Building and Leading High-Performing Security Teams:

A Practitioner's Playbook

Author

Anshu Gupta

https://www.linkedin.com/in/fromanshu/

​

​

Anshu Gupta, CISM, CISA, CIPP

• Anshu Gupta is a senior level security practitioner who has Fortune 500 security consulting experience at Ernst & Young and KPMG where he worked at companies like Microsoft, Salesforce, Oracle, Cisco, Yahoo, McAfee, Adobe, GAP, Kaiser among others.
• Based on advice from mentors, he moved on to get startup experience at Coupa Software (now a public company), HelloSign (acquired by DropBox) wherein he was the first security hire and had to build the whole security program from scratch and hire the information security team as well.
• Anshu served as the Head of Security Engineering at Varo Bank wherein he helped them get FDIC and OCC approval and then as the VP, Security, CISO at Fast wherein he helped them get PCI Level 1 compliant in under 1 year.
• Anshu has a Masters degree in Computer Science and holds the CISM, CISA, PCIP and CIPP certifications among others.

​

My Management Philosophy

Inspire

Educate

Empower

Focussed Execution

Security Team Service Motto

​

Visible

Accessible

Service Oriented

Project Management Tips

• Work with your stakeholders to clearly define success criteria
• Block time on your calendar to match specific tickets/tasks/projects
• Respond back to folks with realistic deadlines. Not everything is P0
• Deep work
• Set up a No-Meeting Day in a week (Best Practice)
• Schedule emails for delivery during business hours
• Start with
• High Level Project Plan/Checklist
• Technical Design Document
• Runbooks
• Get started - Avoid planning paralysis
• Iterating and getting ongoing feedback Vs shooting for perfection in the first go

​

Sustained Engineering

Documented, Repeatable and Scalable

Agile

• Vision->Roadmap->Releases->Sprint Planning->Daily Scrum
• Jira - For project management
• Bi-Weekly Sprints - Pickup 3-4 mid-size tasks for the sprint and do them well
• Daily Standup - Post top 3 things, which you will be working on in the #security-team slack channel
• Actively groom your backlog
• Office Hours
• Bi-Weekly/Monthly Security Office Hours
• Pick up a topic on user education (e.g. How-to’s) to drive attendance/engagement for the office hours
• Rotate scrum master responsibility among team members
• Future State - Task estimation, Capacity Planning, Program Management

​

​

​

​

​

​

​

​

​

People Management Tips

1. Over communicate
2. Celebrate and communicate wins
3. Embrace feedback and give feedback in a positive, respectful manner as to what could be done better
4. Immediately communicate to your manage if you see any instances of undesirable behavior or when you are not sure
5. Understand that people are unique with diversity of personality and thought
6. Constructive disagreement on ideas is ok
7. Come from a place of curiosity
8. Ask a lot of clarifying questions (ideally think of questions before you have a meeting)
9. Make an endeavor to know people at a deeper level
10. Give kudos and credits where due, to stakeholders especially in public forums within the company

Personal Development

1. Have at least bi-weekly 1:1’s with your manager with focus on career/personal development
2. Set up a quarterly learning plan
3. Building your own personal brand
4. Do internal presentations/show and tell at least on a monthly basis
5. External Presentations - Use them as a forcing function to make your knowledge whole on a topic
6. Set up OKRs (Measure what Matters)
7. Build an accomplishments letter/brag document backed by deliverables/artifacts and metrics

​

Personal Branding - Who Am I ?

1. How others see you?
2. Identify your audience
3. Develop original content - Have a website or a personal blog
4. Write posts on the company blog around key projects, learnings or accomplishments
5. Social Media - Post “value add” material on LinkedIn/Twitter/Industry Slack Groups
6. Present at national/international conferences
7. Build your brain trust (who is/are your consigliere?)
8. Get a professional picture taken for LinkedIn
9. Create an actionable plan/checklist for personal branding and execute on it incrementally

​

​

Learning Plan - Sharpen the Saw

• Identify relevant certifications
• Identify books - Build a book list on Amazon Wish List. One domain specific book a month is allowed for reimbursement (departmental policy)
• Podcasts - security specific, management, self-help
• Free Trainings e.g. Cybrary, PortSwigger Academy
• Recording of conferences on Youtube e.g. OWASP, BSides, DefCon
• Identify and follow great people on LinkedIn/Twitter
• Build your own current and planned skills matrix
• Identify tools which you would like to master
• Build your own learning lab

Presentation Tips

• Enunciate - Speak clearly at a moderate pace
• If a stakeholder speaks up, don’t interrupt, listen carefully, take notes and based on feedback either respond with a clarification or take that as an action item
• Be mindful of the time. Keep a timer in front if necessary
• Use humor if you can
• Avoid filler words e.g. um, aa, you know, like
• Avoid using acronyms (unless well known) or company specific jargon

​

Meeting Management

Top 9 Tips for Conducting effective Meetings

Meeting Minutes Template

Action Item/Issues Tracker Template

Keep the meeting flowing. If something is taking up too much time, say “Let’s take it offline” or “I will set up another meeting to discuss this”

Fulfillment

• Identify what are your true professional and personal goals and ambitions
• Every step bring you closer to your goals
• Bringing “true self” to work
• Giving your 100% - Not holding back - No one can really stop your growth
• Expressing yourself
• Life Engineering - Build your own environment
• Help hire great people within the team and in other teams
• Transparency - Being transparent and open with others

Hiring - Preparation

1. Develop a real job description (avoid fillers, buzzwords)
2. Get feedback from recruiting on the job description
3. Work with HR and Finance on salary benchmarking for the role
4. Identify the interview panel
5. Provide recruiting all the keywords and criterion for sourcing candidates
6. Develop suggested questions for each person in the interview panel
7. Have a kick off meeting with recruiters and interview panelist before starting hiring for a position
8. Have the recruiter sit in through one or more phone screens and interviews to get a good idea of the candidate profile

Hiring - Interview

• Based on the role, have the candidate do a group presentation to the panelists
• Core values/Culture Interview - Make sure to include someone outside the security team to interview the candidate based on company core values, soft skills
• During the interview don’t jump into questions directly, start with the company background, your own background, why you are hiring and what are you looking for in this role
• Have a debrief meeting on the same day or the day after all the interviews are complete
• Always send a welcome/check-in email 1-2 weeks before a person joins to demonstrate your interest and engagement in the person you are hiring

​

Hiring Tips

1. Build relationships with people who you would like to hire in future
2. Organize security meetups at company locations
3. Job descriptions should include cool work the team has done including contributions to the open source community
4. Company blog should have blog entries related to security
5. Wear company swag in industry events, conferences, meetups
6. Build relationships with 3-4 security recruitment firms
7. New Grad Hiring - Build relationships at Universities (e.g. CMU, Purdue, John Hopkins etc.) which have specialized programs in security and showcase your company in their career fairs
8. Scout for talent within the company looking for people with curiosity, technical aptitude and hold internal career fairs showcasing different security career paths
9. If possible publish a “Meet the Security Team” video on company Youtube channel and include it in the Job reqs if the Applicant Tracking System (ATS) allows for embedded videos. If you can get an exec to talk about security in such a video, that would be golden.

Well Being

• Human beings are wired to worry/be anxious to ensure survival
• Learn to manage it. Use it to push you forward Vs paralyzing you into inaction
• Avoid Burnout
• Respond Vs React mindset
• If an issue is troubling you, write it down (get it out of your RAM and on-to long term storage)

Tip - Do a 5 min meditation or listen to relaxing music before or after a stressful meeting (you can find them on Youtube)

​

Well Being

• Connect with nature
• Post Covid - Have “walk and talk” meetings/check-ins
• Schedule time on your calendar for
• Time with family/kids
• Exercise
• Meditation
• Hobbies
• Have fun - YOLO
• Do annual/quarterly vacation planning and let team members and other stakeholders know early on

​

Technology Partner Selection

• Terminology - Partners not Vendors
• 1st call to determine fit etc. (30 mins)
• Get NDA signed if required before the technical demo. No NDA needed if we are not sharing any proprietary info.
• 2nd call - Deep Technical Demo (1 hr) - Everyone in the security team needs to be invited/or asked if they are interested. Invite other stakeholders as necessary
• Maintain meeting notes during the calls with potential partners
• Stored the potential partner artifacts (quotes, whitepaper etc.) in the Shared Team Folder
• Develop Partner Selection Criterion
• Fill Business Justification Document
• Pricing Research - Google Fu - Govt depts/States/Counties are good resources
• Do Reference Calls. Ask probing questions
• Leverage your trust network to get vendor feedback
• Tip - If possible organize all the demos in a day or two per quarter on a demo-day especially for cutting edge security solutions/new startups

Communication

• Communication types
• Verbal
• Non verbal
• Proactive
• Engaging
• Crisp
• Prep before as appropriate
• Proper Closure
• How do you make the other person feel?
• Balance between Humility & Confidence
• Audience Selection - Broadcast, Multicast, Unicast

Domain Expertise

• True Expertise
• 10,000 hour rule
• Deliberate Practice
• Continuous Learning & Sharing
• Have a learning plan
• Knowledge sharing

​

​

Email Etiquette

• Always acknowledge with SLA for more detailed response
• Inbox Zero
• Filters/Rules for Emails from key stakeholders
• Set time on your calendar for clearing emails
• Encourage folks to have conversations over messaging tools (Slack/Teams) vs Emails

​

Feedback

• Practice giving and receiving feedback. Start with folks who you are comfortable with
• Once feedback is received clearly define and work on actionable items
• In the upcoming meetings discuss how you acted upon it and share any learnings/challenges
• Use online surveys to get wider team feedback (Example Security Team Feedback form)
• Feedback should be balanced and not overtly focused on the negative

Remote work tips

• Over communicate
• Keep the camera on wherever possible - Be present
• Team socials (at least one per month)
• Regular 1:1s and syncs with all stakeholders
• Block time for lunch, time to take care of family e.g. any online class transitions for kids
• Take scheduled breaks (get off the chair, walk)
• Set boundaries between work and personal life to avoid burnout
• Get consensus on the timing of any group meetings keeping in mind time zones

• Get a good AV setup - Lighting (e.g. Elgato Key Light), HD Webcam (e.g. Logitech Brio), Microphone (e.g. Elgato Wave 3, Blue Yeti)
• Ergonomics - Work with IT/OfficeOps to get ergonomic keyboard, mouse. Use the budget for home furniture setup if offered by the company e.g. a standing desk

​

Professional Networking

• Identify who should be in your career network
• Actively build a Circle of Trust
• Industry Involvement - Meetups, Slack Groups, Conferences
• Professional Speaking Opportunities
• Social Media - LinkedIn, Following industry thought leaders on Twitter
• Both online and offline
• Set up monthly online/offline syncs with mentors
• Network internally with department leaders in the company

Onboarding - New Hire

• Intro Email/Message - Interesting things about you, One picture of you in your favorite place to visit, One picture of you doing something you love, One family picture (optional)
• Social Media - Post a picture of your new hire swag or yourself in company swag on social media with #companysocialmedia tag
• Week 1 Meet & Greets - Schedule 30 min meet and greet meetings with your peers
• Daily Syncs - Daily 30 min sync with your peer who will help you onboard
• Week 1 - Schedule 3 meeting with the Manager on MWF with first meeting for reviewing the onboarding plan
• Feedback - Share at least one feedback item with the onboarding team which could make the onboarding experience better
• Optional - Share something funny in the #teamfun or #random channel on Slack
• Optional - Sit on a sales call with a new prospect
• Optional - Record your own company Pitch and share it in the #teamfun or #random channel
• Optional - Record/Make a company TV commercial and share it in the #teamfun or #random channel

​

​

​

​

Onboarding - Manager

• Send a welcome email one week prior to an employee in your team joining
• Ensure that new hires are on track to receive IT equipment and have the right access especially contractors
• Ensure all HR/Financial paperwork has been completed for contractors
• Work with onboarding team to make sure all new hire onboarding meetings have been set up
• Develop a two week role based onboarding plan for the new hire
• Week 1 - Company & Culture Integration, HR & Business Process familiarization
• Week 2 - Technology, Tools and Departmental integration
• After the first two weeks get feedback from new hire to improve the new hire process and pass on the feedback to relevant departments e.g. HR, IT etc.

​

​

​

​

​

Power of Listening

• Truly listen and be comfortable with silence
• Listen carefully to what is said, but also to what isn't said

The three levels of listening

• Level 1: Internal Listening (Focused on Self) - Listener is focused on themselves and their reactions to what the speaker is saying
• Level 2: Focused Listening (Focused on Other) - Listener is focused entirely on the other person(s) and their ideas, thoughts, and feelings
• Level 3: Global Listening (Focused on context, and what isn’t being said) - Listener not only hears what is said, but is attuned to what is not said

​

​

​

​

​

Customer Centricity

External Customers

• B2B - Set up at least annual check-in’s with major customers to get in front of any potential security or compliance requirements
• B2C - Work with the support team to understand what kind of security or privacy issues/concerns are being reported by customers via tickets, social media etc.
• Check with product team if any customer facing security features are resulting in user friction

Internal customers

• Hold office hours at least on a bi-weekly basis
• Have regular check-in’s with different stakeholders
• Solicit feedback - Use in person meetings or online surveys to ask what is working and what it not working

Conflict Management - Tips

• Understand that having potential differences in opinion/conflict is a part of human interactions. Prepare for it by building rapport with the stakeholders beforehand
• Use “ideation” before a project launch to get stakeholder buy in, which in turn reduces the potential of conflict
• In case of any potential difference in opinion over messaging platforms, quickly setup a face to face sync via Zoom/Teams Vs getting on a long thread
• Set up 1:1’s to make sure a person has an opportunity to be truly heard
• In case of a difference in opinion, separate emotion from facts by writing key points and using them as anchors for discussion
• Be genuine in asking for help if you don’t understand the matter at hand e.g. “Can you help me understand why this is a better approach?”

Security Awareness

• Organize an internal security conference with internal and external speakers at least on an annual basis
• Get public partners like InfraGard, local FBI office cyber agents to come and do a presentation
• Work with the AV team to record security videos with department heads/executives for more personalized messaging
• Find a training vendor which offers interactive experiential training Vs text/video based training
• Apart from basic information security training and OWASP Top 10 type of the training, ongoing security training should be based on issues, incidents which are specific to the company
• Run Capture the Flag (CTF) type of events with prizes to drive participation
• Do anatomy of an attack presentations using the latest breach as an example
• Always be teaching and use every opportunity (micro/nano learning moments) to help people sharpen the saw

Managing Up

• Intentional and thought out
• Have clarity on what success for your manager means
• Set leaders for success by providing visibility and data for high quality decision making
• Keep leaders in the loop around major initiative, issues and challenges to make sure they are not surprised
• If you are asked for status on something, it means it is already too late
• Striving for “pushing information” upwards Vs waiting for “information to be pulled” by management
• Pull information about opportunities & changes from management
• Provide perspective based on experience & ground realities
• Anticipate questions and concerns and make sure you have answers for them
• Tip on Executive communication
• Be Brief, Be Bright and Be Gone

​

Performance Management

My Performance Management Philosophy

• Performance reviews are meant to be a celebration of achievements while gently pointing you in the right direction for personal and professional growth
• You own your career and career strategy. Your manager is a facilitator in this journey

Tips

• Put effort in understanding company’s career ladder and promotion process
• Document your accomplishments using STAR framework - Situation, Task, Action, Response
• Think in terms of numbers and metrics when documenting accomplishments
• To really stand out, do things which no one else wants to do

Performance Management Pillars

1. Job role performance - Did you get the job done for which you were hired at a satisfactory level?
2. People - Did you make other people that work with you successful? Knowledge sharing, training others, building repeatable/scalable processes
3. Efficiency - Did you help the business /your domain area become more efficient? Demonstrable resource savings (dollars/time)
4. Learning - Did you demonstrate that you upgraded yourself and learned new skills e.g. got new certifications, mastered a new technical/management skill

Upcoming

• OKR - Quarterly Retrospectives on OKRs
• Team Offsites
• Stretch Goals - How to do it right?
• Quality
• Procurement Best Practices
• Ensuring Alignment
• Build Vs Manage mindset
• Aspirational Keywords - Authentic, Empathetic, Genuine, Engaged, Ownership
• Career Management - Job Vs Career
• Executive coaching - the why?
• Leadership - What does it mean to you? Servant Leader, Mentor, Coach, Facilitator?
• Budget Management
• Working with Legal
• Reference Books

​