A good security contractor is often booked elsewhere within a few days. If your hiring request is sharp before it goes out, you get better candidates and lose fewer of them along the way. Below is what I think needs to be in place before you send out a request to hire a security contractor.
Why the request has to be ready before it goes out
At a Dutch grid operator looking for a security architect, the deadline for putting candidates forward was one day after my first conversation with the candidate. Then I want the CV with the manager the same day. If you only come back with a shortlist after a week, you are out of the running.
You only reach that pace if the client knows what they are looking for. Most of the delay in hiring a contractor, as I see it, happens before the request goes out. Requirements, budget and who signs off are still being discussed internally, while the candidates you want are already interviewing somewhere else.
The security contractor hiring checklist
1. Write down what must be finished in three months
"Security architect, 36 hours" tells a candidate very little. Describe in one or two sentences which problem will be solved when the assignment ends. For example: a target architecture for segmenting the office network, approved by the architecture board. A contractor can then judge whether they have done this before. And you can hold every CV up against that sentence.
2. Keep the hard requirements few
Separate what you truly cannot do without from what would be nice to have. Three or four hard requirements is plenty, in my view. Every extra requirement takes people out of the market who could do the work perfectly well. Only make a certification a hard requirement when it is mandatory, for example because a public tender asks for it. How a Dutch government request works is covered in hiring security contractors for the Dutch government.
3. Fix the practical terms
Start date, expected duration, hours per week and the number of days on site. For a candidate, those are the points that decide whether they reply at all. Also state whether an extension is possible and whether part of the work can be done remotely. Leave them out and you mostly get questions back, each of which costs time.
4. Settle the rate budget internally
Know in advance what budget is available and who decides on it. If a higher rate still has to go past procurement or the controller after the intake, you lose days. In a tender with a maximum rate, there is no headroom at all. Outside a tender there often is, provided someone has secured budget sign-off in advance.
5. Book the interviews now
Block two or three slots in the hiring manager's diary for the week after the request goes out. Agree who does the second interview and whether a technical check is needed. A candidate left waiting three days for a reply may well accept an offer from a client who moved faster. For the content of the interview, the interview questions for a TPRM specialist are a useful example.
6. Run the screening in parallel
If you ask for a Dutch Certificate of Conduct (VOG), build in the lead time. Justis, the agency that issues it, states a processing time of 1 to 4 weeks, and up to 8 weeks in some cases. For a self-employed contractor, the client usually says how the application should be made: either the client sets up a digital application, or the contractor applies online directly. Applying directly is only possible for work in healthcare, financial services or legal services. The contractor applies for a new VOG for every new assignment, even if they had one last year.
My advice: set up the VOG application as soon as you choose a candidate, and arrange accounts, laptop and access pass at the same time. A specialist who spends the first week waiting for an account costs you money before they have done any real work.
7. Choose the contract type before you start searching
Freelance or secondment is a choice you are better off making up front. The Dutch Tax Administration (Belastingdienst) has fully enforced the rules on false self-employment again since 1 January 2025. Organisations that hire self-employed contractors for work that in practice is not done independently can face an additional tax assessment after an inspection, with retroactive effect back to 1 January 2025. For 2025 the Belastingdienst imposed no penalties for late filing or culpable conduct. It has not approved any new model agreements since September 2024. In March 2026 the Dutch government dropped the part of its Vbar bill that was meant to clarify when someone counts as self-employed. A new Self-Employed Persons Act (Zelfstandigenwet) is meant to replace it, with no date set yet. Until then, full enforcement continues.
For security work, my view is this: a specialist who delivers a clearly scoped project fits a freelance arrangement well. Someone who structurally fills a permanent seat in your team, managed the same way as your own staff, is more likely a candidate for secondment or a permanent job. Put that question to your HR or legal team before the request goes out. I am not a lawyer, and converting afterwards is always harder than choosing up front.
One page is enough
With these seven points on paper, an agency or your own recruiter can start a targeted search the same day. I value a one-page request covering these points more than a five-page job description that mostly lists what the organisation does. The candidate wants to know what they are there to solve, when, on what terms and how quickly a decision will be made.
Once the request is ready, check one more thing: can the hiring manager meet a candidate this week? If not, sort that out first.
Help with your hiring request
Through MVPeople we provide freelance and interim security specialists from our network of 7,000+ professionals, and we present the first candidate within 4 hours. Is your request ready, or do you want to sharpen it first? Call or email me and we will go through the points together before you send it out.
