[jiffyjeff]

Terrific post, thanks! I am somewhat familiar with this hiring process thanks to tptacek's HN contributions (which incidentally led me to recommending a friend to Matasano). I would like to have a better feel for the context of the hiring problems involved here. I am wondering if the company's particular niche makes the hiring process unusually difficult. Or perhaps the company is in a growth phase with a corresponding shortage of employees? With such low turnover rates, how many additional employees are needed? Is it possible that the company is in a position to profitably hire every qualified applicant it receives? If so, the company is essentially losing money on every hire it doesn't make. In addition to a radically improved hiring process, what about offering remote work and/or extremely high starting salaries? Well-advertised high salaries and location flexibility might allow the company to out-compete many alternatives (e.g., Google, FB, Bootstrapped startups).

[elptacek]

When I was at Matasano, there was always enough inbound work (sometimes more than enough) to keep the consultants utilized. So yes, a company with a full pipeline will lose money on every qualified hire it doesn't make. Perhaps this is not the case for other industries, but for infosec consulting, there seems to be more work than there are qualified workers. Matasano ran under its own steam and did not take funding. Offering extremely high starting salaries would have killed it in its early years. It was more cost effective to create a process for finding people who could actually do the work rather than rely on the 4-page CV candidates. The expensive ones.

The net result was a win-win: you get bargain candidates and they get 4-page CVs.

[eru]

Did the salaries of the bargain candidates creep up as their value was realized?

[jerematasno]

My policy (I'm co-in-charge of recruiting at Matasano/NCC, and a lot of folks report to me) is this:

1) Hire based on current ability, not potential. Hiring based on potential is a minefield that our whole process is designed to avoid. ("Enthusiasm," "cultural fit," talking a good game without being able to walk the walk, etc.)

2) Be aggressively fair in giving out promotions and raises. Keeping someone's salary low because they're bad at asking for raises is not a good long-term strategy, especially in consulting.

Seems to be working out.

[eru]

Thanks for the answer!

> Keeping someone's salary low because they're bad at asking for raises is not a good long-term strategy, especially in consulting.

Yes, in consulting the distance between money made and each individual employee's efforts seems shorter than in a big tech company. So keeping salaries in line with impact of contributions should be easier.

[elptacek]

I do not know. I suppose even if I did, it's one of those things nobody is supposed to discuss. I overheard talk here and there about raises, but since it didn't pertain to me, I ignored it.