Cyber Security outside IR35 jobs
An outside IR35 Cyber Security job is a contract the client says sits beyond the off-payroll rules, so you can invoice through your own limited company. The work itself is still the security function as a whole, from the SOC to the policies the board has to sign. The status is a tax determination, not a description of the skill.
Updated 1 November 20264 min read
What outside IR35 means on a Cyber Security contract
Outside IR35 means the engagement is treated as a business-to-business supply of Cyber Security, not as employment in all but name. You invoice your company rate. You do not have the client's holiday, pension or employment rights, and you carry the admin of a limited company. That trade is why contractors filter for outside roles first.
The client, or the agency where the client is a small company, makes the determination and should be able to show it. A sentence in an advert is a signal. It is not the status determination statement. How IR35 status is decided walks through what you can ask for.
How often Cyber Security roles are outside
Cyber Security contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
Regulated firms, government, and any board that has just had a finding it cannot leave until next year do not share one policy. Two Cyber Security adverts in the same week can land on opposite sides because the working practices differ, or because one client blankets a programme and the other does not. Filter the claim, then confirm it.
What to check before you accept
Look at substitution, control and whether you are part and parcel of the organisation. A Cyber Security contractor who is told the hours, the method and the laptop, and who cannot send someone else, is harder to defend as outside even if the advert says it. The inside and outside IR35 guide is the short version of that difference.
Price the rate on both sides with the IR35 calculator. A move from outside to inside halfway through a renewal is a pay cut unless the day rate moves with it. Cyber Security day rates has the band clients are advertising.
Where to find them
Outside IR35 jobs is every live contract on the board that states outside, across every skill. Cyber Security contract jobs is the wider market, including inside and unstated roles. The apply link on each job is for members, so the original advert is not sitting open on the public page.
Geography follows the rest of the Cyber Security market: London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. Remote outside IR35 roles exist and are competed for harder than a hybrid seat in one city.
Live roles on the board
These Cyber Security contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- PENETRATION TESTER - SC cleared - Fully Remote £700 a day - CTL — Remote , UK, £650-£700/day Outside
- PENETRATION TESTER - SC cleared - Fully Remote £700 a day - CTL — United Kingdom, £650-£700/day Outside
- URGENT REQUIREMENT - REMOTE - PENETRATION TESTER - CTL — Remote , UK, £650-£700/day Outside
- Cyber Data Engineer — Manchester (M1), M1, £600-£700/day Outside
- CTL/CTM Penetration Tester — United Kingdom, £785/day Outside
See live Cyber Security contracts · Membership unlocks apply links and the first 48 hours