Starting a Security Program: Thrills and Spills
summary
First security hire at Lyra Health builds a usable program that hits HITRUST in 1 year, enforces MDM and disk encryption, turns on find-sec-bugs and CI build failures for fixes, and ships application-layer per-customer keys to satisfy a demanding client. Implements infra-as-code and automated disaster recovery, integrates LastAlert logging ownership, runs external pen tests and red teams, and pilots same‑day provider payments via Stripe; outcomes: companywide buy‑in at ~60 people and higher operational readiness.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:12What skills do you need
- 1:32What skills did you learn
- 2:32Background
- 3:20What does Lira Health do
- 4:10Starting from the bottom
- 5:43Starting in 2015
- 8:30Why did you take this role
- 8:53What was your background
- 9:26Purpose
- 9:56Call to Action
- 10:11High Trust Certification
- 13:55Responsibility
- 14:15Emotional Journey
- 15:04Thinking Trap
- 17:03Communication Skills
- 17:40Framing Discussions
- 19:21Communication Tactics
- 21:25Presence
- 21:49Remote working
related talks
20mBuilding security culture on infrastructure teams
21mSecuring a Security Company
19mSo You’re the First Security Hire
24mBeing secure by design: Engineer-led security
20mDecoded: Leverage Cybersecurity as a Business Enabler
24mConcrete Steps to Create a Security Culture
44mMinimum Viable Security
57mBuilding a Modern Security Engineering Organization