What lands in a security engineer's inbox
Security engineers read cold messages in the same place they handle alerts, vendor questionnaires, incident threads, code review comments, and recruiter notes. Their attention is split, and their training makes them suspicious of vague urgency, unexpected attachments, and messages that look like a phishing test. A note that is short, specific, and easy to verify has less to prove.
The work also shapes what they consider a useful ask. A security engineer may be responsible for a control, a review process, or a system, but not for buying your product or hiring you. If you want a conversation, say what decision you are facing and why their experience with that decision matters. Do not ask them to educate you on the whole field.
Finally, be careful with channel. Email is better when you have a work address and a specific public artifact to reference. LinkedIn is better when the person is active there or when you share a group or event context. A paid message is better when you have a narrow question and can put a clear value on their time. Pick one channel and write it properly rather than copying the same note everywhere.
Before you write
Before you write, find one concrete reason it is them. That could be a conference talk, a public write-up, an open-source contribution, a team page that names their area, or a comment in a professional community. The reason should connect to your question, not just flatter them. If you cannot name the connection in one sentence, you are not ready to send.
Then define the ask. A useful cold message asks for one of three things: a short piece of feedback, a brief informational conversation, or a candidate conversation if you are recruiting. Write the ask as a sentence you could put on a calendar. “Could we talk about security?” is not an ask. “Would you answer two questions by email about how you scope third-party reviews?” is.
Know the time cost. The U.S. Bureau of Labor Statistics lists Information Security Analysts, the occupation that covers much security engineering work, at a median annual pay of $129,180 as of May 2025. That is $62.11 an hour at median, so 15 minutes is $15.53 of their time and 30 minutes is $31.06. If you ask for a call, name the length. If you ask for a written reply, say how many questions.
What to say in the first message
Your first message should do four things: show why them, state your context, ask one to three direct questions, and name the time involved. Boomerang's analysis of more than 40 million emails found that messages of 50 to 125 words got the most replies, that one to three direct questions did better than none, and that plain, simple writing did better than formal, college-level prose. Use that as a shape, not a formula.
Open with the specific reason. “I saw your talk on [topic]” is weak if it stops there. “In your talk on [topic], you described how you handle [specific situation]. I am deciding whether to do [A] or [B] at [your company]” gives them a reason to keep reading. Then ask your questions. Make them answerable without a meeting: “How do you scope [X]?” and “What would you check first in [Y]?” are better than “What are the best practices for security?”
Close with a small, concrete time ask. “Would a 15-minute call next Tuesday or Thursday work?” fits. “Let me know when you are free” does not. Offer a written reply as an alternative if that is easier for them. Avoid attachments, link shorteners, and urgent language. A security engineer may treat those as risk signals before they read your ask.
How to follow up
Follow up once, about five to seven business days later, in the same thread. Keep it shorter than the first message. Add one useful detail: a document, a specific constraint, or a revised question. Do not repeat the whole pitch. The follow-up should make it easier to answer, not harder to ignore.
A good follow-up says what you are still trying to decide and asks whether the time you proposed still works. If you asked for a call, offer one new time. If you asked for a written reply, reduce the question to one. If they reply with a no, thank them and stop. If they ask you to send questions in writing, do that in the next message and keep it under five questions.
After one follow-up with no reply, stop. Do not send a third message, do not move to another channel to ask the same thing, and do not ask a mutual connection to pressure them. You can try a different person with a different reason later. A clean stop protects your reputation and leaves room for a future contact when you have a real reason.
When a paid message makes sense
A paid message makes sense when you want a considered answer from a specific person and you can state a narrow question. It does not fix a vague ask or a weak reason. Use it for a short call, a review, or a written reply that takes real thought. Do not use it to ask someone to do free work through a back door.
On Introworth, members set a price for messages from people they do not know. The sender's card is held, not charged, and payment is captured only if the recipient replies within the reply window; if they do not, the hold is released. The recipient keeps 85% of the price, and Introworth's commission is 15%. The lowest price is $15. Suggested prices for a security engineer at median pay are $15 for a quick five-minute question, $20 for a considered 15-minute reply, $40 for a 30-minute review or short call, and $75 for an hour of advice. At median pay, 15 minutes is $15.53 of their time, so $20 is a small premium over the raw cost of that time.
Use the same discipline as a cold email: one reason, one ask, one to three questions, and a stated time. Before you pay, Introworth's message coach checks the draft privately for length, questions, why them, the time asked for, and plain wording. If you have a mutual connection on Introworth, you can ask that connection to forward a note; the connection can decline, and the person can accept a free conversation or pass. The payment is tied to a reply, not to agreement. If they reply no, that is still a reply.
Pay figures come from the U.S. Bureau of Labor Statistics and are computed by Introworth's price calculator. The guide text is drafted with AI from those figures and Introworth's product rules, and checked automatically before it is published. It is general guidance, not legal, tax or financial advice.