Security Manager's Journal: A fresh start at a company that gets security

Computerworld - This economic recession has cost all of us. In my case, it cost me my job -- twice. I was laid off first in 2007 after six years as the top security manager at a company where I had built the security program from scratch. I was laid off again just recently, after two years during which I first tried to build a new security program, but then had to cut my already very small staff. Finally the security program was shut down entirely.

Needless to say, I think that was a poor decision, and I don't say that because I lost my job. Just before the ax fell, I had been working on cost-cutting initiatives. I had hated cutting my staff, and I was determined to ensure that no more layoffs would be required. I figured that there had to be a better way to save money than ejecting large pieces of our corporate knowledge base.

After digging around, I found two very expensive services that the company was paying for while getting very little value in return. It looked to me as if we could eliminate those expensive and underperforming services, and then use our in-house staff and infrastructure to perform the same work at a lower cost and higher level of quality. But just as I was feeling good about the prospects of this proposal, I was called in to the CIO's office, where I found myself facing our HR director and a bunch of layoff forms. Clearly, the company had chosen to go down the well-worn path of cutting staff rather than reducing costs in other areas.

It was a devastating blow. But now I have a new position that I'm feeling pretty good about. My job-loss trauma was thankfully brief, and I can look back and realize that I'm probably better off not working for a company that made such terrible decisions.

I'm a security manager again, but in a different industry, and in a company with a different culture and work environment. This time, I don't have to start from scratch exactly; this company has many good security practices ingrained into its processes, mainly because the technical staff is young, smart and savvy -- they get security, and its importance. It looks like I won't have a very large staff once again, maybe two or three people, but the rest of the IT staff here is very aware of what constitutes good security practices, and that could make a huge difference. With everybody pulling in the same direction, I might not need a lot of full-time employees dedicated to security.