Start-Up Secure

CHAPTER EIGHTHiring, Outsourcing, or Hybrid

Your company culture is who you hire, fire, and promote.

– Dr. Cameron Sepah

HIRING WELL IS THE SINGLE most important thing any company can do. A bad hire in a key position can be devastating and have a long-lasting negative impact to the business in almost every aspect. Dr. Cameron Sepah said it very well: “Your company culture is who you hire, fire, and promote.” And I would add to that: company culture is not free snacks, arcade games, or company trips to exotic locations for team building. Who we surround ourselves with to represent us and our business defines the culture. Once you've figured that out you'll need to decide if it makes sense to hire someone full-time, outsource the role in some way, and decide whether to run the search internally, if you have talent acquisition, or use an outside firm.

As a start-up, you must focus on the details. What is your value proposition? Ensure every new role supports that until revenue is positive. Creating cybersecurity roles will be essential to protecting the business's current and future revenue and brand. However, creating titles for the sake of checking a box will do far more harm in the long run than thoughtful hiring. Many companies today are expected to have a chief information security officer (CISO) that reports directly to the CEO and has total visibility across the enterprise's cybersecurity posture and risk.

But simply bestowing this title on someone with no tactical security ...