Blue Team

634 readers

1 users here now

Blue Teamers are the first (and sometimes last) line of defense in the ongoing cyber war. This place is to chat out detection strategies, complain about SIEMs, compare SOAR playbooks, or post mean memes about the Red Team.

founded 2 years ago

MODERATORS

xavier

What does your security organization look like? (self.blueteam)

submitted 2 years ago* (last edited 2 years ago) by 0xCBE to c/blueteam

6 comments fedilink hide all child comments

👋 Hello all! So, how big is your security organization and how are responsibilities split across teams?

I've been through I don't know how many reorgs and seen quite a few place, and while some patterns emerge it's always interesting to see how Security is split up.

In my current company we evolved from:

6ppl: one security team
~12ppl: one security team, distributed between two locations
~12ppl: infrasec team, appsec team
~30ppl: infrasec team, dir team, appsec team, risk/audit team
~60ppl: infrasec team, dir team, corpsec team, appsec tooling team, appsec consulting team, risk/audit team, compliance team

you are viewing a single comment's thread
view the rest of the comments

[–] xavier 1 points 2 years ago (2 children)

I work at a top-10 US bank. If you add our contractors, we have nearly 1000 people in the cyber org. I have 26 people in my direct report org and 235 in my dotted-line org. The 26 folks in my direct report org only do firewall policy changes.

[–] 0xCBE 1 points 2 years ago (1 children)

it’s impressive! How does your infrastructure looks like? Is it 100% on prem?

[–] xavier 1 points 2 years ago

Not completely. We have about 50% of workloads on-prem, 25% in IaaS, and 25% in SaaS. We're slowly moving to the cloud, but only when it makes sense. We only build cloud-native apps.