What happens when a search for a senior security researcher in Paris runs for six months and ends with zero hires.
In recruiting, we talk a lot about the missions we win. Far less about the ones we fail to fill. This article is about one of those: a search for a Senior Cybersecurity Researcher at a European B2B SaaS cybersecurity startup based in Paris, which has raised $50M. We ran it properly. It still did not close. Here is what the data showed, and what it says about hiring in this market.
Every recruiter knows this feeling: the weekly update where the honest answer is “still nothing”. We decided to do something with it instead of hiding it.
The role
The brief was a Senior Cybersecurity Researcher, based in Paris, working on vulnerability research. In practice that means someone with six or more years of experience, published CVEs, reverse engineering depth and the ability to work autonomously.
It is a narrow profile. We knew that from day one. We did not know how narrow.
How we ran the search
This is the same technique we run on every hard search. Six moves, in order.
1. Count the market before touching it. Before the first message went out, we mapped the pool: 147 qualified profiles within 25 miles of Paris, about 4,500 across Europe on the same criteria. Every later decision was measured against the size of that pool, never against effort.
2. Build the search library. We turned the brief into a working document: 8 primary titles (Senior Security Engineer, Security Researcher, Offensive Security Engineer), 6 less obvious ones (threat intelligence researcher, reverse engineer, exploit developer), 3 emerging AI-security titles, and the keyword map behind them. The search was calibrated to how the pool actually names itself: reverse engineering covers 26% of it, malware analysis 14%. Rare skills (OAuth 4%, JWT 2%, supply chain 1%) were banned as filters. Stack them and the search returns nobody; test them in the interview instead.
3. Rank the targets. Tier 1: the Paris offensive security boutiques and agencies, where the active CVE publishers sit. Tier 2: alumni of the feeder employers in defence and research, approached only after 18 months in their current role. With average tenure at 2.9 years, that is the window where people start listening.
4. Outreach in a short sequence. Three touches over nine days, under 100 words each. An opener that leads with the team’s published research and asks for ten minutes. A follow-up with three links – a talk, a write-up, the research blog – scannable in seconds. A low-pressure close that points to the lead researcher and leaves the door open. Two variants: cold, and research-led for anyone with a public CVE, talk or blog post, with their own work referenced in the first sentence.
5. Run a disciplined pipeline, and read it honestly. From June to August 2026 we contacted 275 profiles, more than 74% of the addressable Paris market. 74 replied, a 27% response rate, healthy for cold outreach to senior researchers. Combined with inbound applications, 109 candidates entered the ATS between March and August. Every stage tracked, every drop-off read for what it was.
6. Bring the data to the table. When the funnel stalled, we did not “search harder”. We put the numbers in front of the client – market size, refusal reasons, seniority tiers, three costed options – and moved the conversation from effort to decision: geography, contract, or profile.
The search did not close. The method held: it told us exactly why, and what has to change for the role to fill. That is the point of running a search this way: even a miss produces a map.
Here is what that pipeline looked like.
Chart 1 – The hiring funnel (each block is about 6 candidates)
| Stage | Candidates | |
| Inbox | ██████████████████ | 109 |
| Shortlist | ███████████ | 68 |
| Screening call | █████ | 31 |
| Manager interview | ██ | 11 |
| Technical interview | █ | 5 |
| Advanced technical round | · | 1 |
| Hired | · | 0 |
Nothing in that funnel is unusual. The drop-offs are normal, and one candidate reached the final technical round. The process was not broken. The pool was too small.
What we would propose: keep the funnel exactly as it is and fix what feeds it. A funnel this healthy only converts if enough qualified people enter it, so the first move is to widen the top (see the options below), not to add stages or lower the bar.
The real problem: the market is smaller than the brief
Our market mapping found 147 qualified profiles within 25 miles of Paris. We contacted 275. That means we reached more than 74% of the addressable market in about three months.
When people say “you are not searching hard enough”, this is the answer. We had run out of people to search for.
Of the 74 replies, the majority were refusals. About 80% came down to one thing: the candidate needed full remote, or could not commit to three days a week in a Paris office. The rest was split between role fit, package and timing.
The profile we wanted, senior researchers with public CVEs, is the same segment that left Paris after COVID and negotiated remote work. The people we needed were the people least available to a Paris on-site role.
What we would propose: stop treating the on-site rule as fixed. Offer one day a week in Paris, or a quarterly on-site rhythm, and test it against the same 74 replies: the people who said no for remote reasons are the first ones to re-approach.
What we understood
The market splits into tiers. The further up you go, the harder the person is to reach, and the more it costs. Junior and mid-level researchers are in Paris and on-site ready, but they do not have the depth this role required. Principals are well paid, locked into equity, and they do not move. The profile we needed sat exactly in the tier that moved away from Paris-only roles: senior researchers with six years or more and published CVEs, the same segment that left Paris after COVID or negotiated remote work. Sourcing only inside Paris structurally misses it.
Annual compensation by seniority tier, Paris market estimates – not offers made, and not data from the client.
What we would propose: go where the tier went. Open the role to near-remote France and then Europe, widen the title net (vulnerability researcher, reverse engineer, threat intelligence researcher), and use a freelance specialist as a bridge while the permanent search runs.
How the Paris market is divided
The 147-profile Paris pool averages 12.3 years of experience and 2.9 years of tenure in the current role, so the realistic window to approach someone opens around 18 months in. 86% live inside Paris itself. Only 7% are women, a gap that matches the wider European pool.
Chart 2 – What the pool is called (share of the Paris pool by job title)
| Title | Share | |
| Senior Security Engineer | █████████████████ | 17% |
| Security Researcher | ████████████ | 12% |
| Senior Network Security Engineer | █████ | 5% |
| Senior Cloud Security Engineer | ██ | 2% |
| Senior Security Researcher | ██ | 2% |
| Senior Offensive Security Engineer | █ | 1% |
Chart 3 – What the pool can do (share of the Paris pool by skill)
| Skill | Share | |
| Reverse engineering | █████████████████ | 26% |
| Malware analysis | █████████ | 14% |
| Go | ███████ | 10% |
| Rust / red teaming | █████ | 7% |
| Vulnerability research | █████ | 7% |
| CVE track record | ███ | 5% |
Reverse engineering is the single most common skill, and the most useful search filter. Rarer skills such as OAuth (4%), JWT (2%) and supply chain security (1%) should never be hard filters: stack them and the search returns almost nobody. Test them in the interview instead.
What we would propose: build the search around the common signals (reverse engineering, malware analysis, Go, Rust) and test the rare ones in the interview. That keeps the pool open and still finds the people who can do the work.
Universities matter less than people assume. The top feeders are ESIEA (6%) and Epitech (5%), ahead of every grande école. Polytechnique does not appear in the top ten. Half of the pool (58%) holds a Master’s degree.
Who employs them
The Paris pool sits in four types of company: government agencies and research institutes (ANSSI, CEA), offensive security boutiques (Synacktiv, Quarkslab, Randorisec), defence and telecom groups (Thales, Airbus Defence, Ericsson, Orange Cyberdefense), and big tech and scale-ups (Apple, Amazon Web Services, Datadog, Ledger).
Chart 4 – Where Paris profiles work today (number of profiles in the pool)
| Current employer | Profiles | |
| Datadog | █████ | 5 |
| Ericsson | █████ | 5 |
| ANSSI (French national cyber agency) | ████ | 4 |
| Randorisec | ████ | 4 |
| Ledger | ███ | 3 |
| FuzzingLabs | ███ | 3 |
Chart 5 – Where they used to work (past employer, number of profiles)
| Past employer | Profiles | |
| Thales | ██████████ | 10 |
| CEA | ███████ | 7 |
| ANSSI | ██████ | 6 |
| Quarkslab | █████ | 5 |
| Orange Cyberdefense | ████ | 4 |
| Airbus Defence | ████ | 4 |
Thales is the number one feeder: 10 profiles passed through it, 7% of the pool. Defence and aerospace is where French researchers learn the trade, then leave.
What we would propose: map the alumni of the feeder employers (Thales, CEA, ANSSI, Quarkslab, Orange Cyberdefense) and approach people with 18 months or more in their current role, the window in which they start listening. Our target list ranks the Paris boutiques and agencies first and the feeders second.
Among the best-rated Paris profiles we shortlisted (72 researchers rated four or five stars), two employers stand out: Apple and the offensive boutique Synacktiv.
Chart 6 – Employers of the top-rated Paris researchers (count among 72 shortlisted profiles)
| Employer | Profiles | |
| Apple | █████████ | 9 |
| Synacktiv | ████████ | 8 |
| Datadog | ████ | 4 |
| AWS | ████ | 4 |
| Quarkslab | ███ | 3 |
| Thales | ███ | 3 |
| Orange Cyberdefense | ███ | 3 |
Roughly half of those 72 are rated five stars (37), half four (35). The five-star group is where the CVE holders and conference speakers are. It is also where the competition for them is fiercest, because the same employers keep them.
Paris vs the rest of Europe
The same search criteria across Europe returned about 4,500 profiles, against 147 in Paris. The European pool averages 13.7 years of experience, 3.5 years of tenure and is 65% senior-level (52% in Paris).
Chart 8 – Largest European cities by pool size (each block is about 15 profiles)
| City | Profiles | |
| London | ██████████████████ | 263 |
| Paris (25-mile radius: 147) | ████████ | 126 |
| Berlin | ████████ | 118 |
| Zurich | ██████ | 97 |
| Dublin | ██████ | 88 |
| Madrid | ██████ | 88 |
| Warsaw | ██████ | 84 |
| Barcelona | █████ | 82 |
| Amsterdam | █████ | 73 |
| Bucharest | █████ | 73 |
The big employers are different too. Paris leans towards defence and government. Europe leans towards Big Tech and pure-play security vendors.
Chart 9 – Largest employers of the European pool that are not present in Paris (profiles)
| Employer | Profiles | |
| Microsoft | ████████████████ | 78 |
| CrowdStrike | ███████ | 35 |
| Bitdefender | ██████ | 30 |
| HackerOne | ██████ | 29 |
| Kaspersky (past employer) | █████ | 25 |
Reverse engineering is still the number one skill in both markets (26% in Paris, 19% in Europe). Rust is higher in Paris (7% against 4%), a sign of the French defence ecosystem.
Where the conversations happen matters too. Researchers gather at SSTIC in Rennes (the number one French research conference), leHACK in Paris, Botconf, Black Alps in Geneva, DEF CON and Black Hat. Speaker lists from those events are the best sourcing map there is.
What Project Zero does to attract top security researchers
Project Zero is Google’s team of researchers dedicated to zero-day vulnerabilities. The research community treats it as a benchmark, and the brief for this search used it as the reference for the profile we were chasing. For a Paris search it is an indirect competitor at most. The useful part is how it attracts people. From the team’s own public writing, five things stand out.
A mission people can repeat in one line. Its motto is “Make zero-day hard.” Launched in 2014 as a well-staffed team that puts 100% of its researchers’ time into making the Internet safer.
Work done in the open. From day one the team committed to filing every bug it finds in an external database and to discussing interesting findings on its blog. Its pitch to researchers: a place to do what you love, “in the open and without distraction”.
A public portfolio is the application. The team says most of its hires have a history of publicly reporting vulnerabilities, and that a public portfolio of vulnerability research and exploit development is a great way to get noticed. It looks for creativity, quality and results that are communicated well.
Researchers choose what matters. At launch the team said that beyond finding and reporting bugs, it would research mitigations, exploitation and program analysis, “and anything else that our researchers decide is a worthwhile investment”.
Open doors beyond the obvious CV. Members come from product security, consultancies, government security teams, other Google teams and, for some, straight from university. There is no predefined career path, no strict rule about having public bugs, and the team says a reputation can be built even when results cannot be published.
For scale, a job post circulating in August 2026 reported US pay of $207,000 to $300,000 plus bonus and equity for a senior research role there. That figure comes from a secondary source, and a US package is not like-for-like with a Paris one, so we read it as a sign of where the top of the market sits, not a number to match.
What we would propose: copy the mechanism, not the budget. Give the role a one-line mission a researcher can repeat. Let the team publish: write-ups that include the dead ends, CVE credits, a talk at SSTIC or leHACK, so researchers can judge the work before we ever message them. Protect a share of research time that the researcher chooses. Treat public portfolios as the application: source from CVE credits, conference speaker lists and write-ups, and accept strong profiles from consultancies, government teams and product security, not only people titled researcher. Below senior level, grow your own: a clear researcher path for strong security engineers builds the senior bench you cannot buy.
Sources: Project Zero’s own pages, https://projectzero.google/about-pz.html, https://projectzero.google/2014/07/announcing-project-zero.html and https://projectzero.google/working-at-project-zero.html (team post last updated 2019).
What we would do differently
The constraint was not the quality bar. It was geography. A high bar and a pool of 147 gives you nothing to choose from. The same bar with a pool of 4,500 lets you be selective. We mapped three options:
| Option 1: adjust the profile | Option 2: near-remote France | Option 3: full remote | |
| Pool | About 300 reachable French profiles | About 600, extends to Rennes (SSTIC cluster) and other hubs within 2 hours by train | 4,500+ across Europe, plus New York |
| Policy change | None. Paris, 3 days in office | One day a week in the Paris office | Quarterly or bi-monthly on-site |
| What changes | Lower the seniority bar to 8-10 years (from 12+), favour research signals (CVEs, talks), accept engineers on a researcher growth path | Same criteria, bigger pool, team stays cohesive | Same criteria, no compromise on the bar. London 263, Berlin 118, Zurich 97 |
| Trade-off | The pool roughly doubles but stays finite. The best candidate may not exist in Paris | The sweet spot, but still limited without going fully remote | Needs a deliberate policy decision. Selectivity goes up, not down |
Our recommendation: start Option 1 immediately since it needs no policy change, activate Option 2 in parallel, and treat Option 3 as the escalation if Paris and France produce no hire within six weeks. A larger pool is not a compromise. It is the strategy.
Beyond the search itself, researchers do not apply. They come to companies they respect. Published write-ups of real findings, CTF challenges, a talk at SSTIC or a researcher on a French security podcast do more than any job ad. They take 6 to 12 months, so start before you need to hire.
Lessons for founders, tech leaders and hiring managers
- Size the market before you open the role. Count the qualified people who can actually say yes under your constraints. If the number is in the low hundreds, plan for months, not weeks.
- Your work policy is a sourcing filter. If most of your target profile has negotiated remote work, a strict on-site rule removes most of them before you send a message.
- Know your tier and its price. A senior researcher costs €85K to €105K. Principals cost more and will not move. Decide which tier you are really hiring.
- Do not combine rare skills as hard filters. Treat them as signals and test in the interview.
- Look beyond the obvious titles. Vulnerability researchers, reverse engineers, offensive security engineers and threat intelligence researchers all feed this pool.
- Bring the data to the table early. The most useful thing we did was show the numbers and move the conversation from “search harder” to “decide on geography, contract or profile”.
Where this leaves the search
As of the end of August 2026, no hire had been signed. What the client decided next stays with the client.
And you – what would you have chosen? Adjust the profile, open the search to near-remote France, or go fully remote across Europe? Which technique would you have used to run it? Write to us: we read and answer every message.
We are sharing it because the missions that do not close teach more than the ones that do. If you are hiring senior security talent in France, we hope the numbers above save you a quarter.
Hiring in a market this tight? Talk to us directly.
Email: j.entresangle@fledge.net
WhatsApp: +33 6 08 63 98 03
