Build the team, then build the people
A world-class security function is a talent system before it is a control system. Here is how I shape the org, who I hire, and the culture that keeps them.
> Design the org around leverage
Lead ICs first. The early security org should be built around high-leverage lead ICs — AppSec, InfraSec, and SecOps each need, preferably, Staff-level operators who can set direction, build the rails, and raise the bar for the rest of the team. Earlier-career engineers rotate across those domains so they develop range before specializing.
IT is a security-first team. It should be led by an enterprise security operator with platform and automation experience. That derisks the identity surface, accelerates vendor management and SaaS security, and prevents IT from becoming a separate operational island outside the security model.
GRC needs engineers, not just auditors. It needs someone who can automate where commercial tools cannot, a strong project manager, and a GTM-facing UX. Those may be the same person early, but as compliance complexity and deal flow increase there is a natural fork between program management and engineering.
> Hire for edges, not for comfort
My hiring philosophy is simple: if a panel comes back with unanimous comfort, the hiring manager's hard job is to stop and ask whether the team actually pressure-tested the candidate. A split decision with a strong champion is often more valuable than a safe, forgettable yes.
On a lean team, I cannot afford merely acceptable hires. I hire for sharp strengths, real perspective, and the ability to raise the room.
> Grow people past their strengths
I play to people's strengths, then push them into the adjacent hard thing. A strong GRC operator should learn to build governance programs, not just pass audits. A great offensive-security person should learn to defend and fix, not only find. Breakers have to become builders — the fastest way for security to lose credibility is to throw findings over the wall and call that partnership.
People join because I sell a vision of opportunity, autonomy, and work that does not exist anywhere else yet. They stay because the team is inclusive, respectful, brilliant, and supported by a leader who paves the road for their initiatives. The biggest letdown is when I have to tell the team directly what to do — the goal is a team that can see the opportunity and move.
I believe in a high-autonomy, high-performance culture and I reward it with outsized career growth. Multiple former reports have grown into Head of Security or CISO roles. My organizations are career accelerators, not holding patterns.
> Manage performance humanely and fast
The honest bookend to hiring superstars is acting quickly and fairly when someone is not going to make it. Carrying a low performer is not kindness; it is the least empathetic thing you can do to the people around them who are carrying the weight. Performance management should be humane, direct, well-supported by the company, and fast enough to protect the team.