Member-only story
What it Means To Build A Cybersecurity Team
Does a Security Team even need to be Built?
Recently I was talking to a person who spends a lot of time helping organizations find security leaders, about the changing purpose of the security leader, and they had a hypothesis I thought was interesting.
They suggested that companies don’t want a CISO who can build a security program anymore. Instead, they suggested that companies want security leaders who can operate and optimize a security function.
As someone who has been a security leader for the last couple of decades, I found this perspective to be quite odd. Most CISOs I knew were doggedly creating a security function from scratch. This meant that one definition of a successful CISO was someone who grew the security team, adding new security functions, growing the security budget, increasing the number of tools and vendors, and generally expanding the scope and influence of their role. Even better if the leader of the team could report higher up the organizational ladder, preferably directly to the CEO. Most CISOs who have been in the industry for any length of time have the word “builder” prominently on their resume.
So my first reaction to this new hypothesis was skepticism. Maybe it has some merit for CISOs of Fortune 500 companies who are arguably running…
