CAREER LONGEVITY & THE DON'T FIRE ME CHART

Summary from the TLDR InfoSec newsletter

A common metric of security program success is how much leadership is prepared to stick with the work over the long term. Security work tends to follow a cycle in which security issues are increasing so the company hires a security engineer to fix them, the engineer begins fixing the low hanging fruit and the number of issues declines, the engineer digs deeper and implements more logging, monitoring, etc and discovers more issues, management wonders why the issues have increased and fires the engineer. This can be mitigated by communicating that the situation will get worse in the short-term before it gets better in the long-term.