I recently joined a healthcare institution of about 5000 employees as an Information Security Officer (my boss being CIO) and have encountered several situations that have led me to question the workplace culture and management practices. I have no direct line to the CEO or board, and the CIO and CEO are best friends. All coms to the board need to go through the CIO. I'm hoping to gain some perspective on whether these are typical challenges or an indication of a deeper, more systemic issue.

  • Since my first day, the low morale among team members was evident, with remarks like "good luck with your job, you're going to need it." There seems to be a disconnect between the organization's claims of valuing transparency and the actual communication practices observed.
  • The IT department has experienced significant turnover, with the interim head, a former school friend of the CEO, having been made permanent. This has led to mixed reactions within the team.
  • My role is pivotal for steering the organisation towards compliance with new regulations (ISO27K, NIS2). However, there's a persistent push from leadership to prioritise operational tasks over strategic compliance efforts, undermining the effectiveness of our security posture. For example, asset management is not seen as a priority and will only be picked up in 8 months from now, way to late for achieving our compliance target.
  • Despite the size of our organization (5,000 employees), support for our security and compliance efforts is minimal. After highlighting the need for more manpower, the solution was to allocate only two existing employees part-time, which is vastly insufficient for my line of work.
  • Weekly management meetings are inefficient, often extending well beyond their scheduled time with little progress. Discussions tend to get derailed by minor technical details, preventing strategic issues from being adequately addressed.
  • A recent project highlighted severe communication breakdowns between the application and infrastructure teams. My suggestion to implement an Architecture Review Board (ARB) was dismissed in favor of less formal communications, which I believe hampers project management effectiveness.
  • In a meeting attended by 20 staff members, our interim manager discussed his own contract issues openly, revealing he worked without a contract for three months due to its high value, which required additional procurement controls. This discussion was both inappropriate for the setting and indicative of a culture that may overly focus on monetary values at the expense of professional integrity.
  • There was a troubling incident where it became known that management was considering firing a service desk manager by setting him up to fail. This was to be achieved by assigning him impossible tasks and, during a restructuring, subtly redefining his role to force him to reapply, potentially disqualifying him under new criteria.
  • I'm worried that scrutiny of failing to comply to the regulations might result in me getting fired.

Given these points, I am increasingly concerned about the potential toxicity of this work environment. I would greatly appreciate some insights or advice on how to best navigate these issues…

Thank you for your help!

  • 4
    This sounds more like a (well written) rant than a question. For a company of that size and makeup you will not be able to affect any significant change. So your choices are simple: make your peace with it or move on. It's a bad situation and the best thing to can learn is how to adjust your interview process to avoid a recurrence.
    – Hilmar
    Commented Apr 20 at 13:43
  • 2
    Oh no an imperfect workplace that won’t do things the way you want, whatever to do?
    – mxyzplk
    Commented Apr 20 at 14:57
  • 1
    Recommend rewriting the post to include one or a couple focused questions. Currently the narrative feels 'kitchen sink' with no specific issue or question identified for feedback.
    – A.S
    Commented Apr 20 at 15:00
  • 3
    @mxyzplk can't you say it a bit nicer trying to make your point? Just because we're anon, don't mean we should say something that we wouldn't say to a stranger's face.
    – DogBoy37
    Commented Apr 20 at 15:18
  • Do you work for UnitedHealth?
    – Johnny
    Commented May 19 at 14:09

4 Answers 4


Hero or Zero - with a deadline for compliance, those are your two outcomes with this company.

If your question was just a rant, so be it. If your question is a question looking for a path forward, then are you up to a challenge?

Of course running the business day-to-day has to take priority. But it isn't 99% to 1% balance. They can walk AND chew gum at the same time. They just never had to do it before.

If you are up to the challege:

Create a project plan with milestones and deadlines for getting compliant. Make KISS deck from it. Suggestion - Build in room for slipped deadlines, but don't make it too obvious.

Request a meeting with CIO/CLO/CEO and other C-level interested parties. Present it with the costs in time, money, vendors and manpower needed. Include that compliance is important enough to have weekly or every 2 week meetings with the CEO/CLO, etc. (15 to 30mins) to review status.

Tell them when you need to start to meet the compliance.

If they don't back you - you have your answer.

If you can't fix the problem, do you want it tarnishing your resume?

Being worried about being fired isn't for managers. That is distracting and adds no value to building your career. If this company isn't worthy of you, consider not letting them drain you and moving on.

If you pull it off it will take a lot of work because you are forcing a culture change. But that is part of the reason for requiring CEO/CLO status meetings. Hammer home that compliance is important and you work with serious people on serious subjects. Ask any Ransomewared company if this is serious business. Healthcare compliance is serious business.

When drama drastically outpaces accomplishments that is a reasonable sign you time is being wasted - IMHO.


Given these points, I am increasingly concerned about the potential toxicity of this work environment.

I don't see anything I would catgorize as "toxic". More like "not what you were hoping for".

I would greatly appreciate some insights or advice on how to best navigate these issues.

I would suggest you start by talking to your boss. Share your concerns.

And if you conclude that this is not the kind of environment you want, find a new job and leave this one. Next time, make sure to ask questions during the interview process that will allow you some insight into the environment before you accept an offer.


From what I read from your post, there are some inefficiencies but not sure what you mean by potential toxicity.

There are always some inefficiencies in every organization. Some groups will be more "dysfunctional" more than other within the same organization. I have seen it in many big companies I have worked for and wondered how do such a big org has not figured this out. However, at the end you will navigate your way around and find meaningful career. May be in the process even help improve some processes and culture.

My point being do not solely rely on what you heard and also what you experienced in few days/months. Do the best in your role you can. If you think some process is not right, fix it.

Of course if you feel the culture is truly toxic as in your team and your leaders are not there to support you and instead want you to fail, then clearly you have no other choice than to leave. I am not sure if that is what it is based on your description.

  • Thank you for your perspective. While I recognize that inefficiencies are common, the issues here seem to reflect deeper problems like disregard for processes and unethical management practices. Efforts to implement changes are consistently met with pushback from management, complicating improvements in critical areas like compliance and security. Additionally, there is lot of hearsay at the management level (even from the CIO & management consultant towards me) which I try to ignore. My goal for this post is have input on how to navigate or influence change in this type of environment?
    – Som1234
    Commented Apr 20 at 13:58

A healthcare institution of about 5000 employees is a prime target for ransomware and other malware. (The "grapevine" is talking about how healthcare institutions are now the top target because of how loose their security is and how their IT systems contain huge amounts of Personal Identification Information which is of high value on the market.) Top management may not prioritize that until they are hit. Your job as an Information Security Officer is to prevent such an event. But if your job is not given the tools, the funding, and the CEO level support, you will not be able to do so.

If you can see such a "train wreck" coming, document it. Then, look to protect yourself by either finding another position or having full documentation that you warned them before it happened and what other actions you have taken to protect them.

Not the answer you're looking for? Browse other questions tagged .