Sign in Subscribe

Brian Weidner

Brian Weidner

The Most Important Skills for a Cybersecurity GRC Professional (Hint: They’re Not Technical)

The Most Important Skills for a Cybersecurity GRC Professional (Hint: They’re Not Technical)

InfoSec Made Easy Career Development in Cybersecurity The Most Important Skills for a Cybersecurity GRC Professional Hint: They're not technical Ask most people what a GRC professional does, and you'll get one of two answers. Either a blank stare — because Governance, Risk, and Compliance isn'

Structuring Roles and Gaining Executive Approval to Build the Organization

Structuring Roles and Gaining Executive Approval to Build the Organization

InfoSec Made Easy Security Leadership and Organizational Development Structuring Roles and Gaining Executive Approval to Build the Organization How to make the business case for security growth — and keep earning the trust that makes continued investment possible You've done the work. You've mapped the gaps, built

What Functions a Large Enterprise Security Organization Must Have — And Why

What Functions a Large Enterprise Security Organization Must Have — And Why

If you are operating in a large enterprise, you are not building security for coverage. You are building it for: Scale Resilience Regulatory defensibility Revenue protection Investor confidence Brand preservation At this stage, “having security tools” is irrelevant. What matters is: Clear functional ownership aligned to enterprise risk. Let’s

What to Outsource (Without Losing Control)

What to Outsource (Without Losing Control)

InfoSec Made Easy Building Your Security Team Series — Part 2 Smart Use of External Partners How to extend your security capabilities through outside partners — without losing the oversight and accountability that leadership depends on you to maintain At some point in every midsize security leader's career, the math

How to Scale Your Team (Without Losing Executive Support)

How to Scale Your Team (Without Losing Executive Support)

InfoSec Made Easy Building Your Security Team Series — Part 3 of 3 Hiring Order, Headcount Justification, and Career Path How to grow your security team in the right sequence, make the business case for every hire, and build a place where good people want to stay Building a security team

How to Build a Security Team in a Midsize Organization

How to Build a Security Team in a Midsize Organization

InfoSec Made Easy Building Your Security Team Series — Part 1 Start With Structure, Not Titles How to build a security team that actually covers what matters — without an enterprise budget or a Fortune 500 headcount You didn't wake up one morning and decide to build a security team

NIST CSF 2.0 Respond – Mitigation (RS.MI) Explained

NIST CSF 2.0 Respond – Mitigation (RS.MI) Explained

If Incident Management is about orchestration, Incident Analysis is about understanding, and Response Communications is about control of the narrative, then Mitigation is about decisive action. Mitigation is where security teams move from talking about risk to actively reducing it—while the incident is still unfolding. In my experience, this