Direct-hire search for security leadership, engineering, architecture and GRC roles at financial services, insurance, healthcare and technology companies in the city. Contingency fees. A 90-day guarantee. Senior-led from the first call to the start date.
a fee only when someone we introduced starts.
guarantee on every placement, replacement first.
Monday to Friday, 8am to 5pm Eastern, +1 (646) 598-1050.
Organisations we have supported
CISOs, Deputy CISOs, Heads of Security, Directors of Security Engineering and Security Operations.
Security Engineers, Cloud Security, Application Security, DevSecOps, Identity and Access Management.
Security Architects across enterprise, cloud and solution, Zero Trust and platform security.
SOC leads and analysts, Detection Engineering, Threat Intelligence and Incident Response.
GRC leads, Security Risk Managers, Third-Party Risk, NYDFS Part 500 and SEC disclosure readiness.
Penetration Testers, Red Team, Vulnerability Management and Product Security.
Sectors we work in: Financial services and fintech, Insurance, Healthcare and life sciences, Legal and professional services, Media and technology, Managed security providers.
The New York market
Two regulators put named executives on the hook for cyber security in this city, and the people who can carry that responsibility are in short supply. Every figure below is sourced.
Every DFS-regulated bank, insurer and financial firm in New York must now run multi-factor authentication for all users and keep a full asset inventory. Class A companies also need independent audits, privileged access management and endpoint detection.
In force since 1 November 2025
Source: Hogan Lovells on the amended Part 500Each year by 15 April, DFS-regulated firms file a certification of material compliance or an acknowledgment of non-compliance, signed by both the chief executive and the CISO. Since the 2023 amendment that signature is personal.
Every year; next filing 15 April 2027
Source: Cooley, NYDFS annual certificationsSince 18 December 2023 a public company must file a Form 8-K within four business days of deciding a cyber incident is material, and describe its cyber governance every year in the 10-K.
In force since 18 December 2023
Source: SEC fact sheet, public company cybersecurity disclosuresEmployers posted 514,359 cyber security roles in twelve months, 57,000 more than the year before, and could fill only about three in four of them. New York is one of the largest hiring hubs.
CyberSeek release of June 2025, the latest published
Source: NIST, CyberSeek updateThe Bureau of Labor Statistics projects information security analyst employment to grow 21 percent over the decade, against 3 percent for all occupations, with about 14,100 openings a year. The national median salary was $129,180 in May 2025.
2025 to 2035 projections; wage as of May 2025
Source: US Bureau of Labor Statistics, Occupational Outlook HandbookWall Street employed 198,200 people in 2025, near a thirty-year high, and made $65.1 billion in profit. It is the deepest pool of security budgets and security hiring in the city.
2025 figures, published March 2026
Source: Office of the New York State Comptroller, March 2026Figures last reviewed 8 September 2026. Each card shows the period its number refers to.
You pay a fee only when someone we introduced starts. No retainer, no exclusivity.
A single percentage of first-year base salary, agreed in writing before we send a single resume, invoiced on the start date.
If the hire leaves inside 90 days, we run the search again at no fee. If we cannot refill the role, part of the fee comes back on a published scale.
Every candidate is interviewed by us, referenced on request, and presented against your requirements, not a keyword match.
Every role we advertise for you carries the salary range New York requires, and we never ask a candidate their pay history.
You deal with the people who run the business, in your working day. No handoffs to a junior desk.
Real conversations. No corporate answers.
Our podcast, where security leaders talk about the work as it actually is. CISOs, security architects and SOC analysts sit alongside founders, CEOs and CTOs, on what is really happening in their organizations and what it means for anyone building and running technology. New episodes weekly.
It is also how we stay close to this market. If you lead security in New York and have something to say about cyber or AI, we would like to hear it: cyberheard@invitise.com.
23 Oct 2026 · 21 min
Adam McElroy, Chief Technology Officer at Eclypses
A CTO working on post-quantum encryption explains why harvest now decrypt later is already a live threat, how crypto agility can be achieved without rebuilding systems from scratch, and what years in identity and bank risk oversight taught him about boards, zero trust and AI-generated code.
Episode notes21 Oct 2026 · 31 min
Clement P'ng, IT Manager at BW: Workplace Experts
An IT manager explains why in-house support teams get starved of budget and attention, the real difference between outsourced and in-house service desks, and what day-to-day identity management, vendor reviews and compliance certifications actually look like on the ground.
Episode notes20 Oct 2026 · 25 min
Mark Logalbo, VP Information Security at Fanatics
A GRC leader at a fast-growing, multi-sector group explains how to set a baseline controls programme that subsidiaries can layer on top of, why cutting third-party review times means questioning what you actually ask vendors, and why he resists dressing up risk figures with more precision than they deserve.
Episode notesSecurity talent moves between London and New York constantly, and the people who lead security functions in the city's banks, insurers and healthcare groups are drawn from both. We have spent two decades placing them in the UK's financial services, technology and public sector organizations. New York is the same conversation, in a different time zone.
We are ISO 9001 certified and Cyber Essentials certified, we hold Recruitment and Employment Confederation membership, and we run the Cyber Heard podcast, where security leaders on both sides of the Atlantic talk about the work as it actually is.
Tell us the role, the team it reports into and the compensation range you have in mind. We will come back inside your working day with a straight read on the market and how we would run the search.
Straight answers on who we are, what it costs, and how a search runs from first call to start date.
We are a UK company, Invitise Ltd, operating in New York as an employer fee paid agency. Clients contract with us under a New York law agreement, are invoiced in US dollars, and receive our W-8BEN-E and certificate of insurance on request. We never charge a candidate a fee.
The desk runs on Eastern time. Calls, interviews and offers happen inside your day, and you have a direct line to the people running your search.
A percentage of first-year base salary, agreed before we start. On a contingency search it is payable only on a hire, and there is no charge for a search that does not lead to one. Specialist cyber security roles in New York sit between 25 and 30 percent.
Contingency by default: no fee unless you hire someone we introduced. For a confidential search or a senior leadership hire we can work on a retained basis with a small engagement fee credited against the placement fee. Either way you get the same people running it.
No. In the United States we do direct-hire search only. Our contract and project work is UK-based.
We work from a network of security professionals we already know, in the UK and the US. A brief taken on Monday usually has a shortlist by the end of the week, and we tell you honestly when a role will take longer.
Yes, where the person already holds an active US clearance. A US clearance is granted to US citizens and sponsored by the employer that holds the facility clearance, so we cannot obtain one for a candidate, and the employer verifies it. Placing cleared professionals into defense, aerospace and federal contractor roles works the same way as SC and DV roles do for us in the UK.
_1778603447189-DGEkYDPq.png)