Why does a security engineer seat stay open at an MSP?

The security engineer seat at an MSP usually stays open for a plain reason: the ticket queue always has a louder claim on the budget. That’s how Dokimo Talent, a Koine Cyber company that places remote staff, describes it, and the rest of its approach follows from that. A remote engineer changes who you can hire and how that person is tested before you meet them. It doesn’t promise a faster search, and Dokimo says so itself.

What goes wrong when nobody owns the security stack?

Dokimo describes the pattern like this. The EDR agent is missing on a few endpoints at one client, and an old policy exception is still sitting at another. The MFA rollout finished for the easy tenants. The vulnerability scan runs and nobody works the report. The hardening baseline lives in a document that new clients never get. Your senior engineers know all of it, and escalations pull them off it every day.

According to Dokimo, the seat that fixes this is expensive to fill locally, and it gets deferred because tickets always feel more urgent. Deferring it costs an MSP twice. The security offering ends up inconsistent from one client tenant to the next, and a vCIO can’t promise a client a remediation plan without knowing someone has the hours to deliver it.

What does a remote security engineer actually own?

The seat is defined by work you can name:

• EDR and MDR tooling. Deployment, policy tuning, and coverage checks across client tenants.
• Identity and access. MFA rollouts, Conditional Access policy, privileged access, and offboarding clean-up.
• Vulnerability management. Scans, prioritization, and tracking fixes through your PSA.
• Hardening baselines. Along with security assessments and the remediation projects that follow them.

The security side of client onboarding is a natural fit. When a new client cuts over, the engineer deploys agents, applies your baseline, checks the tenant against it, and records the result in whatever documentation platform you run. The work comes from your PSA projects and service boards, and changes go through your own review process.

How do you find out whether a candidate can do the work?

Dokimo tests every candidate on the real work before you meet them. For a security engineering seat that means a live piece of your kind of work: an EDR policy with gaps in it, a set of Conditional Access rules to review, a scan report to prioritize, or a baseline to pick apart. Talking well about detection or hardening doesn’t get anyone through.

What matters is what the candidate flags, what they’d change first, what they’d leave alone on purpose, and how they write the change request. A good change note says what’s changing, why, and how to back it out. Your review process and your client notes both depend on clear writing, and an engineer who can’t explain a change slows down every review it goes through.

Dokimo doesn’t assume a candidate already knows your EDR, your identity setup, or your scanner. What you get is a short list of people who have already shown they can do the work. By Dokimo’s own rule, if it sends you six resumes, it’s because six people passed testing.

How does the seat work day to day?

The hours decide which country the engineer is recruited in. Dokimo recruits in the Philippines and in Mexico. A Philippine workday falls in the US evening and overnight, and a Mexico City workday lines up with most of the US business day. The hours are agreed with you seat by seat.

The engineer works in your tools and under your managers, and is employed in their own country through Dokimo’s employer-of-record partner, which runs payroll there. You get one monthly invoice from Dokimo, month to month, with no long-term contract. For Tier 3 technical seats you can later hire the person directly, through contract-to-hire or direct placement. Dokimo asks you to raise that up front so it can be planned from the start.

Access runs through your own tools: named accounts, MFA, vaulted credentials, session logging, and access you can revoke the day the engagement ends. A security engineer holds privileged access to client tenants, so Dokimo also offers an optional secure remote workstation, a US-hosted virtual desktop priced separately. Running the seat on a device or VDI you manage works too.

What stays with your own people?

Client-facing advice, and anything with a signature on it. The engineer prepares findings, drafts remediation plans, and does the work. Someone at your MSP reviews whatever goes to a client and puts a name on it, so a security assessment or an attestation shouldn’t go out under the engineer’s name.

Physical work stays local as well: swapping a firewall, cabling a rack, anything that needs hands in a building. A one-off deliverable such as a penetration test is consultancy work, and Dokimo doesn’t sell one.

Which clients can’t have a remote engineer on them?

Some environments are closed. Dokimo won’t place anyone on a client environment that holds export-controlled defense data, or on a criminal justice system. If you serve a client like that, the work stays with US staff.

Almost everything else is a contract or insurance term, and those vary. A managed services agreement can limit who you may subcontract to, a client’s security review can ask where your staff sit, and a health-data agreement can pass its terms down to anyone who touches the environment. HIPAA alone doesn’t bar work from outside the US, but a client’s agreement with you may go further. Dokimo doesn’t decide which of your clients a remote engineer can touch. You and your counsel do, and Dokimo fits the seat to your answer.

Check one practical thing early: whether a client’s own Conditional Access policies block sign-ins from outside the US, because that will lock the engineer out. Dokimo suggests starting a new seat on client environments you’ve already cleared, and deciding which consoles need a US-side approver for changes. None of this is legal advice.

Will a remote seat fill faster?

Dokimo doesn’t claim it will. Asked how fast it can present candidates, its own answer is that it’s slower than a firm that forwards resumes, and that this is deliberate. It won’t quote a time to shortlist, because that depends on the role and the level. A seat also takes time to recruit and ramp, which makes it the wrong tool for covering a short spike.

What a remote seat does change is the pool and the evaluation. The pool is two countries, chosen by the hours the seat needs, which helps with the hard seats that are tough to fill within driving distance. The evaluation happens before you meet anyone, so your interview time goes to confirming a short list instead of filtering a stack.

Where should you start?

Write down what the seat owns: the work, the tools, and the hours. That’s what Dokimo asks for when you contact it, and it replies with questions and next steps rather than a pitch deck. Be ready to say which clients the seat can touch and which stay US-only, because that answer shapes everything else. The details for this seat are on Dokimo’s own page for security engineers.

Koine Cyber doesn’t place anyone itself. Dokimo Talent is a separate company in the group, and an engagement is contracted with Dokimo, not with Koine. If you’d rather buy security as a service than staff a seat, the managed IT and cybersecurity companies in the group work that way, and you can read about them on the Managed IT and Cybersecurity Services page. Either way, tell us what you’re trying to accomplish and we’ll route you to the right company.

← Back to the blog