Navigating the Cybersecurity Career Path

CHAPTER 21How Do I Fund My Program?

Summary

• Know your numbers: Know your income sources, your spending needs, and how financial decisions are made at your organization.
• Network: Know who makes spending decisions and keep regular contact with them about your planning needs.
• Communicate well and often: Ask for everything you need, even if you know the answer will be “no.” Give them a choice to make and document their risk management choices.

When you are a mid-level security manager, you don't need to care too much about where the money to pay for your programs came from — it sort of magically appears (or not). It is the job of your manager and their manager to get the budget you need. This is a common experience for most of us. (We're happily going along being a manager of people, but income sources are not something we particularly worry about.)

When you become a security leader, suddenly it is your job to ensure there is funding for the team. You must learn how the whole financing thing works. Who makes decisions, officially or unofficially, about how money is spent? What is the budget cycle? When can you ask for money? Even if everyone agrees that security should be invested in, where will the money come from and when?

It can take a lot of time to understand how money works, who should decide where the money should be spent, and how to engage with the institution to ensure that money flows to the security team. Being the security team leader means you must know ...