps with CNAPP and cloud-native security hiring

CNAPP hiring is one of the most technically demanding recruitment challenges in cybersecurity today. The candidate pool is small, the skill sets are highly specialized, and the cost of a slow or misaligned hire is significant. That is where we come in.

At Iceberg, we specialize exclusively in cybersecurity recruitment, which means we understand the nuances of cloud-native security roles in a way that generalist recruiters do not. Here is how we support organizations hiring in this space:

• Access to a global network of over 120,000 cybersecurity professionals across 23 countries, including passive candidates who are not visible on the open market
• Precision matching that goes beyond job title alignment, assessing platform experience, engineering context, and cultural fit
• Speed without compromise, with 98% of our placements remaining in role or being promoted within 18 months
• A complimentary Vacancy Health Check, a 30-minute consultation to diagnose exactly why a CNAPP or cloud security role is proving difficult to fill and what you can do about it

If you are struggling to find the right cloud-native security talent or want to build a more effective hiring process from the ground up, get in touch with our team and let us help you move faster without sacrificing quality.