Building a Product Security & DevSecOps Team for a Global SaaS Company

Client Background

A global B2B SaaS product company was expanding its Product Security and DevSecOps team in India.

The company operated a cloud native SaaS platform serving enterprise customers across multiple geographies. As the product and customer base expanded, the organization wanted to strengthen security across application development, cloud infrastructure, APIs, CI/CD pipelines and the overall software development lifecycle.

The client engaged Prism HRC to hire cybersecurity experts in India and to help build the team across leadership, senior specialist and engineering levels.

 

The Hiring Mandate

The mandate covered multiple cybersecurity capabilities, including:

• Head / Director – Product Security
• Product Security Architects
• Senior Application Security Engineers
• DevSecOps Engineers
• Cloud Security Engineers
• API Security Specialists
• Kubernetes & Container Security Engineers
• Security Automation Engineers
• Vulnerability Management Specialists
• Penetration Testing Professionals
• IAM / Identity Security Engineers

The requirement looked like a cybersecurity hiring project on the surface.

However, availability of cybersecurity professionals was not the primary challenge.

The real challenge was the client’s strong preference for professionals with experience in SaaS and product companies, particularly for senior and leadership positions.

 

The Problem Statement

The cybersecurity talent market in India is reasonably large across IT services, consulting, BFSI, telecom, technology services and other industries.

But the client’s requirement was much narrower.

For senior positions, the company wanted professionals who had already worked in a SaaS or product-led environment and understood how security operates when the product itself is the business.

These professionals needed experience working closely with:

Engineering → Product → DevOps → Cloud → Security

They needed to understand secure product development, rather than approaching cybersecurity only from an infrastructure, operations or compliance perspective.

This significantly reduced the senior-level addressable talent pool.

 

Hiring Difficulty 1: SaaS Experience Was the Real Constraint

Searching for Application Security, Cloud Security or DevSecOps professionals produced a large number of potential candidates.

Adding the requirement of relevant SaaS/product experience dramatically reduced that number.

Many technically capable candidates came from:

• IT services
• Consulting
• Banking and financial services
• Telecom
• Managed security services
• Large enterprise IT environments

For senior positions, however, the client wanted professionals who had already dealt with security challenges within a SaaS/product organization.

This included understanding:

• Secure SDLC
• Product security architecture
• Multi-tenant environments
• API security
• Cloud-native security
• CI/CD security
• Kubernetes and container security
• Security automation
• Vulnerability remediation with engineering teams
• Security considerations during product releases

The hiring challenge therefore became less about “Where do we find cybersecurity professionals?” and more about “Which SaaS companies already employ the kind of professionals our client needs?”

 

Hiring Difficulty 2: Senior Talent Required Competitor Mapping

For leadership and senior positions, conventional sourcing was not sufficient.

Many of the strongest candidates were not actively looking for jobs.

Prism HRC therefore moved from traditional recruitment to a targeted headhunting strategy.

A talent map was created covering competing and adjacent SaaS/product organizations with mature Product Security capabilities.

The mapping focused on identifying:

• Heads of Product Security
• Security Directors
• Product Security Architects
• Senior Application Security professionals
• Senior Cloud Security professionals
• DevSecOps leaders
• Security Engineering Managers

Instead of waiting for candidates to apply, Prism HRC directly approached relevant professionals from identified organizations.

 

Senior Hiring Strategy: Headhunting from Competitors

For leadership and critical senior positions, industry relevance was treated as a priority rather than an optional preference.

The first target pool consisted of professionals working with direct or closely comparable SaaS/product organizations.

Prism HRC mapped:

Target Companies → Relevant Security Functions → Organization Structure → Potential Candidates → Seniority → Product/SaaS Experience

The team then conducted confidential outreach to selected professionals.

The initial conversation was not simply about compensation or whether the candidate was looking for a job.

Senior candidates were engaged around:

• Scope of the role
• Opportunity to build or influence the security function
• Product complexity
• Team structure
• Global exposure
• Leadership responsibility
• Technology environment
• Long-term career opportunity

This was particularly important because several target candidates were passive professionals who were already well-positioned within established product companies.

 

Hiring Difficulty 3: Applying the Same Industry Filter to Junior Roles Wasn’t Practical

While SaaS experience remained highly desirable, Prism HRC and the client recognized that requiring it for every position would unnecessarily restrict the hiring funnel.

A different strategy was therefore adopted for junior and mid-level engineering roles.

Instead of asking:

“Has this candidate already worked for a SaaS company?”

the evaluation focused more heavily on:

“Does this candidate have the technical foundation to succeed in a SaaS security environment?”

This opened a much larger talent pool.

 

Junior & Mid-Level Strategy: Hire for Skills, Not Just Industry

For junior and selected mid level roles, Prism HRC expanded sourcing beyond SaaS companies.

Candidates were considered from:

• IT services
• Consulting
• BFSI
• FinTech
• Telecom
• E-commerce
• Cybersecurity services
• Other technology driven industries

The emphasis shifted toward transferable technical capabilities.

For Application Security positions, candidates were assessed for areas such as:

• OWASP
• SAST / DAST
• Secure coding concepts
• API security
• Vulnerability assessment
• Penetration testing
• Threat modelling

For DevSecOps and Cloud Security positions, the focus included:

• AWS / Azure
• CI/CD
• Docker
• Kubernetes
• Infrastructure as Code
• Security scanning
• Secrets management
• Cloud IAM
• Security automation

Candidates with strong fundamentals could therefore be considered even without previous SaaS employment.

 

A Two Level Recruitment Strategy

This eventually became the core of Prism HRC’s hiring approach.

Senior & Leadership Hiring

Industry-first + Skill-first

For Heads, Directors, Architects and critical senior positions:

SaaS/Product Experience → Relevant Security Experience → Leadership/Architecture Capability

Targeted headhunting and competitor mapping were the primary sourcing methods.

Junior & Mid-Level Hiring

Skill-first + Industry-flexible

For engineering and execution roles:

Technical Capability → Relevant Security Exposure → Ability to Transition into SaaS

Candidates could come from other industries provided their technical experience was transferable.

This significantly increased the available talent pool without compromising the requirements of critical senior positions.

 

Building the Right Team Mix

Rather than attempting to build an entire team exclusively from SaaS companies, the final hiring strategy created a balanced structure.

Leadership Layer

Primarily professionals from SaaS/product environments who understood Product Security strategy and could establish standards for the organization.

Senior Specialist Layer

A combination of SaaS/product professionals and specialists from adjacent digital businesses with strong Application Security, Cloud Security and DevSecOps experience.

Engineering Layer

Technically strong cybersecurity professionals recruited from a broader range of industries.

The senior SaaS professionals provided the product-security context, architecture and direction, while the broader engineering team provided the execution capability.

This made the hiring model both scalable and commercially practical.

 

What Made the Engagement Different

The solution was not simply to increase sourcing activity.

It was to recognize that different levels of the same cybersecurity team required different recruitment strategies.

If SaaS experience had been mandatory for every position, the available talent pool would have been unnecessarily small and hiring timelines would have increased.

At the same time, removing the SaaS requirement completely would have created a leadership team without sufficient product-security context.

Prism HRC therefore used:

Targeted competitor headhunting for leadership and senior roles combined with skill based cross industry hiring for junior and selected mid level roles.

Key Recruitment Insight:

The project highlighted an important lesson in specialized cybersecurity recruitment:

Industry experience matters most where context, architecture and decision making matter most. At the execution level, strong transferable skills can often be more valuable than an exact industry match.