Security Team Design

Who you need, in which order, reporting to whom: roles, managers, budget and KPIs for a security team that fits your company.

The team in 18 months

Who reports to whom, and the order you hire in. Until a team exists, its work is bought as a service.

1
AppSec, first hire
Most of the risk is in the code, so the first person works with developers.
2
SOC, a service, then a lead
Detection bought for 12 months, then a SOC lead.
3
Offensive, a service until volume
Pentests bought per release until there's enough work for a team.
4
CTI, inside SOC at first
One person watching the stack, routed to the other teams.

Pick a step, or let it play. Every line is what someone in the room actually says.

What security work exists, who does it now, what's missing.

ATALAIAHere is every security task you have today, and who does it.

CISOFive of them are nobody. Detection is one.

Leaves the roomWork map: 14 tasks, 5 unowned

Offensive, SOC, AppSec, CTI, managers and the CISO.

ATALAIAAppSec, SOC, offensive and CTI. Managers own budget; the CISO owns policy and risk.

CTOThat's a lot of people for our size.

Leaves the roomTeams: AppSec, SOC, Offensive, CTI

Which role first, and what to buy as a service meanwhile.

ATALAIANot all at once. AppSec first, because most of your risk is in the code.

CISOAnd detection until we hire?

ATALAIAA service for twelve months, then a SOC lead.

Leaves the roomHire order: AppSec first

KPIs and budget lines per team.

MANAGERBudget: people first, then services, tools last.

ATALAIAAnd one KPI page per team, so the CISO sees all of it.

Leaves the roomKPIs per team, budget split

“That's a lot of people for our size.”
CTO · step 2, Draw the teams

Security teams are often hired by job title, not by need. Then roles overlap, gaps stay open, and the budget goes to tools nobody runs.

Typical shape: Two to four weeks.

Every station reports to the same tower. These are the neighbours.

From a team of one to a working program

A lead, part-time, until you hire one

Policies, audits, risk assessment

A 30-minute call. No slides, no price list, and a next step either way.