<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-security-organizational-design
description: >-
  Design security organization structures including team topology, reporting
  lines, RACI matrices, capability mapping, and staffing models that scale
  with business growth and threat landscape evolution.
domain: cybersecurity
subdomain: security-leadership
tags:
  - org-design
  - team-topology
  - raci
  - capability-mapping
  - staffing-model
  - reporting-structure
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Organizational Design

## Overview

Security organizational design determines how security capabilities are
structured, staffed, and governed. Effective design aligns team structure
with business needs, ensures clear accountability through RACI matrices,
and scales efficiently as the organization grows.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Business context | Organization size, industry, growth rate |
| Current org chart | Existing security team structure |
| Capability requirements | Security functions needed |
| Budget parameters | Headcount and contractor budget |

## Key Concepts

- **Team topologies**: Centralized, federated, hybrid security models
- **RACI matrix**: Responsible, Accountable, Consulted, Informed assignments
- **Capability mapping**: Map security functions to team ownership
- **Span of control**: Optimal manager-to-IC ratio (5-8 reports)
- **Embedded security**: Security champions in product teams

## Workflow

### Step 1: Assess Current State

```python
ORG_MODELS = {
    "centralized": {
        "description": "Single security team owns all functions",
        "best_for": "< 500 employees",
        "pros": ["consistent_policy", "clear_ownership", "efficient_tooling"],
        "cons": ["bottleneck_risk", "limited_business_context"],
    },
    "federated": {
        "description": "Security distributed across business units",
        "best_for": "> 5000 employees, multi-BU",
        "pros": ["business_alignment", "scalable", "domain_expertise"],
        "cons": ["inconsistent_standards", "coordination_overhead"],
    },
    "hybrid": {
        "description": "Central team sets policy, embedded engineers execute",
        "best_for": "500-5000 employees",
        "pros": ["balanced", "scalable", "business_context"],
        "cons": ["dual_reporting_complexity", "role_clarity_challenges"],
    },
}
```

### Step 2: Define Team Structure

```python
from dataclasses import dataclass, field

@dataclass
class SecurityTeam:
    """Security team definition."""
    name: str
    lead_title: str
    headcount: int
    capabilities: list[str] = field(default_factory=list)
    reports_to: str = "CISO"

TEAMS = [
    SecurityTeam("Security Operations", "Director, SecOps", 8,
                 ["monitoring", "incident_response", "threat_hunting"]),
    SecurityTeam("Security Engineering", "Director, SecEng", 6,
                 ["tooling", "automation", "detection_engineering"]),
    SecurityTeam("Application Security", "Director, AppSec", 5,
                 ["code_review", "sast_dast", "secure_sdlc"]),
    SecurityTeam("GRC", "Director, GRC", 4,
                 ["compliance", "risk_management", "policy", "audit"]),
]
```

### Step 3: Build RACI Matrix

```bash
node agent.js design --model hybrid --headcount 25
node agent.js raci --teams security_teams.json --capabilities all
node agent.js staffing-plan --growth-rate 20 --timeline 3y
```

## Verification

| Check | Method |
|---|---|
| All capabilities mapped | No orphaned security functions |
| RACI complete | Every function has exactly one A |
| Span of control valid | No manager > 8 direct reports |
| Budget aligned | Headcount within approved budget |

## References

- [Team Topologies — Skelton & Pais](https://teamtopologies.com/)
- [NIST NICE Workforce Framework](https://www.nist.gov/itl/applied-cybersecurity/nice)
- [SANS Security Team Structures](https://www.sans.org/)
