Starting a new role in cybersecurity leadership comes with a unique set of challenges. As a seasoned practitioner who has built multiple security programs across diverse firms and industries, I understand the pressure to quickly grasp the current security posture, reduce risk, build credibility, and set the organization up for its next phase of maturity. Based on this experience, these are the things I would do if I had to prioritize limited resources during the first 180-days of leading a security function. I had an idea to write this after seeing many individuals looking for guidance continually ask this type of question as this can be one of the most overwhelming experiences during a career.
This list was incredibly difficult to conjure as there are so many areas that one can focus on. Every organization is different and it is important to ensure you quickly understand the landscape you are in rather than following a checklist like this. It is not possible to define a perfect list for every situation. With that said, this is where my head would be at on focus areas and roughly in the order of priority that I would seek to quickly understand and address.
As an additional comment – If you find yourself in this position of taking on an important new role, I highly recommend reading The First 90 Days by Michael D. Watkins. I highly recommend every new leader entering a senior position or receiving a significant promotion to create a 90-day plan to hold themself accountable and outline exactly what they will do in their new role. Feel free to use this as a guide for some of those focus areas.
1. Budget & Staffing
Your first and most important job is securing the right people and the right funding. All other efforts depend on having resources to support them. Before making commitments, you need a clear understanding of your current budget, how funds are allocated, and where gaps exist. This also means partnering with finance early to align security spend with business priorities.
What it includes:
- Reviewing existing security budget and spend allocations;
- Staffing levels and org structure;
- Defined roles and responsibilities;
- Resource allocation for technology, services, and external partners; and
- Training and development plans for team and broader organization.
Why it matters: Security is ultimately a human-driven effort. You can’t succeed with insufficient headcount, ill-defined responsibilities, undertrained staff, underfunded initiatives, or mismatched spend. Early visibility into your financial landscape helps you rationalize existing costs, identify funding needs, and advocate effectively for additional investment. At the same time, investing in your team’s growth (through paths like Institute for Applied Network Security (IANS), Blue Team Con, or American Management Association (AMA)) builds retention and capability.
2. Documentation & Governance
When stepping into a new cybersecurity leadership role, the first task isn’t rolling out new tools – it’s gaining clarity. That starts with documentation. You need to understand what’s in place, what’s missing, and where the organization stands from a risk and compliance standpoint.
What it includes:
- Risk register;
- Regulatory/compliance posture;
- Security roadmap;
- Process standardization;
- Technology and service rationalization (to those risks, regulations, and compliance); and
- Business continuity elements (e.g., disaster recovery).
Why it matters: Documentation creates transparency, consistency, and accountability. Without it, you’re flying blind. You are reacting to issues rather than steering the organization proactively. Governance ensures decisions are made deliberately, risks are tracked, and processes are repeatable. This builds the foundation for regulatory compliance, board reporting, and audit readiness. It also helps break down silos and gives new team members a map to follow, strengthening resilience as your team grows or changes.
3. SOC Transformation (Even if MSSP)
The Security Operations Center (SOC) is your eyes and ears. But many teams struggle under alert fatigue, unclear workflows, or Managed Security Service Providers (MSSP) who lack context. Transforming this function is key to enabling proactive detection and rapid response.
What it includes:
- Tuning detection logic and alert thresholds;
- Improving triage processes and Service Level Agreements (SLA);
- Clarifying escalation workflows and RACI models; and
- Deciding whether to build, buy, or augment SOC capabilities.
Why it matters: Your SOC defines how well you detect and respond to threats. A noisy or inefficient SOC burns out teams and lets true risks slip through. Transforming your SOC improves detection fidelity, speeds up response times, and ensures that every alert means something. This isn’t just about technology; It is about building workflows, playbooks, and relationships that allow rapid containment and recovery. A strong SOC also demonstrates to executives and regulators that your organization takes detection and response seriously.
4. Identity & Access Modernization
Identity and access controls are the gatekeepers of your environment. If these aren’t tight, everything else you build on top is vulnerable. This area often reveals some of the deepest legacy technology debt and the biggest opportunities for risk reduction.
What it includes:
- Identity Provider (IdP) strategy and consolidation;
- Multi-Factor Authentication (MFA) rollout;
- Single Sign-On (SSO) enablement; and
- Active Directory and Entra ID (if applicable) audit (via Microsoft Risk Assessment Program (RAP) or Trimarc).
Why it matters: Identity is the new perimeter (woo, I said it!). Weak controls lead to privilege escalation, lateral movement, and undetected persistence. Modernizing identity reduces these risks while simplifying user experience, streamlining audits, and supporting a Zero Trust Architecture (the non-marketing way). It also helps close gaps that attackers increasingly exploit in cloud and hybrid environments, such as abandoned accounts, stale service principals, and inconsistent MFA coverage.
5. Posture Assessments
Understanding your environment’s exposure is essential before making big changes. Posture assessments help you quantify risk, prioritize work, and communicate gaps to stakeholders in a language they understand.
What it includes:
- Vulnerability management program evaluation (people, process, and technology);
- Cloud security posture assessment (misconfigurations, IAM, unused services); and
- Asset inventory and exposure review.
Why it matters: Posture assessments help you see your environment as an attacker would. They uncover legacy technical debt, dangerous misconfigurations, and gaps between policy and reality. These assessments give you a risk-driven roadmap for remediation, help justify funding, and provide evidence that security investments are focused where they matter most. In cloud environments especially, posture reviews surface issues that traditional controls miss.
6. Email Security
Email is still the #1 vector for attacks. This spans from phishing to malware to impersonation. Even with training, people click. Strengthening email defenses is a quick win that significantly reduces risk. Many companies skip over the basics here or let these risks linger for way longer than is necessary or appetizing. There are many quick wins achievable here.
What it includes:
- Email gateway effectiveness review;
- Phishing detection and prevention controls; and
- SPF/DKIM/DMARC implementation and validation.
Why it matters: Email remains the primary attack vector for phishing, ransomware, and Business Email Compromise (BEC). Strengthening email security not only reduces risk but also reduces noise resulting in fewer alerts, fewer incidents, and less end-user confusion. Implementing SPF/DKIM/DMARC protects your domain’s reputation, prevents impersonation, and improves trust in your communications. Strong email controls are a fast, high-value win that reduces the burden on your SOC.
7. Firewall Configuration & Network Segmentation Audit
Firewalls and segmentation are often the last line of defense. Yet, in many organizations, they’ve been running untouched for years. They are often full of outdated, shadow, or overly permissive rules. Fixing this early pays dividends. It must be understood that these areas can take significant time investment. This is why it is important to start addressing early on to best control the long-tail this often takes.
What it includes:
- Firewall rule review;
- Elimination of shadow and legacy rules;
- Network segmentation validation; and
- Egress control policies (please, get to default deny!).
Why it matters: Firewalls and segmentation are critical barriers to contain threats. But over time, rulesets become bloated and ineffective, creating invisible gaps attackers can exploit. A thorough review closes these gaps, eliminates legacy risk debt, and reinforces least privilege. This not only strengthens your defense but also supports regulatory compliance and readiness for more advanced segmentation strategies like microsegmentation.
8. Application Security Review
Applications, for many organizations, represent the crown jewels. Flaws here can lead to devastating breaches. Early reviews help expose technical debt and misconfigurations before attackers find them.
What it includes:
- Evaluation of critical internal and customer-facing applications;
- Secure development practices (e.g., Software Development Lifecycle (SDLC), threat modeling, Static Application Security Testing (SAST) / Dynamic Application Security Testing (DAST);
- Access and data handling reviews; and
- Dependency and library management (*cough*Software Bill of Materials (SBOM)*cough*).
Why it matters: Applications house your most critical data and processes, and they’re often under-protected. Weak application security exposes you to breaches, compliance violations, and reputational damage. Early reviews help surface security gaps in design, code, and operations, and create opportunities to embed security into the development lifecycle. This shifts security left, reduces future technical debt, and builds better partnerships between security and development teams.
9. Log Strategy & Detection Engineering
You can’t defend what you can’t see. But more logs don’t automatically mean better visibility. The key is having the right logs, sent to the right place, analyzed the right way.
What it includes:
- Evaluation of logging pipelines (e.g., Abstract, Cribl);
- Identification of critical data sources and gaps;
- MITRE ATT&CK alignment; and
- Development of custom detections.
Why it matters: Without the right logs and detections, your ability to spot and stop attacks is limited. A strong logging strategy ensures you collect what matters, where it matters, and that your SOC can act on it. Detection engineering turns raw data into actionable insight thereby reducing false positives, improving attacker detection, and enabling better investigations. This work is foundational for any effective monitoring, threat hunting, and incident response effort.
10. Third-Party Risk Management
Vendors and partners often have deep hooks into your systems and yet they’re rarely scrutinized. Establishing a lightweight, repeatable process for evaluating and monitoring them is essential.
What it includes:
- Vendor inventory and classification;
- Lightweight risk assessment framework;
- Onboarding and offboarding process alignment;
- Architecture patterns/standards for third-parties; and
- SLA and contract review for security clauses.
Why it matters: Your risk doesn’t stop at your walls. Vendors and partners often have deep hooks into your systems, yet they are rarely scrutinized with the same rigor as internal systems. Establishing a lightweight, repeatable process for evaluating and monitoring them is essential to ensure they do not introduce unacceptable risk. This area often sparks debate, as many question its realistic benefits or fear it becomes overly burdensome. That’s why it is important not to try to boil the ocean. Focus on doing enough to quickly assess high-risk vendors, prioritize those that matter most, and let contracts, legal frameworks, and ongoing business processes manage the remainder. This approach balances risk reduction with operational practicality while still demonstrating due diligence to customers, boards, and regulators.
Phase 2 or Swappables
As mentioned in the beginning of this post…not every organization will have the same priorities, and sometimes business context or risk profile demands a different focus. This section represents those initiatives that can follow the initial Top 10 or be swapped into the Top 10 if your environment calls for it. These ideas help extend or adapt your security program beyond the core, or provide edge-case additions for very mature organizations or those operating in high-risk sectors. The only others worth debating in a “Top 10” might be those that directly address unique threats, regulatory pressures, or organizational imperatives. This list is designed to jumpstart ideas for what could come next or where you might pivot based on your specific situation.
Data Classification & DLP Foundations
Data classification and Data Loss Prevention (DLP) are essential to protecting sensitive information. Without clear data handling rules, it is impossible to consistently secure critical assets or comply with regulations. Building a data classification scheme and laying DLP foundations help you understand where your data lives, who accesses it, and how it flows. This reduces accidental leaks, simplifies incident response, and strengthens compliance. It also sets the stage for more advanced controls like encryption, data rights management, and secure collaboration tools.
Insider Threat
Insider threat programs address the risk that comes from trusted users (whether through negligence, coercion, or malicious intent). As organizations digitize and distribute workforces, the risk of insider threats grows. Establishing a program focused on monitoring, awareness, and response helps reduce this risk without creating a culture of mistrust. It also positions security as a partner to Human Resources (HR), legal, and compliance in protecting both employees and critical assets. If you are coming into an organization that is more mature, you will often find that external controls are working well, and your greatest risks may come from within. This makes insider threat programs an essential next-level focus for organizations that have already built strong defenses against external attacks.
Final Thoughts
The first 180 days are about setting tone and direction. These ten focus areas represent a blend of foundational hygiene and strategic enablement. They are not just about tightening controls but building credibility, improving decision-making, and positioning security as a business partner.
Tailor these efforts to your organization’s size, risk profile, and culture. Use this list as a starting point, but customize based on your unique environment, business objectives, and threat landscape. The goal is not to boil the ocean in six months, but to create visible, meaningful progress that builds trust with leadership, engages teams, and reduces tangible risk. Prioritizing these areas thoughtfully can help avoid reactive firefighting and instead set the stage for a security program that is proactive, resilient, and aligned with business goals.
The first 180 days are your chance to establish credibility and show that security is not just a cost center, but a business enabler. Make the most of it!
Credit to Chris Camacho, Co-Founder and COO of Abstract Security, for his assistance in editing this article for me and helping promote it. See Abstract’s summarized post here: 10 Cybersecurity Focus Areas That Actually Move the Needle
I did partially use ChatGPT for this blog post as a test to see how well it could help, but it did not write this post.