ronutz

The Roles · Who defends it

Security manager

Written from published sources

The first rung of the management arm, in security. A security manager runs the people who do the analysis, the response and the assessment: hiring them, developing them, staffing the rota, and turning a leader's direction into work that fits in a week. It is the rung where a career stops being about your own output and starts being about somebody else's.

What the day looks like

  • Staffing: the rota, the on-call, and the arithmetic of covering a queue that runs at all hours.
  • Developing people, which is the part that compounds and the part most easily postponed.
  • Turning strategy into a backlog somebody can actually work through.
  • Standing between the team and the interruptions, so that the analysis has room to happen.
  • Reporting upward in the terms the tier above uses, and downward in the terms the team uses.

What it answers for

  • The team producing the outcome, with the people in it still there next year.
  • Coverage: the rota being genuinely staffed rather than nominally filled.
  • The accuracy of what is reported upward, including the parts that reflect on the management.

What it is measured on

  • Team outcomes: detection, response, assessment coverage.
  • Retention and time to fill a vacancy.
  • Delivery against the programme the tier above set.

Who it receives from

The security leader
Direction, budget and the risks the organisation has decided to prioritise.
The team
What is actually happening in the queue, which arrives filtered by how safe it feels to say.
Human resources and recruitment
The market reality behind every hiring plan.

Who it serves

The analysts and responders
Room to do the work, and a career with somewhere to go.
The security leader
Execution, and an accurate picture of capacity.
The organisation
A function that runs at three in the morning as well as at ten.

Who else has a stake

  • The families of everybody on a rota, which is a real stakeholder in a role built on shift work.
  • The teams whose incidents this one handles.
  • Finance, for whom headcount is the largest line in the programme.

What it takes

  • Technical credibility, because a team that has to explain its work upward twice starts editing it.
  • Care taken deliberately, since burnout in this function is an operational risk and shows up as attrition.
  • The willingness to hold a boundary against work the team has no capacity for.
  • Honesty upward about capacity, which is the same skill the project manager needs and costs the same to use.

What the job turns on

This is the rung the Y moment leads to, and the trade is immediate: the day fills with other people's work and the technical depth that earned the promotion begins to age from the first week. Managers who thrive decide early what they are keeping current and what they are letting go, and say so — because the alternative is a slow drift in which the team stops asking and the manager stops being able to answer.

The published sources

Where it leads

Roles that lead here

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

Read The Practice