Cybersecurity teams play a huge role in any organization. Not only are SecOps expected to make an airtight network, but they’re also expected to anticipate a hacker’s next antics to force their way in. When it comes to coordinating these efforts, CISOs have to consider everything from technical skills to personality quirks.
SightGain’s expertise in cybersecurity operations is directly linked to how teams pull together, whether it’s for routine tasks or all-hands-on-deck emergencies. Founder and CEO of SightGain, Christian Sorensen, recently sat down with several leaders in the cybersecurity sector about how they’ve managed to build a cybersecurity team that clicked.
Invest in Your Talent Pool
When asked the biggest game-changer seen in the last couple of years at an executive level, Josh Copeland, Sr. Director of Cybersecurity at AT&T, said that it was the perception of his field. Since the first major hack, people have known that breaches are a potential concern. However, coaxing people to truly understand the dangers to the bottom line has been precarious at best. Unless they’re dealing directly with the fallout, they might dismiss either the odds of an attack or the severity of its consequences.
This attitude shift has organizations spending more on improving their cybersecurity resiliency. As a general rule, there’s less pushback from the C-suite about devoting resources to cybersecurity. If you were ever going to put time and effort into your SecOps team, whether that means offering higher salaries or expanding your compliance department, you’re unlikely to regret it.
Utilize Your Resources Efficiently
Extolling the benefits of remote work is nothing new since the pandemic, but for cybersecurity teams, it bears repeating. When you can hire from anywhere, your talent pool is wide enough to build the team you envisioned. Paul Keener, SVP Head of Cybersecurity Operations at City National Bank, will tell you that nothing replaces human interaction, but “the collaboration tools make it much easier to close the gap.”
In terms of productivity in remote teams, Keener remarked that it was a weird mix. “You find yourself having to force people not to work.” For leadership, they have to remember not to call people unless it’s absolutely necessary, so people can actually take time for themselves. When people’s phones and laptops are constantly pinging at all hours, there need to be clear and present boundaries established.
Aim for Diversity
The term echo chamber is largely used to refer to politics these days, but organizations fall prey to groupthink all the time. Building an effective cybersecurity team is more than hiring professionals from the ‘right’ schools or companies. While it may seem better to have an agreeable team — likely because they all have similar educational backgrounds, it can stunt a company in more ways than one.
Copeland remarked that hiring people with varying degrees of experience has been remarkably beneficial for AT&T. You end up with experienced people who can mentor and lead, and a junior team that comes at each obstacle from a very different perspective. “When you have people coming from a plethora of backgrounds, you can pull in all that synergy.” While it may not be noticed on the P&L sheet, it’s an undeniably better way to do business.
When you consider people’s resumes, you have to look past the text. You want people who have proven they can challenge where you’ve been and where you’re going in a way that helps everyone move up.
Give People Ownership
A big part of establishing the right environment is knowing when to step away. Allowing people to take the lead in their work doesn’t just make them more interested in what they’re doing, it creates better products and solutions. Keener from City National Bank said, “Of all the things that have been successful, it’s been the team dynamic [he’s helped to build]. A tool is just a tool until you put someone behind it.”
Keener also stressed the importance of forming connections before there’s a crisis. If people care about one another, you won’t have to encourage them to band together to meet a tight deadline, they’ll do it on their own. This inherent awareness is rarely something you can buy. In addition to offering a stellar compensation package, building a cybersecurity operations team comes down to everyone believing in their missions — and one another.
