You join a 100-person SaaS company tomorrow as its first security hire. There is no security team, no formal…
Lara B. — Building Cyberr
You join a 100-person SaaS company tomorrow as its first security hire.
There is no security team, no formal security programme, customers are already sending security questionnaires, and the company wants to start selling to larger enterprises.
You have a limited budget and a long list of things that could be fixed.
What do you do first?
Not which framework you choose.
What are the first three things you actually do in your first 30 days?
I’d love to hear how people here would approach this differently.
6 reactions · 12 comments
Comments
Scott D.: It would appear that the tactical issue is the security questionnaires from clients. Dealing with that will inform what your security program should be so that will be #2. Forming the security program will reveal where the holes are and then you can prioritize budget from that for to deal with #3, as much remediation as time and budget will allow.
Lara B.: Scott Smith so basically client first. Okay, I like that approach.:)
Scott D.: They pay the bills...I know that that is my priority and most employer/clients agree.
Mark C.: I unfortunately see this a lot myself with the consultancy work I do. The most alarming issue is that this SaaS company reached 100 employees without a single consideration for even the most basic of security posture. The way I would approach this is as below 1. Obtain the enterprise admin username and password, and determine who has access. The same applies for a list of service accounts and wher
Timo: I'm a little surprised by these answers. "Obtain Admin username and password" as first thing? Read what the customers want and do that? Customers want to know you manage and mitigate your risks appropriately and properly. Currently the organisation may but will likely not have formalised or understood their requirements. First thing would be to do a risk analysis, understanding what needs mitigati