Legal & General

Legal & General is a UK-based financial services company offering a wide range of insurance, pensions, and investment products, committed to delivering long-term value for customers and shareholders.

The Challenge

Against a backdrop of multiple high-profile cyber security incidents across the insurance sector, Legal & General was looking to strengthen its defensive capability and reduce exposure to future attacks. A key part of this strategy was expanding its in-house penetration testing function.

The roles were based on the South Coast of England and required four days per week onsite. While CREST-certified penetration testers do exist in the market, attracting them to a predominantly on-site role outside London proved challenging. Initial searches confirmed that location and flexibility, rather than certification alone, were the primary barriers to hiring.

The Solution

Following an initial search and market feedback, we advised Legal & General to reconsider the structure of the roles. Rather than continuing with permanent hires, we proposed a contract-based model that would offer greater flexibility and appeal to experienced testers already operating in consultancy environments.

By positioning the roles on competitive day rates, we were able to engage London-based penetration testers who were open to contracting for the first time. Importantly, the client was aligned on prioritising the right experience over speed, meaning longer notice periods of four to eight weeks were not a blocker.

We targeted penetration testers within larger consultancy firms who were accustomed to project-based delivery and client-site work, and ran a focused headhunting campaign aligned to this profile.

The Results

• 3 Placements Made
• 21 days average time to offer

We successfully secured a Lead Penetration Tester and through the relationship built during the process, the they referred a Senior Penetration Tester, who was also placed successfully. A Mid-Level Penetration Tester was hired from a consultancy background, keen to transition into contract work and relocate to the South Coast during the week.

Legal & General ultimately built a new, purpose-designed penetration testing team, strengthening their cyber defence capability at a critical time for the organisation.