Question 1

What security certifications are valued at hyper-growth tech companies?

Accepted Answer

The most valued certifications at hyper-growth companies are OSCP (Offensive Security Certified Professional) for penetration testing roles, CISSP for senior security leadership, and AWS/GCP/Azure security specialisations for cloud security roles. CEH and CompTIA Security+ are recognised but considered entry-level by most scale-ups. For AppSec roles, practical experience with OWASP Top 10 and secure code review is typically weighted more heavily than certifications.

Question 2

What does a security engineer do at a Series B or C company?

Accepted Answer

At a Series B or C company, a security engineer typically has broad scope — they may be the first or second security hire, responsible for everything from securing the CI/CD pipeline and cloud infrastructure to conducting internal penetration tests, managing vulnerability disclosure, and building the security awareness programme. This is a high-autonomy role that suits engineers who want to build a security function from the ground up rather than operate within an established programme.

Question 3

How important is SOC 2 compliance experience for security roles at hyper-growth companies?

Accepted Answer

SOC 2 compliance experience is highly valued at B2B SaaS companies, where enterprise customers require it as a condition of purchase. Many Series B and C companies are either pursuing their first SOC 2 Type II certification or maintaining an existing one. Security engineers who have led or contributed to a SOC 2 audit — including control design, evidence collection, and auditor liaison — have a significant advantage for roles at B2B-focused hyper-growth companies.