Cybersecurity Executive Search Firms: 10 for CISO and Security Hires

The chief executive of a software company says AGS "delivered exceptional results in our search for a Chief Information Security Officer at Ncontracts", and that the placement exceeded expectations on technical capability and leadership. An information security executive at a private equity firm describes AGS filling "a crucial cyber security role". The testimonials are undated.

AGS presents itself as one group with three specialisms: cyber, technology and executive search. Its cyber search page (opens in a new tab) covers CISO appointments and specialist teams in threat intelligence and cloud security, and sets out a six-stage process from briefing to onboarding. Its executive search page (opens in a new tab) lists the CISO among the C-suite roles it fills for boards, founders and investors.

Hitch reports more than 120 CISO or head of security placements since it began, and more than 150 security leadership placements in total across SaaS, enterprise and AI-native companies. It describes its clients as "high-consequence software-producing companies with rapidly growing public cloud infrastructure", and it calls itself a retained search firm.

Its security leadership searches (opens in a new tab) cover the CISO and CSO, AI security, product security, GRC, incident response, OT governance, fraud and privacy. Its homepage, read in October 2026, reports an 89-day average for its CISO searches without saying which stage that ends at. It also publishes an annual survey of CISO compensation, which can help you test an offer.

Kyle McIntyre, who runs the firm, writes that he and his father, the founder, partnered on more than ten C-level and VP searches for CrowdStrike before its 2019 IPO. Reza Morakabati, founder of Quanta Management, writes about "a CISO search at Commvault" that the role was filled "in short order". Stu Sjouwerman, the founder of KnowBe4, describes "several executive searches at KnowBe4", and John Deskurakis, now a CISO, credits McIntyre with recruiting him into a role at "a Fortune 100 global conglomerate".

The firm says it has worked only in cybersecurity since 2001 and describes itself as a retained search firm for the industry. McIntyre says he handles every search personally, end to end, and that he has placed CISOs as well as VPs and C-level executives. One person running every search is useful when you want a senior recruiter on the work, and worth asking about capacity.

Pinpoint lists security vendors it has worked with, among them Eclypsium, Legit Security, Sonrai Security, Xage Security and SANS. Its testimonials give each executive's name and title but not their company. A co-founder of a cybersecurity startup describes Pinpoint finding a developer who also held a security clearance needed for government clients.

Pinpoint's published focus is go-to-market recruitment for security vendors. Its homepage says it recruits "go-to-market professionals for the cybersecurity vendor community", from executives to senior individual contributors. Its process page (opens in a new tab) describes a shortlist that comes with a match score and compensation details for each candidate. The firm also tracks cybersecurity funding and acquisitions, which it uses to map where candidates work.

Alpha Apex Group's published figures cover the whole firm, not only its security work. It reports more than 2,000 placements worldwide. Its cybersecurity page, read in October 2026, gives a 43-day average time-to-fill for full-time hires without defining the end stage. Its service pages show client logos, including AWS, Siemens and Zendesk, without saying which functions were hired.

The CISO page offers retained and confidential CISO search and an assessment of security leadership candidates on threat management and governance. Its cybersecurity recruitment page (opens in a new tab) also covers specialists in threat intelligence, incident response and information security. The firm says new candidates reach the hiring manager within 72 hours, without stating which searches that applies to.

DSG Global's technology, AI and cybersecurity practice is led by Lavonne Moon, who joined in January 2026. The firm says she has completed more than 3,000 searches at the CISO, CTO and VP Security level over her career, a figure that covers her earlier employers too. The practice page (opens in a new tab), read in October 2026, reports an average close of 76 days, without saying which stage that ends at.

DSG Global, formerly Diversified Search Group, acquired Alta Associates (opens in a new tab) in March 2022. Its announcement says Alta, founded by Joyce Brocaglia in 1986, specialized in cybersecurity, IT risk management and data privacy and "has filled many of the most high-profile Chief Information Security Officer roles", without naming them. Brocaglia now leads the Executive Women's Forum, a membership organization for women in information security, risk and privacy, which the acquisition brought into DSG.

JM Search's cybersecurity page features Barracuda, Coalfire, Netwrix and Sophos as clients. The firm says more than 80% of its clients are private equity firms and their portfolio companies, and it reports a 95% placement retention rate across the firm without stating the period.

Its cybersecurity and risk practice (opens in a new tab) recruits CSOs, CISOs, chief technology risk officers, deputy CISOs and the heads of security operations, engineering, architecture, product security, cloud security, identity and GRC. It works for private equity-backed, private and public companies, and separately recruits executives for cybersecurity businesses. It describes itself as a retained search firm with partners involved in each search.

The figures Korn Ferry publishes describe its wider business: it says it works with 96% of Fortune's top 50 most admired companies, and that its recruiters have on-the-ground experience in 130 countries.

Its cybersecurity practice brings together advisors with backgrounds in information technology, national security and professional services. The work runs from recruiting security leaders to developing internal talent, building cyber awareness among executives and boards, and reshaping structures and rewards to reduce cyber risk. That breadth suits a company whose security problem involves its leadership and culture as well as one hire.

Aruba Exec reports a 99%+ search completion rate and a 98%+ retention rate at three years across the firm; it does not publish security-specific results on the pages read. It also sets out its payment stages and replacement terms. Its FAQ says executive search firms typically charge a retained fee of 25% to 35% of the appointed candidate's first-year base salary. Aruba takes its fee in three stages: at the briefing, at the shortlist and on offer and acceptance. Its CISO search page (opens in a new tab) adds that fees depend on the search's complexity and scope and are quoted at the first consultation. The FAQ also describes a 12-month replacement guarantee: if a placed candidate leaves or is asked to leave in that period, the new search costs only direct research expenses.

Every CISO search is partner-led. The CISO page, read in October 2026, says most searches take 60 to 90 days from kickoff to offer acceptance, with complex requirements taking longer. Its broader executive search page (opens in a new tab) gives four to six weeks to a shortlist and 90 to 120 days from launch to offer acceptance for C-suite searches, and its FAQ gives 8 to 12 weeks through shortlist presentation and offer stage. Ask which scope and milestone apply to your search. Its testimonials give first names and roles, and none describes a security search.

Stone reports more than 1,000 senior appointments across the firm and twenty years as a retained search practice. Lee Hammon, chief commercial officer of Cygnet Healthcare, says the quality of management staff Stone delivered "was exceptional". No security placement is named on the pages read.

The cybersecurity page lists CISOs, heads of information security, security operations, architecture and GRC, and commercial leaders for security vendors, with most assignments "at director and board level". A named consultant leads each search, and each shortlisted candidate comes with a written profile covering technical depth, leadership record and fit. For a CISO hire, Stone says the first stage includes a candid conversation about how much authority and board access the role will carry.