Building the team behind audit-ready security.

The situation

Security delivery and audit readiness meet in the controls an organisation actually operates. In a global IT services environment, I led a security R&D and deployment team of 24. The team’s scope included identity and access management, endpoint detection and response, software-defined perimeter, honeypots and privileged access management.

The decision

I approached assurance as part of security delivery. The controls need to serve an operational purpose, while the organisation needs to explain what they do and how they support its obligations. Keeping those concerns connected makes the technical work relevant to both operators and reviewers.

Making it work

The team combined research and deployment across a broad set of security capabilities. Leading that work meant connecting technical decisions to the organisation’s assurance needs while retaining a practical focus on implementation. The range of controls required a view across identity, endpoints, access boundaries and detection.

The result

The organisation passed audits covering ISO 27k, PCI DSS, ISAE 3402 and GDPR. The 24-person security R&D and deployment team supported that wider organisational effort through its work across identity, endpoints, access boundaries and detection.

What I took forward

Useful assurance starts with controls that have a clear purpose. A team should be able to explain the protection it provides and connect that explanation to evidence. That relationship makes audit readiness an ongoing property of the work rather than a description written only when a review approaches.