Chapter 1 of 14 · Day 1 to week 2

Your First Day: Who to Meet and What Not to Say

Who should I talk to first?
Should I share my plan in my first meeting?
What if people ask me what I think and I don't know yet?

Your first job is to listen, and to be seen listening. People will form a view of you in the first fortnight, and the view they form is mostly about whether you understood their world before you tried to change it.

Who to meet, roughly in this order

Your boss. Ask what made them hire for this role now, and what would make them say in six months that it was the right call.
Your own team, one at a time. Ask what they are proud of, what keeps breaking, and what they were told to stop raising.
The CFO or finance lead. Ask how security spend is approved and who signed the last big security purchase.
General counsel or the legal lead. Ask who decides whether an incident has to be reported, and how fast they expect to hear from you.
The CIO or head of engineering. Ask where the systems are that would hurt most if they stopped for a day.
Two or three business unit heads. Ask what security has made harder for them, and whether they think it was worth it.
The person who did your job before you, if they are reachable and the parting was civil.

Write down what each person says in their own words. Later, when you present your plan, you can show that the plan answers what they told you. That is the fastest way to earn trust you have not had time to build.

What not to say yet

"At my last company we did it this way." Say it once and people stop telling you how things work here.
A verdict on the previous security leader. You do not know what they were allowed to do.
A list of tools you plan to buy. You do not know the problems yet.
A promise with a date on it. Every date you give in week one becomes a test you did not choose.

The question you might not ask out loud

What do I say when someone asks for my plan on day three?

Say you will have a first view in 30 days, and tell them what you are doing to get there: who you are meeting and what you are reading. A clear process is a good answer. A made-up plan is a bad one, and people can usually tell.

You will see things that worry you in the first week. Some of them will be real. If something is actively dangerous, like a public storage bucket full of customer data or an admin account with no second factor, act on it now and say so. Everything else goes on a list. Most first-week alarms turn out to have a history you do not yet know.

Rule of thumb:Rule of thumb: in the first two weeks, ask three questions for every opinion you give.