Building High-Performing Security Teams in a Talent-Scarce Market

Security leaders across manufacturing, SaaS, and technology consulting all describe the same hiring environment: too few experienced candidates, too much competition for the ones who exist, and job descriptions that ask for a unicorn combination of skills no single person actually has. Building a strong team in that market takes a different approach than posting a role and waiting.

Stop hiring for the perfect résumé

The instinct when a role is hard to fill is to add more requirements to filter candidates, which makes an already-scarce pool smaller. What's worked better is separating "must be true on day one" from "can be built in the first six months." A strong generalist with real judgment and a track record of learning fast is often a better long-term bet than a narrow specialist who checks every box on the job description but has never had to operate under ambiguity.

Build depth through rotation, not just hiring

In every organization I've led security for, some of the strongest team members came from adjacent disciplines (infrastructure, software engineering, IT operations) rather than a traditional security background. Deliberately rotating people through different parts of the security function (GRC, operations, architecture) does two things: it builds a team that understands the whole picture instead of narrow silos, and it gives people a growth path that doesn't require leaving to get it, which matters enormously for retention in a market where competitors are actively recruiting your team.

What actually retains people in security

Autonomy with real accountability, not micromanagement dressed up as oversight. Security work involves enough ambiguity that people who are trusted to make judgment calls, and are supported when those calls turn out to be wrong in a reasonable way, grow faster and stay longer than people who have to escalate every decision.

Visible impact. Security teams often operate in the background, and it's easy for individual contributors to feel like their work disappears into a queue. Making sure the team sees how their work connects to outcomes (a successful audit, a prevented incident, a customer deal that closed because the security posture held up) matters more for morale than most leaders expect.

A genuine path to growth that doesn't require becoming a people manager. Not everyone wants to manage; a strong technical or architectural track that leads to real seniority and compensation without requiring management is one of the most underused retention tools in security organizations.

The manager's actual job

The biggest shift I've had to make personally, moving from individual contributor and technical roles into leading larger security functions, was accepting that my job stopped being "solve the hardest technical problem myself" and became "make sure the team has what it needs to solve it, and clear whatever is in the way." That's a harder transition than it sounds, especially for security leaders who came up as strong technical operators and take genuine pride in that skill.

Culture is what happens when you're not in the room

The strongest signal that a security team is actually high-performing isn't how it operates when the leader is present. It's whether good judgment, ownership, and collaboration with the rest of the business continue to show up when they're not. Building that takes longer than filling headcount, and it's the part of team-building that compounds the most over years, across every organization I've had the chance to lead.