Project · Active · started
Building a Security Function from Zero: A 12-Month Playbook
A playbook for the first security hire or the engineering leader who owns security by default: what to do in the first 90 days, how to build a roadmap ranked by business risk, what to buy and what to build, when compliance arrives, and how to report progress leadership can act on.
Scope
Security functions rarely start from a plan. They start when a customer asks for a SOC 2 report, an incident happens, or an investor asks who owns security. The first year decides whether security becomes a function the business relies on or a queue of tickets nobody prioritises.
This playbook covers that year in order:
- First 90 days: understand the business, the crown jewels and the people before writing a single policy.
- A roadmap ranked by business risk: not by vendor pitches or the loudest finding.
- Foundations: identity, logging, incident response, cloud and supply chain basics.
- Security that engineers adopt: controls in the pipeline, not in a PDF.
- Compliance as a by-product: SOC 2 and ISO 27001 as evidence of good engineering.
- Reporting: quarterly updates leadership can make decisions from.
Status
Scoping. Drawn from experience across consulting, a regulated bank and a global SaaS platform: general lessons, no employer specifics.
Planned artifacts
- Risk-ranked roadmap template
- First-90-days plan
- Quarterly leadership report template