0

I work in the information security team at my company in a senior role. I have been asked by my manager to coach / train new and more junior members of the team.

A somewhat common occurrence I have seen is that these junior team members are often very keen to suggest changes to procedures / processes / security architecture etc. Security is a delicate operation in which risk and end users needs must be balanced. It is a constant exercise of risk management, as benefits of security controls must be balanced against potential side effects.

Very often, more junior team members are somewhat overly - excited to begin security remediation / architectural / policy changes without what I feel is adequate consideration of end user needs / risk management / future needs. I would hate to architect a solution only to have it be temporary and short lived.

What can I do to train other team members to temper their enthusiasms with out shutting down feedback for needed changes?

2

Part of being a mentor is to put yourself in their shoes. If you had thought of this idea, what would you do to validate it is viable to yourself and to others?

If you want to encourage these ideas, you can invite them to have sessions, maybe just between the junior members to work together to consider these factors. Maybe take the most promising of ideas, and ask them to prepare a report on the suggested change, or present it to you or manager.

You don't want to temper their enthusiasm, you just want them to start considering the factors you identifed. Some of these considerations will take time and experience to be at the forefront of their mind.

At some point, they will have to realise that change does happen slowly, and often driven by risk, and while there is usually the "proper" way of doing things, reality is often a different story.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.