Home Industries Retail & e-commerce
RETAIL & E-COMMERCE
Cyber security recruitment for retail and e-commerce
Retail security is judged against trading. Nothing goes live in peak season, everything is measured against conversion, and the security team is small relative to the estate it covers. The hires that work here are pragmatic by temperament, not by compromise.
What these teams hire
- APPLICATION SECURITY
- Secure SDLC, threat modelling and design review for storefront, app and checkout engineering teams.
- PCI DSS & PAYMENTS
- Scope reduction, control evidence and the assessor relationship — a specific and well-paid GRC specialism.
- CLOUD SECURITY
- Cloud and platform security engineers supporting fast-moving e-commerce infrastructure.
- FRAUD & ABUSE
- Account takeover, bot mitigation, promotion abuse and the commercial trade-offs each one carries.
- SECURITY OPERATIONS
- Lean in-house detection and response, frequently paired with an outsourced SOC.
- IDENTITY & CIAM
- Customer identity, where security, conversion and consent meet.
What is different about hiring here
Retail security candidates have to be comfortable saying yes with conditions. A control that costs checkout conversion will be overruled, so the useful candidate arrives with a proportionate alternative rather than a policy. We probe for that directly by asking about a control they had to compromise on and what they put in its place.
Change freezes shape the calendar. Black Friday and the festive trading period lock the estate for weeks, which compresses delivery into the rest of the year and makes hiring timing matter. We plan searches around it where clients tell us early.
The market, honestly
South African retail groups have built real security capability over the last few years, mostly concentrated in Cape Town and Johannesburg, and they compete for the same cloud and application security engineers as fintech. Retail rarely wins on package, so flexibility and interesting engineering are the arguments that land.
In the UK, PCI DSS and payments specialists are steadily in demand and the pool is genuinely small. Application security is the harder search: strong AppSec engineers are courted by product companies with better equity and fewer change freezes.
If the security team is three people covering stores, warehouse, app and cloud, say so. Candidates who want that breadth exist and the ones who do not will screen themselves out early.
Where we recruit
Cape Town and Johannesburg across South Africa, and London and the wider United Kingdom.
Common questions
Do you recruit PCI DSS specialists?
Yes. Scope reduction, evidence and assessor management is a distinct skill set and one of the scarcer GRC specialisms in both markets.
Can you find application security engineers for retail platforms?
Yes, though it is the most competitive role in this sector. We are realistic about what the package needs to look like against product-company offers.
Do you recruit for physical and loss prevention security?
No. We focus on cyber and information security. Loss prevention and physical security are a different market with different networks and we would not do a good job of it.
How do trading freezes affect hiring timelines?
They usually compress delivery rather than hiring, but notice periods running into a freeze can delay a start meaningfully. Telling us early lets us plan the search backwards from the date you need.
Explore further
Talk to us about your search
A short conversation is usually enough to tell you whether we can help.