How would a random hiring manager know who to hire? There are surely people out there who know security, but how does someone who doesn’t know security choose

How would a random hiring manager know who to hire? There are surely people out there who know security, but how does someone who doesn’t know security choose the right people to hire? The very software that was the vector of this attack is produced by a company claiming to improve security.