<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Team & Culture Reference

Deep reference for security team building, career frameworks, and champion programs.
Parent skill: [../SKILL.md](../SKILL.md)

---

## Security Team Organizational Models

### Model Comparison

| Model | Structure | Best For | Tradeoffs |
|-------|-----------|----------|-----------|
| Centralized | Single security team owns all functions | Small/mid orgs, early maturity | Bottleneck at scale, limited business context |
| Federated | Central team + embedded security engineers in BUs | Large enterprises, multi-product | Higher headcount, coordination overhead |
| Hub-and-Spoke | Central CoE + dotted-line security champions | Mid-to-large, rapid growth | Champions need training and time allocation |
| Virtual | No dedicated team; security responsibilities distributed | Startups (< 50 employees) | Gaps in coverage, no dedicated ownership |

### Recommended Team Structure (Centralized, Mature)

```
CISO
├── Security Engineering
│   ├── Detection Engineering (Sigma, SIEM, SOAR)
│   ├── Application Security (SAST, DAST, code review)
│   ├── Infrastructure Security (cloud, network, endpoint)
│   └── Identity & Access Management
├── Security Operations
│   ├── SOC Analysts (Tier 1, 2, 3)
│   ├── Incident Response
│   └── Threat Hunting
├── Governance, Risk & Compliance
│   ├── Risk Management
│   ├── Compliance & Audit
│   └── Third-Party Risk
├── Threat Intelligence
│   └── CTI Analysts
└── Security Program Office
    ├── Awareness & Training
    ├── Metrics & Reporting
    └── Architecture Review
```

### Team Sizing Guidelines

| Company Size | Security FTEs | Ratio |
|-------------|--------------|-------|
| < 100 employees | 1–2 | 1:50–100 |
| 100–500 | 3–6 | 1:80–150 |
| 500–2000 | 8–15 | 1:100–200 |
| 2000–10000 | 15–40 | 1:150–250 |
| > 10000 | 40–100+ | 1:200–300 |

Note: Ratios vary significantly by industry. Financial services and healthcare
skew toward lower ratios (more security per employee). SaaS/tech companies
often supplement with embedded security engineers.

---

## Career Ladder Frameworks

### Individual Contributor Track

| Level | Title | Scope | Skills | Years Experience |
|-------|-------|-------|--------|-----------------|
| IC1 | Security Analyst | Execute defined processes | Tool proficiency, alert triage | 0–2 |
| IC2 | Senior Security Analyst | Own a functional area | Investigation, rule writing, mentoring juniors | 2–5 |
| IC3 | Security Engineer | Design solutions, lead projects | Architecture, automation, cross-team influence | 5–8 |
| IC4 | Senior Security Engineer | Define strategy for a domain | Threat modeling, org-wide standards, external thought leadership | 8–12 |
| IC5 | Staff Security Engineer | Shape program direction | Industry influence, novel research, executive communication | 12+ |
| IC6 | Principal Security Engineer | Define industry practices | Published research, conference keynotes, advisory board | 15+ |

### Management Track

| Level | Title | Scope | Skills |
|-------|-------|-------|--------|
| M1 | Security Team Lead | 3–5 ICs, single function | Hiring, 1:1s, sprint planning |
| M2 | Security Manager | 6–15 ICs, multiple functions | Budget, roadmap, stakeholder management |
| M3 | Director of Security | 15–40, full program area | Strategy, executive communication, vendor management |
| M4 | VP of Security | Multiple directors | Board reporting, M&A security, enterprise risk |
| M5 | CISO | Full security program | Business strategy, regulatory, industry representation |

### Level-Up Criteria

Promotion requires demonstrated performance at the **next** level, not just time at current:

```
Criteria for IC2 → IC3:
  ✓ Independently designed and shipped a detection/tooling project
  ✓ Mentored at least 1 junior analyst
  ✓ Cross-team collaboration (e.g., worked with dev team on secure coding)
  ✓ Presented findings or methodology to team (internal talk)
  ✓ Consistent "exceeds expectations" in current role for 2+ review cycles
```

### IC ↔ Management Transition

- IC → Management is not a promotion — it's a role change
- Offer "management trial" (3–6 months, reversible)
- Preserve IC6 compensation parity with M3/M4 to retain senior ICs
- Staff/Principal engineers should have scope and impact comparable to directors

---

## Security Champions Program Playbook

### Program Goals

1. Scale security knowledge across engineering without hiring proportionally
2. Shift security left — catch issues earlier in development
3. Build a security-aware culture through peer influence
4. Create a pipeline for future security team hires

### Champion Selection Criteria

| Criteria | Required | Preferred |
|----------|----------|-----------|
| Interest in security | ✓ | |
| Technical respect from peers | ✓ | |
| 1+ year at company | ✓ | |
| Development experience | ✓ | |
| Prior security training/CTF | | ✓ |
| Team lead or senior engineer | | ✓ |

### Program Structure

```
Month 1: Onboarding
  - Security fundamentals training (8 hours)
  - Threat modeling workshop
  - Access to security tools (SAST dashboard, vulnerability scanner)
  - Slack/Teams channel for champions

Month 2–3: Skill Building
  - OWASP Top 10 deep dive (hands-on labs)
  - Secure code review workshop
  - Shadow a security engineer during code review

Month 4+: Active Participation
  - Conduct security review for their team's PRs (2–4 hrs/week)
  - Triage SAST findings for their service
  - Present "security tip of the sprint" at team standup
  - Escalate findings to security team via defined process

Ongoing:
  - Monthly champions meetup (1 hour — new threats, tools, Q&A)
  - Quarterly CTF or tabletop exercise
  - Annual champions summit (full day)
```

### Champion Responsibilities

| Activity | Time Commitment | Frequency |
|----------|----------------|-----------|
| Security PR review for own team | 2–4 hrs/week | Ongoing |
| SAST finding triage | 1 hr/week | Ongoing |
| Monthly champions meeting | 1 hr | Monthly |
| Security tip presentation | 15 min | Per sprint |
| Training/skill building | 4 hrs | Monthly |

### Success Metrics

| Metric | Target | How to Measure |
|--------|--------|----------------|
| Champion coverage | ≥ 1 per engineering team | Headcount tracking |
| SAST finding triage time | < 5 business days | Tool metrics |
| Security bugs found pre-release | 20% increase YoY | Bug tracker tags |
| Champion retention | > 80% annual | Program enrollment |
| Champion → security hire pipeline | ≥ 1/year | HR tracking |

---

## Culture Measurement Methodologies

### Security Culture Dimensions

| Dimension | What to Measure | Method |
|-----------|----------------|--------|
| Awareness | Do people know the policies? | Quiz scores, training completion |
| Behavior | Do people follow the policies? | Phishing sim rates, clean desk audits |
| Attitude | Do people believe security matters? | Annual survey (Likert scale) |
| Communication | Can people report issues easily? | Reporting volume, time to report |
| Compliance | Do teams meet security requirements? | Audit findings, SLA compliance |
| Norms | Is security part of daily conversation? | Champion activity, PR review adoption |
| Responsibility | Do people own security for their domain? | Incident ownership, risk register participation |

### Measurement Framework

```
Quarterly Culture Score = weighted average of:
  - Phishing click rate (25%) — lower is better
  - Training completion (15%) — higher is better
  - Security survey score (20%) — Likert 1-5
  - Incident reporting rate (15%) — higher indicates trust
  - Champion activity (15%) — PR reviews, presentations
  - Audit compliance (10%) — findings closure rate
```

### Annual Security Culture Survey (Sample Questions)

```
1. I understand my responsibility for protecting company data.
   [Strongly Disagree] 1 — 2 — 3 — 4 — 5 [Strongly Agree]

2. I know how to report a security incident.
   [Strongly Disagree] 1 — 2 — 3 — 4 — 5 [Strongly Agree]

3. Security requirements are considered early in our projects.
   [Strongly Disagree] 1 — 2 — 3 — 4 — 5 [Strongly Agree]

4. I feel comfortable pushing back when asked to bypass security controls.
   [Strongly Disagree] 1 — 2 — 3 — 4 — 5 [Strongly Agree]

5. Security training is relevant to my daily work.
   [Strongly Disagree] 1 — 2 — 3 — 4 — 5 [Strongly Agree]
```

### Benchmarking

Compare your scores against:
- **Internal trend** — QoQ improvement is more important than absolute score
- **Industry benchmarks** — SANS Security Awareness Report publishes annual data
- **Peer companies** — ISACs (Information Sharing and Analysis Centers) may share anonymized data
