Software security. We take products that 4-8 person dev teams spend 9-18 months building, and, in 2-3 weeks with 2-3 people, essentially compete with those teams to find clever vulnerabilities they left in their code. Particularly on non-web projects, this often involves reverse-engineering from binary and quickly tooling up for bizarro undocumented proprietary protocols and APIs. If you're a startup, you hire for Rails, or low-level C database stuff, or iOS, or distributed systems. For us, switch those or's to and's.

Security audits and the like. tptacek is the founder of http://www.matasano.com/

I know the company and I know about tptacek from HN, even a friend worked there a few years ago. I just wanted to understand if they were in some new specialized niche.

Sure. I'm just explaining how someone could conclude that hiring for a software security team is actually harder than hiring for a typical startup; the skills requirements are close to a superset.

Could it be that the specialization you are working with ends up actually be a benefit with regards to finding new hires?

From my perspective, I'm probably not going to go out of my way to apply to a typical startup unless there is some reason to believe the renumeration is remarkable. However, I might be interested in applying to a company like yours as a challenge to myself.

That happens. For example, to be a low level 3d engine programmer is a quite specific skill, yet because of the nature of the games industry, such people don't get paid as much as your average full stack web developer.

Yes, I used to work in the security field and almost every project was an adventure, a challenge where you also need to learn at the speed of light.