What the firm hires for
The firm runs two practices across eight service lines and delivers them with six disciplines. Hiring goes by discipline rather than by job title, and the discipline decides who reads your application.
- Cloud and infrastructure engineering: platform build and migration across public cloud and the estates that are not being retired, delivered with the run book written, the rollback point fixed and the failover timed before the change window opens.
- Identity and platform operations: replacing standing privileged access with time-bound elevation, evidencing the reviews an auditor will ask to see, and running the estate to the response times in the service level schedule.
- Detection and response analysis: analyst work on a rota inside contracted coverage hours, where a priority one detection is acknowledged and triaged within 15 minutes and containment is taken under standing authority rather than while waiting for approval.
- Incident response and digital forensics: mobilisation for retained clients, evidence handled to a standard that survives an insurer and a court, and the written account afterwards that says what happened and what was done about it.
- Offensive security: testing where findings are ranked by exploitability rather than scanner severity, and every finding is reproduced in front of the client before it is written up.
- Governance, risk and compliance: DORA, NIS2, PCI DSS and audit-readiness work, written for the regulator or the assessor who will read it rather than for a scoring tool.
Everyone employed here delivers. Project and service management sit with the people running the work, so there is no separate management layer to apply to.
Delivery is by our own employees, and nothing is subcontracted. The work described above is work you would do rather than work you would arrange.
This page lists no vacancies. When there is a role it is posted on this page, and the advertisement states the discipline, the terms and the pay before you apply. Speculative applications are read and answered whether or not a role is open.
Experience is weighted above credentials. No degree is required for any role here, and no application is filtered on one.
What the work looks like
Engagements are scoped in writing before they start. Everyone who will do the work is named in the proposal, and the lead who scoped it attends the reviews and signs the report. There is no bench of unnamed people behind that.
The commitments set the pace. An analyst acknowledges a priority one detection and begins triage within 15 minutes. Containment actions listed in the authority matrix agreed at onboarding are taken without waiting for approval and reported to the client's duty contact within 30 minutes. A service report covering every agreed service level is issued on the fifth working day of the following month, with the misses printed beside their causes and the corrective action.
Writing is not the overhead of the job here, it is the deliverable. A client keeps the report long after the change window closes, and it has to hold up in front of an auditor, an insurer or the engineer who inherits the estate. Everyone writes, and everyone's writing is read by someone who will have to defend it.
Methods are tested on the firm's own systems before they reach a client, and the field notes on this site are written out of that work under the name of the practitioner who did it. If a method does not survive contact with a real estate, it does not get sold.
Both practices sit under one contract, so the engineer who built a platform and the analyst who defends it answer to the same client review. Nobody gets to hand a problem across a boundary and call it someone else's.
How the process runs
Four stages, the same for every discipline. The whole process takes about 3 weeks, and at the first stage we tell you who you will meet at each of the others.
- Application review: read by the practice lead for the discipline and by one person who does the work you applied for. No screening software sits in front of them.
- Technical conversation: 60 minutes with two people from the practice, about a system you have run and a decision you made on it. No puzzles, and no whiteboard algorithms.
- Work sample: an exercise taken from real delivery, time-boxed to 2 hours, marked by the people you would work alongside. You keep the brief, and we tell you what we were looking for.
- Practice lead conversation: 45 minutes on the work you would pick up, the terms and your start date. The lead of the practice takes this stage, and it is not delegated.
Pay is quoted as a number at the technical conversation rather than at offer. Nobody is asked to spend 2 hours on a work sample without knowing what the role pays.
A decision follows within 5 working days of the last stage. Everyone who reaches the technical conversation gets written feedback, whichever way it goes.
What we pay attention to
- Work you can describe end to end, including the part that went wrong.
- Writing. Reports are the product here, and we read for whether a stranger could act on what you wrote.
- Reproducibility. If a finding cannot be reproduced in front of the client it does not go in the report, and that habit starts at interview.
- Judgement against a deadline, particularly where the change window is measured in minutes.
- Saying what you do not know, early and without decoration.
- How you would talk to a client at 02:00 holding a partial picture.
People stay technical
There is no route here where promotion means leaving the work. The people who lead the practices carry engagements, attend the reviews and sign the reports they have read line by line. The person who sets a method is the person who uses it on a client site.
The firm pays for qualifications and puts the study time inside the working week rather than on top of it. Credentials here are personal. They are held by the named practitioner, they are verifiable with the body that issued them, and they leave with the person who earned them. The firm holds no corporate certification. SOC 2 Type I is examined on 1 December 2026.
There is no up-or-out. A career here can be spent going deeper into one discipline, and that is treated as a career rather than a plateau.
Screening, and what the firm does not offer
The firm holds no facility clearance and does not sponsor one. Where a client's contract sets a screening standard, the firm runs those checks before the person joins that engagement, and the proposal for the engagement says which checks were completed for each named person.
Before you start, the firm completes:
- Confirmation of your right to work where you will be employed.
- Employment and education references covering the previous 3 years.
- A criminal record check where the law of that country provides for one.
- Any further check a specific client contract requires, named in advance rather than sprung on you.
- For incident response roles, confirmation that you can join the on-call rota.
How you would be employed
Everyone who does the work here is an employee of the firm. There is no associate panel and no contractor arrangement sitting behind the delivery, which is why the terms are worth settling early.
Whether the firm can employ you where you live depends on it having a lawful way to pay and tax you there, and that is worth knowing before you spend an evening on an application. Write to enquiries@eigenvector.group with the discipline you work in and the country you live in, and you will have a straight answer within one working day. A no of that kind is about the paperwork, not about you.
Two things about the working pattern are said in advance rather than at offer. Analysts work to a rota, because coverage hours are set in each client's service level schedule and an on-call responder sits outside them. Consultants travel to client sites, and in the regulated sectors some of that work cannot leave the client's building.
How to apply
Applications go to enquiries@eigenvector.group, with the discipline in the subject line. There is no portal and no form to fill in.
Include:
- The discipline you are applying in, and the country you live in.
- A short account of one piece of work you did, what it cost, and what you would do differently.
- Your notice period and the earliest date you could start.
- A curriculum vitae if you have one to hand. It is read after the account of the work, not before.
Every application is acknowledged within one working day and reaches the lead for that discipline.
If you need an adjustment at any stage, say so in the application or in a separate message to the same address. Tell us what would help: the format of the exercise, the timing of a conversation, or the software it runs in. The request goes to the person arranging that stage and is not recorded against the application.