So You’re the First Security Hire
summary
Practical roadmap for the first security hire: inventory crown jewels, map legal and customer compliance needs, and rank threats with Mitre ATT&CK and CVSS to feed a simple risk spreadsheet. Prioritize zero trust and Platform-as-a-Service, enable OAuth whitelisting and mandatory 2FA, and outsource audits while owning implementation. Favor guardrails not gates, iterate to 80% then improve, recruit security champions across sales, legal and engineering, and use small cultural moves (awards, transparency) to get buy-in.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:35What have you gotten yourself into
- 1:49Why do you exist
- 3:15Strategy
- 5:02What Matters Most
- 6:25Third Party Risk
- 7:26Strategy Threats
- 8:11Strategy Policies
- 9:34Good Guiding Principles
- 11:10Culture
- 12:52Feedback
- 14:55Building Relationships
- 16:20Engagement
- 17:46Physical Security
- 19:00Outro
related talks
31mStartup Security, 2nd Edition
51mFirst Security Hire: Building a sec...
50mHow to Introduce “Enterprise-Grade” Security at a Startup
51mBuilding Security Champions
36mOvercoming Obstacles in Operationalizing Security
46mNow You’re in Role: The Fearless CISO
31mTrust Engineering: Building Security Leadership at Early-Stage...
44mUnlikely Allies: How HR Can Help Build A Security-First Culture