Design a cybersecurity team structure, with job descriptions
A cybersecurity team structure sets which security functions you staff, how many people each gets and what each role is measured on. Describe a company in five fields — size, industry, current maturity, regulatory pressure and annual security budget — and get a structured greenfield security organisation to work from: a budget split, security functions with headcount, roles with KPIs, a first-year hiring roadmap and downloadable job descriptions. It is a planning model to adapt, not a scan of your environment.
What it gives you
Budget allocation
Splits your annual security budget across people, tooling, managed services and training & culture, with the percentage each takes.
Functions & headcount
A set of security functions sized to the company, each with an approximate FTE count and non-people spend.
Roles with KPIs
Roles under each function, with level, headcount and a few concrete KPIs per role.
First-year hiring roadmap
A sequenced view of which roles to hire when across the first year.
Downloadable job descriptions
Per-role JDs in Markdown, plus the whole plan as Markdown and the roster as CSV.
How it works
- 1Set five inputs: company size band, industry, current security maturity, regulatory pressure and annual budget.
- 2The model builds an org shape — budget split, functions sized in FTE, and roles with KPIs.
- 3Review the first-year hiring roadmap and adjust the budget to see the plan change.
- 4Export the plan as Markdown, the roster as CSV, and each role’s job description as Markdown.
Honest about what this is
- A fast, structured first draft of a security org you then tailor to reality.
- Useful for a new security leader, a board plan, or pressure-testing headcount and budget.
- ✕ Not a scan, benchmark, or audit of your current organisation — nothing connects to your systems.
FAQ
How should a cybersecurity team be structured?
Most security teams group work into a handful of functions under the CISO: governance, risk and compliance; security operations (detection and response); security engineering and architecture; identity and access; and application or product security, with some work bought in from managed services. How many people each function gets depends on company size, industry, regulation and maturity, which are the inputs this designer asks for.
What goes in a cybersecurity job description?
A useful one states the role's purpose, the function it sits in and who it reports to, the responsibilities, the skills and certifications that actually matter for the work, and the KPIs the person will be measured on. The designer generates one per role in your plan, as Markdown you can edit.
What does the Org Designer produce?
A greenfield security org built from five inputs — company size, industry, current maturity, regulatory pressure and annual security budget. It returns a budget split (people, tooling, managed services, training), the security functions with headcount per function, roles with KPIs, a first-year hiring roadmap, and downloadable job descriptions.
Is it based on my real environment?
No. It is a planning model, not a scan. You describe the company in a few fields and it generates a structured starting point — an org shape, budget allocation and JDs you then adapt. It does not connect to your systems or read live data.
What can I export?
The full plan as Markdown (budget allocation, functions, roles, KPIs, hiring roadmap), a roster as CSV, and per-role job descriptions in Markdown.
Is it free?
The interactive designer is part of a paid plan. Any PlayCISO plan unlocks it, along with the other security-architect studios.