Chapter 8 of 12 · Week 1
The first week in the job
- What should I do in my first week?
- What if I am given access to things I do not understand?
- How much should I already know?
Your first week in a security job is mostly about orientation. You will get accounts, meet people, read documents and watch others work. It can feel slow. That is fine. Your manager is not expecting much output yet.
What to focus on
- Learn who is who: your manager, your team, who you go to for each kind of question.
- Learn the tools you will use every day, starting with the ones your team mentions most.
- Read the runbooks or procedures for your main tasks, even if they are out of date.
- Sit with a colleague while they work, and ask why they do each step.
- Find out the rules: what you may do alone, and what needs approval.
Access and responsibility
Security staff often get more access than most new starters: logs, alerts, sometimes sensitive data. Treat it carefully. Look only at what your work needs. If you are unsure whether something is allowed, ask before you do it.
Rule of thumb:Never test, scan or change anything in production without explicit approval, even if your account technically allows it. Having access is not the same as having permission.
The question you might not ask out loud
Everyone uses acronyms I do not know. Should I keep asking?
Yes, and keep a list. Most teams are happy to explain, and some acronyms are specific to the company, so nobody outside would know them. After a week your list becomes a glossary the next new starter will thank you for.
Small wins
- Fix something small in the documentation that confused you.
- Write up what you learned each day in a few lines.
- Ask your manager what good looks like at one month and three months.
At the end of the week, write down three things you understand now that you did not on Monday. It will feel like less than you hoped, and it is more than you think.
Expect some things to be messy. Documentation may be out of date, tools may not match what you learned and people may be too busy to explain everything at once. That is normal in almost every security team. Note the gaps you find. Later, when you understand them, fixing one is an easy way to be useful.