Skip to main content

Chapter 5 — Leadership, Communication, and Career Development

The technical and procedural foundations matter, but they are not sufficient for impact. The security professional who masters frameworks but cannot lead people, communicate effectively, or sustain career growth limits their contribution. This chapter takes up the human and career dimensions of the profession: leading security teams; building organisational security culture beyond the security team itself; leading incident response when systems and people are stressed; and developing one's own career through deliberate planning and continuing professional development. The skills are less codified than technical security knowledge but matter as much for the professional who aims for sustained contribution and growth over a multi-decade career.

5.1 Managing security teams​

The security manager's role​

A security manager is the professional responsible for leading a team that performs information security functions — combining technical understanding sufficient to direct work appropriately, people-management skills to develop and retain team members, business judgement to align with organisational needs, and communication ability to engage with stakeholders across the organisation.

The transition from individual contributor to manager is significant. The skills that made one an effective analyst, engineer, or auditor are necessary but not sufficient for leading others doing those activities.

What security managers do​

The role typically includes:

Setting direction. Strategy and priorities for the team.

Resource planning. Headcount, budget, tools.

Hiring. Recruiting, evaluating, selecting team members.

Development. Coaching, mentoring, training.

Performance management. Setting expectations; reviewing; addressing issues.

Retention. Keeping good people engaged.

Operations. Day-to-day team operations.

Escalations. Handling issues that team members escalate.

Stakeholder engagement. With other functions and management.

Reporting. To leadership.

Programme management. Multiple initiatives.

Vendor management. Relationships with security suppliers.

Incident leadership. When incidents occur.

Team types​

Security teams vary in focus:

SOC. 24/7 monitoring and response.

Penetration testing / red team. Offensive testing.

Detection engineering. Building detection capability.

Vulnerability management. Identification and remediation.

Identity and access management. Identity infrastructure.

Application security. Securing software development.

Cloud security. Cloud-specific operations.

Risk and compliance. GRC work.

Forensics and IR. Incident response.

Security architecture. Design and standards.

Each requires somewhat different management approach reflecting the work's nature.

Managing technical experts​

Many security teams consist of technical experts. Considerations:

Respect expertise. Don't second-guess on technical matters without good reason.

Provide context. Help team members understand the business context.

Remove obstacles. Enable the work rather than direct it.

Buffer from politics. Allow technical focus.

Recognise contributions. Public acknowledgement matters.

Career growth. Provide paths for growth that don't require leaving technical work.

Hiring security talent​

Hiring in cybersecurity faces specific challenges:

Limited supply. Skilled professionals are scarce.

Demand exceeds supply. Many employers competing.

Salary inflation. Compensation rising.

Geographic competition. Remote work intensifies competition.

Certification signalling. Imperfect indicator of capability.

For Nepali context specifically:

Local talent pool. Limited but growing.

International competition. Skilled professionals attracted to overseas roles or remote work for foreign employers.

Salary differential. Local salaries below international comparison.

Retention challenge. Trained professionals leave for better opportunities.

Visa-related dynamics. International placement opportunities affect supply.

Effective hiring practice​

Clear role definition. What success looks like.

Skills assessment. Practical evaluation of capability, not just credential review.

Cultural fit assessment. Does the person work well with the team.

Realistic offer. Competitive within constraints.

Onboarding. Strong start to retention.

Pipeline building. Continuous relationship with talent market.

University engagement. Building relationships with educational institutions.

Retention strategies​

Once hired, retention:

Meaningful work. Engaging projects.

Career path. Clear progression options.

Compensation. Periodic review against market.

Development. Training, certifications, conferences.

Recognition. Public acknowledgement.

Work-life balance. Sustainable workload.

Autonomy. Trust to do the work.

Leadership quality. Direct manager strongly influences retention.

Major Nepali employers in security increasingly invest in these areas; smaller often cannot.

Performance management​

Direct conversations about performance:

Regular check-ins. Not just annual reviews.

Clear expectations. What success looks like.

Constructive feedback. Specific, timely, actionable.

Issue addressing. Don't avoid difficult conversations.

Development planning. Joint plan for growth.

Documentation. Records of performance discussions.

Difficult cases. When performance is not adequate, address with appropriate process.

Building a high-performing team​

Characteristics of strong security teams:

  • Clear shared purpose.
  • Mutual respect.
  • Open communication.
  • Continuous learning.
  • Constructive disagreement.
  • Recognition of contributions.
  • Distributed leadership.
  • Resilience under pressure.

These don't emerge automatically; they are built through deliberate leadership over time.

Diversity in teams​

Diverse teams typically outperform homogeneous teams on complex problems. Security work is complex.

Diversity dimensions:

  • Gender. Discussed in Chapter 6.
  • Background. Different educational paths, prior experience.
  • Cognitive styles. Different ways of approaching problems.
  • Perspectives. Different professional and cultural backgrounds.

Building diverse teams requires deliberate effort — inclusive job postings, broad sourcing, fair evaluation, supportive culture.

Common management mistakes​

Patterns to avoid:

Micromanagement. Killing engagement.

Avoidance. Not addressing issues.

Favouritism. Damaging team cohesion.

Unclear direction. Confusion and inefficiency.

Public criticism. Eroding trust.

Credit hogging. Damaging future cooperation.

Inconsistency. Confusion about standards.

Burnout. Personal or team.

Failure to develop. Treating team as utility rather than growing capability.

The transition from individual contributor to effective manager typically requires substantial skill development; mentoring from experienced managers helps.

5.2 Building a security culture​

Security culture​

Organisational security culture is the collective values, beliefs, behaviours, and norms regarding information security exhibited by an organisation's members, manifesting in how individuals approach security in their daily work, how decisions integrate security considerations, and how the organisation responds when security comes into tension with other priorities.

Culture is what people do when no one is watching. Strong security culture means people do the right things consistently without requiring constant supervision.

Why culture matters​

Technical controls have limits:

  • Users can be tricked.
  • Configurations can be misset.
  • Policies can be ignored.
  • Procedures can be skipped.

A workforce committed to security through culture provides the human layer of defence that technical controls cannot.

Elements of security culture​

Awareness. People understand security risks.

Knowledge. People know how to act appropriately.

Attitude. People believe security matters.

Behaviour. People act consistently with security.

Norms. Group expectations support security.

Communication. Open discussion of security.

Accountability. Recognition for good practice; consequences for poor.

Building security culture​

Effective approaches:

Leadership example. Senior leaders demonstrate commitment.

Continuous awareness programmes. Not just annual training.

Engaging content. Not boring compliance check-the-box.

Specific role training. Tailored to function.

Phishing simulations. Practice in safe environment.

Recognition programmes. Positive reinforcement.

Champion networks. Distributed advocates.

Communication channels. Regular updates.

Storytelling. Real incidents (sanitised) build engagement.

Easy reporting. Simple way to report concerns.

Just culture. Errors investigated for systemic issues, not just individual blame.

Awareness training approaches​

Traditional annual training. Common but limited effectiveness.

Continuous micro-learning. Brief regular touches.

Role-specific training. Developers learn secure coding; finance learns BEC; executives learn whaling.

Phishing simulations. Practice and metrics.

Tabletop exercises. For management.

Lunch-and-learns. Informal learning.

Awareness campaigns. Themed periodic emphasis.

Gamification. Where appropriate.

Specific awareness topics​

Phishing recognition. As covered in ENCTNS615.

Password practices. Strong, unique, MFA.

Social engineering. Beyond email.

Data handling. Classification, sharing, disposal.

Mobile device security. BYOD and corporate.

Travel security. When traveling with sensitive data.

Public Wi-Fi. Use and risks.

Incident reporting. How to report concerns.

Working from home. Specific considerations.

Cloud and SaaS. Sanctioned and shadow IT.

Awareness training vendors​

For Nepali enterprises:

International vendors:

  • KnowBe4 (largest globally).
  • Proofpoint Security Awareness.
  • Cofense.
  • Hoxhunt.
  • Mimecast Awareness Training.
  • Wizer.

Local capability. Some Nepali consultancies offer awareness services.

In-house development. Larger organisations may develop own content.

Open-source / free resources. SANS, OUCH! newsletter, others.

Culture assessment​

How to measure security culture:

Surveys. Periodic security culture surveys.

Phishing simulation results. Click rates and reporting rates.

Incident patterns. What types of incidents occur and where.

Reporting culture. Are people reporting concerns?

Policy compliance. Spot checks of behaviour vs policy.

Audit findings. What culture issues do audits surface?

Multiple measures provide better picture than any single metric.

Culture change​

When existing culture is weak:

Diagnose. Understand current state and root causes.

Engage leadership. Cannot succeed without leadership.

Identify champions. Distributed advocacy.

Quick wins. Build momentum.

Systemic improvements. Address structural causes.

Sustained effort. Culture change takes years.

Patience and persistence. Setbacks are normal.

Nepali context for security culture​

For Nepali enterprises:

Banks. Generally have established awareness programmes; NRB-required training; mature culture in major institutions.

Major enterprises. Building awareness capability; mixed maturity.

Smaller organisations. Often limited formal programmes.

Government. Variable; emerging efforts.

Cultural considerations. Hierarchical workplace norms can both help (top-down direction works) and hinder (junior staff may not raise concerns).

For MSc graduates in security roles, contribution to awareness and culture is a significant part of impact beyond technical work.

5.3 Incident response leadership​

Leading during incidents​

Incident response involves technical work (covered in ENCTNS551 Digital Forensics) and substantial leadership work. The professional leading response handles:

Coordination. Multiple teams, vendors, executives.

Decision-making. Often under uncertainty and time pressure.

Communication. Internal and external stakeholders.

Resource management. Staffing, tools, vendors.

Pressure management. Personal and team.

Documentation. Records during the chaos.

Stakeholder management. Executives, legal, customers, regulators.

Incident leadership skills​

Calm under pressure. Not adding to chaos.

Clear thinking. Not freezing or panicking.

Decisive action. Decisions made; second-guessing minimised during response.

Listening. To technical inputs, business perspectives.

Communication. Updates that inform without overwhelming.

Delegation. Not trying to do everything personally.

Time management. Prioritising the urgent.

Endurance. Long incidents demand sustained capability.

Compassion. For team members under stress.

Incident response team structure​

Common roles:

Incident commander. Overall lead. Doesn't typically do technical work; coordinates.

Technical lead. Senior technical decision-making.

Communications lead. Internal and external communication.

Legal lead. Legal counsel participation.

Documentation lead. Records during incident.

Executive sponsor. Senior management engagement.

Subject matter experts. Brought in as needed.

External support. Vendor IR firms, law enforcement, others.

For smaller organisations, individuals may play multiple roles. The key is clarity about who is doing what.

Communication during incidents​

Internal.

  • Executive briefings (frequent during active phase).
  • Team updates (more frequent).
  • Affected user notifications (as appropriate).
  • Status pages (where used).

External.

  • Customer notifications (per legal and policy).
  • Regulatory notifications (per requirements).
  • Law enforcement (where applicable).
  • Vendors (those affected or needed).
  • Media (per communications plan; usually through corporate comms).

Communication discipline:

  • Cadence. Regular updates expected.
  • Accuracy. Don't speculate; correct information when better understanding emerges.
  • Appropriate detail. Different audiences need different detail.
  • Single source. Through designated channels.
  • Records. What was communicated when.

Decision-making under pressure​

Real incidents demand decisions with incomplete information:

Frameworks help.

  • OODA loop (Observe, Orient, Decide, Act).
  • Sensemaking before deciding.
  • Multiple-perspective consultation.

Avoid:

  • Analysis paralysis.
  • Sunk-cost reasoning.
  • Defensive reasoning.
  • Groupthink.

Embrace:

  • Reversible decisions made quickly.
  • Irreversible decisions considered carefully.
  • Pre-commitment to certain decisions (in playbooks).
  • Acknowledging mistakes and adjusting.

Working with executives during incidents​

Senior leaders during incidents:

They need information. Brief, factual, action-oriented.

They make business decisions. Customer notification, ransom payment, public statements.

They engage with peers. Other executives may need briefings.

They face external pressure. Board, media, investors.

They may want to help. Direct them to appropriate roles.

They need protection from operational distractions. Don't burn their time on detail.

The incident leader's job includes managing the executive interaction effectively.

Working with law enforcement​

When law enforcement involvement is appropriate:

Cyber Bureau under Nepal Police. For Nepali criminal matters.

International cooperation. For attacks originating elsewhere.

Evidence preservation. Chain of custody.

Communication discipline. What you share when.

Legal counsel involvement. Standard.

For Nepali context, law enforcement engagement on cybercrime is developing capability; engagement is uneven across cases.

Post-incident review​

Discussed in ENCTNS551 (Digital Forensics) Chapter 7. The leader's role:

Convene the review. Make it happen.

Set the tone. Blameless investigation focused on improvement.

Encourage candour. People should be willing to say what went wrong.

Document outcomes. Lessons captured.

Drive action. Improvements actually implemented.

Communicate findings. Appropriate audiences informed.

The review converts incident pain into organisational learning.

Burnout prevention​

Major incidents are exhausting. Leader responsibility for team welfare:

Shift management. People can't work 24/7 sustainably.

Rest enforcement. Send people home; insist on rest.

Backup planning. Multiple people capable of key roles.

Recognition. Acknowledge the contribution.

Recovery time. After major incidents.

Counselling resources. Where appropriate.

For Nepali context, work culture sometimes celebrates sustained extreme effort; recognising the limits of sustained capability is professional responsibility.

Building IR leadership capability​

For aspiring incident leaders:

Tabletop participation. Practice in low-stakes environment.

Real incident participation. Eventually, lead.

Cross-functional engagement. Understanding broader organisation.

Crisis-management training. Generic and security-specific.

Communication training. Particularly crisis communication.

Mentor relationships. With experienced incident leaders.

The capability builds over years of progressively responsible engagement.

5.4 Career strategy and continuing professional development​

Career as deliberate construction​

A career is built through accumulated choices over decades — what roles to take, what skills to develop, what relationships to invest in, what reputation to build. Deliberate career planning is more effective than passive drift.

Career stages​

Early career (first 5 years). Building foundation. Multiple role exposure valued; technical depth begins; certifications start.

Mid career (5-15 years). Specialisation depth. Leadership development. Certifications maturity. Reputation building.

Senior career (15-25 years). Senior roles. Strategic perspective. Mentoring others. Industry engagement.

Late career (25+). Top roles, board positions, advisory work, retirement transition.

Each stage has different priorities and opportunities. Successful careers manage transitions effectively.

Specialisation choices​

The cybersecurity field is broad; specialisation directions:

Technical depth. Penetration testing, security engineering, cryptography, forensics, malware analysis.

Operational depth. SOC, incident response, threat hunting, detection engineering.

Architectural breadth. Security architecture, cloud security architecture.

Governance and risk. GRC, audit, compliance, privacy.

Management. Security management, programme management.

Executive. CISO and equivalent.

Industry specialisation. Banking, healthcare, government, energy, etc.

Domain specialisation. IoT, mobile, cloud, AI security.

Most professionals build T-shaped skills — broad foundation plus deeper specialisation. The specialisation may evolve over career.

Career path patterns​

Technical track. Stay in technical roles; achieve senior technical position; influence through expertise.

Management track. Move to management; ultimately leadership.

Hybrid. Move between technical and management roles.

Consulting. External consulting career.

Vendor. Working for security vendors.

Entrepreneurship. Founding or joining security companies.

Academic/research. Universities, research labs.

Public sector. Government cybersecurity.

For Nepali context, all paths are available though with different opportunity densities. Banking sector roles common; consulting growing; vendor side relatively small locally but international remote opportunities expanding; entrepreneurship limited but emerging.

Continuing Professional Development​

Continuing Professional Development is the deliberate, ongoing maintenance and improvement of professional knowledge and skills throughout a working life, recognised by professional bodies as essential for sustained competence and increasingly required as a condition of maintaining certifications.

CPD takes many forms.

Forms of CPD​

Formal education. Degrees, diplomas, courses.

Certifications. Industry credentials with ongoing maintenance requirements.

Conferences and seminars. Industry events.

Reading. Books, papers, blogs.

Training courses. Vendor and skills training.

Professional body activities. Chapter meetings, committees.

Speaking and writing. Sharing knowledge.

Mentoring others. Both directions.

Personal projects. Hands-on learning.

Open source contributions. Code contributions.

Research. Independent or institutional.

CPD requirements for certifications​

Most certifications require ongoing CPE:

CISSP. 120 CPE credits per 3-year cycle; 40 minimum per year.

CISM. 120 CPE credits per 3-year cycle; 20 minimum per year.

CISA. Same as CISM.

CEH. 120 ECE credits per 3-year cycle.

OSCP. Lifetime certification (no CPE requirement currently).

GIAC certifications. 36 CPE credits per 4-year cycle.

CPE credits earned through various activities; documented and reported.

Building a CPD plan​

A deliberate plan:

Career goals. Where you want to be in 3-5 years.

Skills gaps. What you need to develop.

Certifications. Which to pursue.

Learning sources. Where you'll learn.

Time allocation. Realistic time commitment.

Tracking. Records of CPD activities.

Review and adjust. Periodic reassessment.

CPD opportunities for Nepali professionals​

For Nepali security professionals:

Online resources. Substantial — Coursera, Udemy, Pluralsight, Cybrary, SANS On-Demand, vendor training.

Free resources. OWASP, MITRE, NIST, various GitHub repositories, security blogs.

Local events. OWASP Kathmandu chapter, ISACA Kathmandu chapter, npCERT events, conferences (NCSC and others), informal meetups.

International conferences. Some Nepali professionals attend Black Hat, DEF CON, RSA, regional Asia-Pacific events. Cost and visa considerations.

Books. Available digital; physical limited.

Research papers. Free academic literature.

Vendor training. Some vendors offer training in Nepal or remotely.

The MSc graduate has substantial opportunity for CPD; the challenge is sustained commitment over decades.

Professional networking​

Beyond formal learning, professional relationships matter:

Professional bodies. ISACA, (ISC)², ISSA, OWASP local chapters.

LinkedIn. Professional online presence.

Conferences. Networking value beyond content.

Local meetups. Informal community.

Mentoring relationships. Both directions.

Collegial relationships. Peers across organisations.

Vendor relationships. Where appropriate.

International connections. Through remote work, conferences.

Networks provide opportunities, information, support, perspective. Building network early in career compounds over time.

Personal brand and reputation​

In a small market like Nepal's, reputation matters substantially:

Quality of work. Foundation.

Reliability. Doing what you say.

Ethical conduct. Not compromised.

Public contributions. Speaking, writing, open source.

Collegial relationships. How you treat colleagues.

Discretion. Confidentiality respected.

Recovery from mistakes. How errors are handled.

Reputation built slowly; damaged quickly. Care from the start matters.

Geographic mobility​

Many Nepali security professionals work internationally:

Remote work. Increasingly possible from Nepal for international employers.

Migration. Australia, UK, US, Gulf states, Singapore common destinations.

Multinational employers. Banks and IT firms with international operations.

Consulting travel. Regional consulting roles.

Career planning should consider geographic options realistically — both opportunities and constraints (visa, family, lifestyle, return paths).

Sustainability and balance​

Long careers require sustainability:

Health. Physical and mental.

Family. Long-term relationships.

Personal interests. Beyond work.

Burnout prevention. Recognising and managing.

Recovery periods. After intense work.

Boundaries. Work-life separation.

Perspective. Work is important but not everything.

The cybersecurity field has high burnout rates. Sustainable career practice from the start matters more than maximum effort that cannot be sustained.

The compounding effect of professional development​

Over a 30-year career:

  • Skills built early compound.
  • Relationships built early compound.
  • Reputation built early compounds.
  • Health and resilience built early compound.

The MSc graduate has decades ahead. Investments made now in professional capability, relationships, reputation, and personal sustainability pay returns over the entire career. The compound interest of professional development is one of the most powerful forces in long-term success.

The leadership, communication, and career-development capabilities covered in this chapter complement the technical and procedural foundations. The final chapter takes up emerging trends and the future outlook for the profession — examining how AI and cloud are reshaping the field, how to handle ethical case studies, and how the profession must work toward greater gender and diversity inclusion to access the full talent pool the field needs.

· min read