Hello. Landing a white-collar job is getting so tough that candidates—not companies—are paying recruiters to match them with positions.

A tech professional in California recently signed on with a reverse recruiter, paying the company 20% of his first month's salary once he landed a role, WSJ reports.

I'm curious if any job hunters in the cybersecurity field have gone this route? How tough is it these days to nab a new job in cyber? Email me about your experience. Thanks! 

Also today: 

• Inside Singapore's response to suspected Chinese hackers
• Coupang whistleblowers wanted
• U.S. chips away at cyber problems in water sector

• The response effort and investigation, over 11 months, included nights and weekends and took a mental toll on those involved. (Channel News Asia)

Six-day outage: Rhode Island workers' compensation insurer Beacon Mutual is investigating a Jan. 14 cyberattack that prompted the company to shut down key services for six days. Beacon Mutual said it will notify people of any breached data when it has more details. (Insurance Business)

Water triage: The Environmental Protection Agency said it worked with 277 U.S. water facilities to identify security holes and improve defenses in 2025. The agency said it helped remove 350 vulnerabilities last year. The more than 50,000 local water plants and providers across the U.S. are often understaffed and run old technology.

• In August, the Trump administration established a $9 million grant program for water facilities to use for cybersecurity. 

Whistleblowers wanted: A law firm considering filing a securities class-action suit against online retailer Coupang over a data breach last year is encouraging knowledgeable insiders to come forward. "Persons with non-public information regarding Coupang should consider their options to help in the investigation or take advantage of the SEC Whistleblower program," Hagens Berman Sobol Shapiro said. 

• The U.S. Securities and Exchange Commission offers whistleblowers a payment of up to 30% of the sum it recovers in a case. 
• Seattle-based Coupang, which is South Korea's largest e-commerce company, in December disclosed a data breach affecting 33 million customers—almost every adult in the country. The incident went undetected for months. 

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.