The First 90 Days: Building a Security Strategy Without Burning the Building Down
Why relationships matter more than firewalls when you’re the new security hire.
The Reality Check
There is a version of security leadership that exists in textbooks. In that version, you walk in on Day 1, apply a standard framework (NIST, ISO, SOC2), buy a shiny dashboard, and suddenly the company is secure.
Then there is reality.
In reality, you walk in on Day 1 and ask for a simple asset inventory. You get three different answers. The CMDB says you have 400 servers. The finance invoices say you’re paying for 650. The cloud console shows 800 active instances.
Congratulations, you have found your first gap before lunch.
If you are stepping into a new role—whether as a founding security engineer or a CISO—building a strategy isn’t about templated policies. It is about anthropology first, technology second. You have to understand the tribe before you can protect the village.
Here is a pragmatic 3-month plan to move from “figuring it out” to “executing a vision.”
Month 1: The Listening Tour & The Triage
Goal: Understand the context, build capital, and stop the bleeding.
The biggest mistake new security leaders make isn’t technical; it’s relational. They come in hot, blocking workflows and locking down permissions, scaring the staff into thinking “Dr. No” has arrived to ruin their productivity.
Your primary job in Month 1 is reassurance. You need to signal that you aren’t here to make hasty, disruptive decisions.
1. The “Listening Tour” Schedule 1:1s with every department head (Engineering, Product, HR, Sales, Legal). Do not talk about security frameworks. Ask them one specific question:
“What is your current pain point that is not security related?”
This question is magic. It disarms them. It shows you care about their success, not just your compliance checklist. If Sales says their pain point is “contract delays,” and you can eventually help speed up vendor security reviews, you just became a revenue enabler, not a blocker.
2. Asset Reality Check You cannot protect what you don’t know exists. As mentioned, trust the invoices, not the diagrams. If the company is paying for AWS, Azure, and DigitalOcean, but IT only knows about AWS, you have found the shadow IT. Don’t shut it down yet—just map it.
3. The “Stop the Bleeding” Quick Wins While listening, look for the non-negotiable, “open doors” that you can fix without anyone noticing.
MFA Everywhere: If root accounts or email systems don’t have MFA, fix that now.
Offboarding: Check the last 5 employees who left. Do they still have access? If yes, build a manual offboarding checklist immediately.
Month 2: Analysis & The “Invisible” Strategy
Goal: Connect the dots and improve visibility without friction.
Now that you know who the key players are and where the scary skeletons are buried, you move to analysis. This is where you differentiate between “theoretical risk” and “business risk.”
1. The High-Value, Low-Friction Win: Email Hardening In Month 2, you need a win that makes you look competent but doesn’t annoy a single developer. My favorite go-to is Email Security (DMARC/DKIM/SPF).
A surprising number of companies have email configurations that are wide open to spoofing. This is a massive risk that is often completely invisible.
The Fix: Use free tools (like MXToolbox or verify-email.org) to identify DNS gaps.
The Value: You can often fix this with simple DNS configuration changes. It takes weeks, not months.
The Sell: You tell leadership, “I just stopped hackers from being able to impersonate our CEO via email, and nobody had to install a single agent.”
2. Turn on the Lights (Visibility) You don’t need to block attacks yet; you just need to see them.
Quick Win: Enable logging. CloudTrail, Google Workspace logs, endpoint logs. Aggregate them somewhere. You can’t investigate an incident if you have no history.
3. Contextual Risk Assessment Map your findings from Month 1 against the business goals. A vulnerability in a brochureware website is low risk. A vulnerability in the payment processor is existential risk.
Strategy Tip: Don’t present a list of 1,000 vulnerabilities. Present the 3 that threaten revenue.
Month 3: The Roadmap & The Sell
Goal: Formalize the strategy and secure the budget/buy-in.
By Month 3, you are no longer the “new person.” You are the owner of the domain. You have built relationships by listening to their pain points, and you have proven competence by hardening email without breaking the product. Now you propose the Big Strategic Fixes.
1. The “Big Rock” Strategic Fixes These are the 6-18 month projects that require budget and engineering time.
Example: Moving from a flat network to a Zero Trust architecture.
Example: Automating the SDLC (shifting left) so developers get security feedback in their PRs.
Example: Achieving SOC2 or ISO 27001 certification to unlock up-market sales deals.
2. The Tabletop Exercise Nothing creates alignment like a simulated disaster. Run a 1-hour tabletop exercise with leadership.
Scenario: “Ransomware just hit the CFO’s laptop. What do we do?”
This highlights gaps in communication and decision-making faster than any PowerPoint deck. It usually reveals that the organization has no idea who makes the call to shut down the network.
3. The Executive Presentation Present your 12-month roadmap. It should follow this narrative arc:
Here is where we were: (3 different asset lists, open email relays).
Here is where we are: (Unified inventory, hardened DNS, active monitoring).
Here is where we are going: (Resilient architecture that supports sales velocity).
The Golden Rule
The best security strategy is not the one that is technically perfect; it is the one that the organization can actually absorb.
Walk in. Listen to their pain. Fix the easy stuff quietly. Then, build a strategy that helps the company run faster, not slower.