What should a practical job description say?

Write the outcomes first. For example: maintain an accurate coverage map, own remediation coordination, keep escalation contacts current, and produce evidence for the agreed control set. Then state the systems involved, decision authority, work schedule and support available.

Avoid combining a CISO, penetration tester, detection engineer, auditor and 24-hour responder into one ordinary analyst role. If the job includes on-call duties, describe frequency, compensation and backup honestly. Ask HR to validate location-specific requirements and pay disclosure.

Use a work sample appropriate to the role: explain a sanitized incident timeline, prioritize a remediation queue, or assess an evidence packet. Do not require candidates to perform live unauthorized testing or unpaid production work.