35

During my performance reviews at the three companies I have worked for during my 15+ year career in information security, I have seen a consistent and concerning disconnect between the annual goals/OKRs I set and the work that demands my time every week/month. This consistently results in me not fully achieving the goals I set.

The problem could possibly be an unfortunate side effect of the demanding and dynamic nature of my field, but its frequency and consistency over time at more than one company indicates to me that the root cause might have more to do with my own work patterns.

If I were to give a reason for the failure, it would most often be "I couldn't balance the time required with all of my other commitments." Yet that seems contradictory if my goals are what my company is hiring me to do. This lack of "performance" has not hampered my promotion or stature within the companies. However, at every performance review, I find myself admitting that I could not achieve what I said I would, which is concerning. Conversely, while I provide a lot of valuable support to the company, my performance review does not directly benefit from that activity because it has little to do with my goals.

  • Is this phenomenon known to be common in the IT industry, or does this appear to be primarily a personal failing?

  • What biases do I appear to have, or incorrect assumptions am I making?

  • How can I stop this cycle?

Background:

All positions I've held have been "consultant" in nature, meaning that I'm tasked with ensuring 'cyber' security at my organization. While I've always had a manager/boss, they do not have a background in my field. I've almost always been given a lot of independence in my work. I set my own annual goals/OKRs, but I also need to align them with those of my team and company. The company clearly states that my goals should be a 1-year timeframe, should follow S.M.A.R.T. principles, and should add value in the long-term.

Thus, my annual goals/OKRs are ones that naturally require consistent effort over 6-12 months in order to accomplish. These goals are often somewhat lofty, but they are achievable assuming that I can make focused effort. That seems reasonable to me. However, at goal-setting time, I am often left with a sense of "I need to somehow carve out additional time for these goals", rather than "my other work fits in around these goals".

My teams have been very small, and during my career have ranged from "just me" to "less than three". Regardless of team size, work is always structured one-person-per-project with each person juggling multiple projects, so we are our own taskmaster.

I/we am the only one doing what I do within the company, and we are always understaffed for the required workload. I often find myself to be the only person who knows how to do what I do, so delegation isn't much of an option.

Management is reluctant to increase headcount, because my work is a cost center, not a revenue generator. I have never known the concept of "downtime" during my career. 20-40 hours of overtime per week is the norm, which I accept.

My daily work is a mixture of projects, and also sudden issues which are unrelated to the projects, yet are usually either important or urgent (usually both). As per concepts like the Eisenhower matrix, non-important/urgent tasks are avoided or deferred. Solving challenging, time-consuming problems is a daily activity.

Many of the urgent issues are either ones I receive from others, or ones that I unintentionally discover on my own. In both projects and sudden issues, a cascade often exists such that in order to solve problem Z, one must must first deal with problems Y, X, W, etc. This causes nearly all work I do to take longer than I estimate it will require.

Every few months, a sudden issue will balloon into a project which genuinely must be dealt with ASAP, so of course other work suffers. In my mind, it is not feasible to simply not do my day-to-day work in favor of focusing only on my goals; the day-to-day work is also part of my role and responsibilities in addition to the longer term projects that my goals are attached to, but the balance seems impossible.

I am generally regarded as a highly-knowledgable, capable, "go-to" member for difficult work. Multiple times, I have been offered manager-type positions, which I have usually declined due lacking the confidence that I can deliver what is required (especially because my current responsibilities wouldn't simply disappear).

From the outside, one might interpret that as my company's confidence in my ability, but I suspect that such offers were more likely due mistaking my technical skill for management savvy or a scarcity of other candidates at the time. Yet even if it were a reflection of my ability to get things done, then why am I consistently unable to achieve my goals? I feel like a walking contradiction.

13
  • 5
    Do you write your real goals or the one you are expected to have? Those often don't align - are you looking for help to align the goals, figure out if/how to make progress to stated goals or something else altogether? (Sample goals: stated/expected - "learn Python to improve my scripting skills", actual: "have high adrenaline level by solving one company-critical-time-sensitive problem a day") Mar 4, 2023 at 1:30
  • 3
    @JoeStrazzere It is well-known that 'not doing it properly' is the root cause of nearly every information security problem, yet 'doing it properly' is incredibly time-consuming and requires frequent updating over time. I actively and passively bite of more than I can chew, so there is definitely a snowball effect. In the last few years, I have found that simply doing organization/project management for all this work is becoming nearly as big of an effort as actually getting things done. Mar 4, 2023 at 4:21
  • 2
    @AlexeiLevenkov "Do you write your real goals or the one you are expected to have?" - Excellent question. I would categorize my annual goals as ones that I am expected to have. That is to say, they are important for company improvement in the long-term (2-5 years) and I truly believe that I should work on them, but I also feel that my existing work suffocates my ability to devote the time necessary to get the goals done. Mar 4, 2023 at 4:23
  • 4
    I'm confused. What sort of goals is your employer expecting you to write: career development goals in addition to your official/regular duties, or goals for your regular duties? If the latter, "I'm too busy successfully accomplishing my regular duties to fulfill the goals I have to successfully accomplish my regular duties" doesn't square. -- The disconnect in you writing goals to be an "extra" - versus what your employer is actually looking for in goals - may be part of the problem.
    – R.M.
    Mar 4, 2023 at 15:39
  • 2
    @Stef "Looks like you set your own annual goals, but then your daily and weekly time is busy with all the work prompted by your managers, coworkers, and other factors." - This is 99% correct. I would only add that admittedly I am also one of the people unearthing new Important&Urgent work which has previously remained unnoticed/unknown by others, but "needs to be done". So as others have kindly pointed out, there is clearly an ongoing problem regarding prioritization. Mar 5, 2023 at 11:55

11 Answers 11

68

why am I consistently unable to achieve my goals?

because the goals that were set in your review aren't your real goals, they were just things you and your manager made up because you were told to set some goals, or extra things you'd like to do in your spare time.

Examples I've seen are "deliver project X", and then it gets cancelled, or you're moved to another project, or something else out of your control prevents you from working on it.

If your day-to-day work is getting in the way of the goals, then either you're letting people distract you from what's really important, or the day-to-day work is actually more important and the goals were just nice-to-have things that can be delayed.

It sounds like your goals should be service-level things, like "respond to issues within a day" or "no more than x days down time per year", or even "track how much time is spent on unplanned work".

For someone doing mostly development, it could be "deliver sprint goals" or "complete sprint tasks".

4
  • 36
    well said man. annual employee goals are a joke. Day-to-Day fire fighting trumps any wishful goals employee and managers set. As a self-employed consultant for 20 years, my yearly goal and employee review is asking my wife ... are you happy? If the answer is yes, I have passed my yearly review.
    – Sam B
    Mar 5, 2023 at 17:57
  • 4
    @SamB - 30 years here, and I've never had a goal that made sense. Mar 6, 2023 at 11:12
  • 2
    With a reasonable manager, you can have reasonable - and relevant! - goals. I had 5 goals set for 2022 by my manager, of which I fully achieved 4 and nearly fully the fifth one (mainly due to misunderstanding of what the 5th entailed). The main point was that these goals were actually aligned with what I was expected to do. I then set goals for my team based on my own goals - and the majority of the team has achieve majority of the goals. Hence I disagree that goal-setting is a joke.
    – Aleks G
    Mar 6, 2023 at 16:37
  • 3
    Since 'Delivery project x' is probably a common goal people have issues with, it could easily be restructured to something like 'Hit x% of development benchmarks for project X' If the project is cancelled early on but you've already hit the initial benchmarks for data collection and sprint planning, well then you've hit your goal. Mar 6, 2023 at 18:27
43

The annual goals system was designed for when work in general was less nimble, and for folks whose assignments were less variable -- sales goals, defect rates, multi-year development cycles, other things that go with more traditional factory or "business" roles.

For many of us now, needs change during the year.

For a while, IBM tried to finesse this by saying that the annual goals sheet was a living document, and encouraging employees and managers to update it at quarterly progress meetings. Finally they admitted that wasn't working, and abandoned annual goals in favor of a really dynamic system of continuously rolling goals, added to and progress-updated (and closed out, when assigned tasks shifted) on as continuous a basis as the employee wanted to maintain them, and with each being flagged as relevant to a set of categories and management scoring (hopefully equally frequently) on those axes. I consider this a much more realistic reflection of how modern product development works, and probably a better match to many roles.

If you are still stuck with them, annual goals should avoid being overly specific, so they can remain valid through those changes... but you should trust/expect/hope that management will work with you at the end of the year to recognize what you've really been asked to do. You may want to schedule quarterly meetings to review not only your progress but the goals themselves, if your manager doesn't do so. Then be prepared to help wrestle your achievements into the straight-jacket of the goals so your manager can review you on your actual performance.

It's not a great system. It doesn't accomplish what it set out to accomplish. All you can do is learn how to cheat it into working well, until manglement agrees that it's time to do something else.

4
  • 1
    ^This ... So. Much. This. I would upvote again if I could ... Mar 3, 2023 at 17:35
  • 8
    @keshlam "...encouraging employees and managers to update it at quarterly progress meetings...You may want to schedule quarterly meetings to review not only your progress but the goals themselves" - My current company follows the quarterly meeting philosophy, however due to various reasons, those meetings unfortunately never seem to materialize. That said, I am currently blessed with a very understanding, flexible, and progressive manager who is open to goal realignment mid-flight. It appears I need to be much more proactive in this area, and drive this on my own since they are not doing so. Mar 4, 2023 at 6:47
  • 6
    @keshlam "[if annual goals,] you should trust/expect/hope that management will work with you at the end of the year to recognize what you've really been asked to do..." - I suspect that this is what has been happening all along, which is why my promotion track hasn't suffered. That is, I've been blessed with reasonable management who somehow pull hidden levers to avoid making my evaluations a complete train wreck (for both me and them). Mar 4, 2023 at 6:48
  • 3
    Most decent managers stuck with this system have learned how to get the right results out of it, just as most have learned how to handle the arguments about how promotions/raises are to be distributed when there is competition for those. A good manager protects his people, as best he can, because that's how they make him look good in return.
    – keshlam
    Mar 4, 2023 at 7:08
10

In my mind, it is not feasible to simply not do my day-to-day work in favor of focusing only on my goals; the day-to-day work is also part of my role and responsibilities in addition to the longer term projects that my goals are attached to, but the balance seems impossible.

You should raise this in your annual appraisal, using your previous experience as evidence.

If you are anything like me, you will tend to focus on the tasks that immediately need doing, in order to get your specific job done, while missing out on the strategic stuff that will grow me personally AND grow me as a contributor to the company. When I've raised this with my manager, I've been surprised that my manager is happy for me to do less of the regular work (or take less of it on), in order to work on the growth stuff. They understand that needs to happen, in order for them to get more out of me.

Of course, your manager may not appreciate how much work is involved and may just say "of course, you have the time", so you'll need to keep them updated when your real work gets in the way of your targets. "I wanted to spend 6 hours this month working on X, but we had that production issue. What should I work on boss?"

This way, when your next appraisal comes around you can have an honest conversation about why you didn't (or did!) hit the targets. Just leaving it until the annual review is never a good idea.

1
  • 4
    "tend to focus on the tasks that immediately need doing, in order to get your specific job done, while missing out on the strategic stuff that will grow me personally AND grow me as a contributor to the company." - This. Many times over. "when your next appraisal comes around you can have an honest conversation about why you didn't (or did!) hit the targets. Just leaving it until the annual review is never a good idea." - Very good suggestion. This hasn't been an option until now, but my current position does allow for this flexibility as long as I proactively drive the process. Mar 4, 2023 at 6:50
8

No, this is very common, and I think a lot of people are struggling with this. I also think how people deal with this challenge has a big impact on the level of success in IT careers.

OKR or Wildly Important Goals

You already mentioned the Eisenhower matrix and in my eyes this is exactly what OKRs are there to address: You end up doing the things that are urgent (e.g. bugs), but there is some things that are less urgent but more important (refactorings, to avoid future bugs).

OKRs help you to do the important tasks by artificially making them urgent, as they have to be done by the end of the period. This mechanism wasn't actually pointed out to me by any of the resources about OKRs I studied, but by the first part of the book "The four disciplines of execution". The book doesn't talk about OKRs at all, but it describes how to deal with "the whirlwind" of daily tasks (the urgent), and how to define "wildly important goals" to make sure the important things are getting done too.

When setting your OKRs, you should make sure to pick things that are truly more important than your daily urgent tasks and then start treating them with urgency.

Don't overestimate your own indispensability

It is an easy trap to think of oneself as indispensable and nothing of the really urgent things would not get done if one wouldn't be focussing on them right now. It is easy to think that a security issue or a user facing bug needs to be adressed as soon as possible, since this is the professional thing to do.

If you are falling into this trap, you not only neglect your companies long term goals, but you also are doing a disservice to you own career, since operational day-to-day work usually is regarded of lesser value than strategical work: Most of the highly paid positions are strategical, rather than operational or tactical.

Thinking about how the company saw me helped me to overcome this issue: Is the company regarding you as the linchpin of the organisation without whom nothing would be working?

Is the company worried that you might be quitting and your resignation would throw the business in despair, because nobody is taken of all these surgent. I guess the answer is 'no'.

To management you are probably another worker that can be replaced. If you would get sick or be on leave things would be picked up by someone else or would have to wait until a replacement has been found. If two or three urgent tasks would pop-up at the same time, would you clone yourself to get them done? No, two of them have to wait until the most urgent one is fixed. You need to let go of the urgency of these tasks and be willing to let them wait. If you get challenged by your manager, you use your OKRs as a shield: You both agreed that your OKRs are urgent and need to done this period, so it should be understood that you have time to work on them.

What if my urgent tasks are truly more important too?

First of all, double and triple check: Are they truly more important.

If so, you probably should set better OKRs. If you are drowning in bugs or security issues or other "whirlwind" stuff, then your OKRs should be solely focus on reducing these and make more time for other things. If your OKRs are addressing your workload, then they should be considered more important than any short-term fix. If they aren't then find OKRs that do.

1
  • In my experience, the big problem with annual goals of this type is that "a year in advance" is an absolutely terrible cadence to be deciding on how much long-term strategic stuff is appropriate to try to do.
    – Ben
    Mar 6, 2023 at 7:21
4

If you're not meeting the goals you yourself set then you are setting unrealistic goals or you are not committed to realising them. You need to factor in the dynamic nature of your work and everything else.

I factor in everything I can think of and then double it for a generous margin to cover everything I didn't think of.

2
  • One technique for estimating time was to take the initial effort estimate, double it, and raise it to the next time interval. A one-day effort estimate becomes a two-week project. That often results in a more accurate estimate.
    – David R
    Mar 4, 2023 at 15:21
  • Alternatively, you make a guess, and then double it. The knack is knowing how many times to double it… (I've seen that one attributed to Roger Moore, though I've no idea who really said it first.)
    – gidds
    Mar 4, 2023 at 16:44
3

Work in IT and software engineering is becoming much more dynamic and fluid than in the past. Short cycle agile sprints have replaced multi-year waterfall plans. The new technologies and risk exposures are changing much faster. This makes it much harder to plan for the year.

Annual goals don't have to be year long goals. See if you can break them down into better time managed chunks. Break goal X into goals A, B, C & D. Much easier then to explain how you completed goals A, B & C, but the surprise project from some other department de-railed goal D. Now you have succeeded in 3 of 4 smaller goals instead of failing one big goal.

Over the years, you have probably developed a feel for how many surprise security risk situations occur across the year. Based on that create a goal to cover those surprises, "Handle newly disclosed CVEs to mitigate impact on the organization". You now have a goal that represents a loosely known amount of time that will be taken up for you across the year.

Most importantly, you and your manager need to be on the same page with understanding the fluidity of your work and how to handle changing priorities. Very few people in the field successfully achieve all of their goals, not because of inability to do the work but because of priority interruptions which take them off plan. The annual evaluation discussion is a great time to remind your manager of all of the things you took care of that noone expected.

6
  • 1
    "See if you can break them down into better time managed chunks. Break goal X into goals A, B, C & D." - This is a good idea, but unfortunately does not fit well into our current goal-setting framework (which limits how many goals I can set, each of which need to be different topics). However, your suggestion would be possible with a higher goal-setting cadence. Mar 4, 2023 at 6:51
  • 2
    "Most importantly, you and your manager need to be on the same page with understanding the fluidity of your work and how to handle changing priorities." - Fully agreed. I suspect that this (frequently-occurring) misalignment is a key root cause. Mar 4, 2023 at 6:52
  • 2
    "Based on that create a goal to cover those surprises" - Ah, THIS points to the larger disconnect/misalignment. My management doesn't want my goals to focus on day-to-day 'fire fighting', even although that's also my job; they want the goals to focus on initiatives that provide long-term value. So, instead of "mitigate (CVE) impact", they want "initiative XYZ to greatly reduce the impact in the first place". I agree that both are incredibly important, but I would argue that you cannot focus on preventing the fire while it's already smoldering/burning right next to you. Mar 4, 2023 at 6:53
  • 2
    @BeshrewableProtractor What you describe is a situation where management does not know all the issues. Part of your job then, is to document all the fire fights and then, propose solutions to reduce the impact. One suggestion would be to go back over the last two years and document all the surprises. That can give a sense of the real scope of the problems you face.
    – David R
    Mar 4, 2023 at 15:23
  • 1
    Goals don't need to focus on day-to-day fire-fighting but having a goal around system stability or similar with a description that describes what it takes to keep the system up would be a valuable way to acknowledge that effort. My team builds and supports software infrastructure used by other teams in the company. I often remind my team that one of the most valuable things we can say about our systems is "it just works". It may not be a flashy accomplishment, but when other teams depend on your stuff, that is huge( and should be recognized by your managers)
    – cdkMoose
    Mar 6, 2023 at 15:03
2

What should OKRs cover?

From practitioners, I've heard that there are really two kinds of tasks in most companies, the OKRs and "run the business" line operations. Both are vital, but OKRs are what grabs the management attention, while "run the business" only comes to their attention when it does not run. Often the split is 30/70 or even more in favor of "run the business." This might be different in a startup company.

So a good company acknowledges that OKR are important, but not to the exclusion of other activities.

How should OKRs be scaled?

A healthy OKR process sets almost unreachable KR as "stretch" goals or "moonshot" goals. It also acknowledges that reaching them is not usually going to happen, and does not penalize people for failing to reach a "moonshot."

So the expected performance, from a good employee in an average year, is to cover the basics and some of the OKR goals.

2

I would like to respond specifically to the setting expectations/goals aspect.

I like to use the SMART model to set obtainable goals for myself.

  • Specific (simple, sensible, significant).
  • Measurable (meaningful, motivating).
  • Achievable (agreed, attainable).
  • Relevant (reasonable, realistic and resourced, results-based).
  • Time bound (time-based, time limited, time/cost limited, timely, time-sensitive).

source

Some times you may feel pressure to accept a goal that does not fall within these bounds. In those cases, you have to be pragmatic and challenge the person (even a manager, but in a polite way) because setting an unobtainable goal is not in anyone's best interest.

If you want to change something big (like making a monolithic software solution testable) set up an obtainable goal e.g. "every time we change a function or add new functionality code coverage should be 100% on the affected code" instead of "we need to write testcases on all our software". In time, the vital parts of the system (the ones being changed/added/used often) will have test coverage, but the overall goal is too big to be attained within reasonable timeframes.

1

The purpose of a system is what it does

is a saying from the field of "cybernetics" (today "systems engineering"). The opposing idea is that the purpose of a system is what its designers said it was supposed to do. If a system was not fulfilling its purpose, its designers would change it, and on the other hand, system designers are often incentivised to lie in their public statements, consciously or not, so maybe those shouldn't be trusted so much.

These performance reviews are filling you with a sense of failure and concern because you did not achieve your goals, and making you feel like you might need to commit more time to the company so you can do more work.

That's the point.

Why? Employees who feel like their performance is unsatisfactory are less likely to demand promotions or bonuses or raises. Employees who feel like they need more time are more likely to work overtime and if they also feel their performance is unsatisfactory, they believe it's their fault and don't demand to be paid for the overtime. So the company gets more work for free.

It isn't just your industry. At many delivery companies, delivery drivers pee in bottles while driving so they can do more deliveries in a day (source). No manager told them to do that; they just gave them impossibly high goals and told the drivers to figure it out themselves. When the media discovered the practice and the criticism came rolling in, the managers denied having anything to do with it - all they did was set KPI targets, after all.

4
  • 1
    That depends.. badly set goals and then missing them in the consequence leads also to a demotivating situation (actually what OP has described..). I have seen enough people giving up first, and then just leaving after a while. That can hardly be in the company's interest
    – Apfelsaft
    Mar 7, 2023 at 5:22
  • That may be true in some companies but by no means all.
    – deep64blue
    Mar 7, 2023 at 23:23
  • @CarlBerger you ever noticed how much the top levels of the economy are performative rather than substantive? Elon Musk is our recent example - he can't run a business out of a paper bag. Or Donald Trump, with his bankrupt casinos. As long as they look and act like they're rich, they somehow... magically... are? So, perhaps demotivating people like the OP so they quit is also an intention. Perhaps they are looking to retain the type of people who won't quit under these circumstances.
    – user253751
    Apr 5, 2023 at 19:48
  • @CarlBerger upon revisiting, my previous comment reminds me of The Gervais Principle, a pop sociological-economic theory which divides employees into three types: the "sociopaths" at the top, the "clueless" who think ass-kissing will get them more pay, and the "losers" who realize this is silly and just want a paycheck (who are mostly at the bottom, but can in rare cases be promoted directly to sociopath. Clueless are never promoted to sociopath).
    – user253751
    May 4, 2023 at 21:01
1

However, at goal-setting time, I am often left with a sense of "I need to somehow carve out additional time for these goals", rather than "my other work fits in around these goals".

Neither of these are correct, your goals should reflect what your Manager expects you to do day by day with perhaps one or two "stretch" goals you may stuggle to achieve! It's always difficult to estimate how long things will take so build that into your goals. It sounds like you work in an operational area so your goals could be something like:-

  1. Respond to all requests for support within X hours. [NB: Respond means an initial response not the fix unless it's straightfoward.]
  2. Resolve 75% of requests within +/-1 day of estimate.
  3. Support Y projects to a succesful conclusion during the year.

These are examples to get you into the mindset of aligning your goals to what your Manager actually wants you to work on.

1

From your comment:

Low headcount means I do everything from corporate culture changes, policy decision and writing, compliance, user training, solution deployment and management, and alert triage/investigation...to hands-on-keyboard threat mitigation, and incident handling.

You are working pieces of half a dozen different jobs

Based on my time in infosec, each of these tasks fall under a different job title. Each of those positions has a reasonable way of setting and measuring goals, but you find yourself in a position where you are tossed among them wildly.

Each of those individual jobs does have a set of rational goals

When developing information security policy at a project level, there are straightforward goals around developing required documentation, remediating system deficiencies within reasonable periods of time and developing and following regular schedules for reviewing and updating the associated artifacts. For SOC/NOC activities, I would expect there to be more Service Level Agreement (SLA) goals you might aim for. If you're responsible for designing and implementing a security architecture, I could imagine that goals could be set around a high level plan that lays out all of the security controls to be addressed.

But since you don't do any single one of those jobs, it's hard to say what goals are "yours"

It's possible you enjoy the ninja/hired-gun task assignments you currently deal with. If so, then I think you work at the pleasure of a company and boss who appreciate your effort, and it would be good to speak with them candidly about the difficulty you are having in developing realistic goals, and about how they would like to measure your effectiveness.

If instead you are interested in more stability and predictability that you could set actual goals around, I think you might consider speaking with your company about formalizing information security roles. You'd probably have to take on a more managerial role, but you could delegate work along the boundaries of standard infosec positions, and then your goals would be aligned for the single position you assume.

I propose, if you don't like the current arrangement, that you try and start a formal information security program

I hear you about infosec being treated as a "cost center", and about the limited team size. However, you might propose to your management that they take a more structured approach to infosec:

  1. Information security is a cost center, but it's a cost better paid carefully and incrementally over the lifetime of projects rather than trying to bolt security on after the fact, or worse yet suffer a catastrophic security incident. Having ninjas is textbook bus factor.
  2. The cost per project can potentially be lowered by de-duplicating effort. Information security requirements have day to day needs, but most of the big deliverables come and go as peaks and valleys of effort. If (and it's a big "if") the projects can coordinate their schedules, then it's possible to have all of you pile on to address the large deliverables based on need. Additionally, pieces of ongoing maintenance can often be automated, and several infosec personnel working together can accomplish a lot more than if they have to reinvent the wheel for their own projects.
  3. If the infosec personnel can be consolidated as above, then rather than having several do-it-all guys, you could have (for example), a senior Information System Security Officer (ISSO), an ISSO and a Information System Security Engineer (ISSE), or some other combination of roles as appropriate. This would make hiring way easier since you don't need all of the skillsets all the time.

If you can make that pitch, I think you could initially have goals around standing up the information security program from scratch, and subsequently have goals around the individual role you take on.

This kind of turned into a ramble, but I hope something in there is useful for you, or perhaps useful to future answerers trying to grok your situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .