1. Leadership Team
1.1. CEO
1.1.1. Chief Information Security Officer (CISO) or CSO
1.1.1.1. Access Management
1.1.1.1.1. Access Management Specialist
1.1.1.1.2. Access Management Administrator
1.1.1.2. Security Architecture
1.1.1.2.1. Security Architect
1.1.1.3. Security Engineering
1.1.1.3.1. Application Security Engineer
1.1.1.3.2. Cryptographer/Encryption Engineer
1.1.1.3.3. Database Security Engineer
1.1.1.3.4. Identity and Access Management Engineer
1.1.1.3.5. Mainframe Security Engineer
1.1.1.3.6. Network Security Engineer
1.1.1.3.7. Unix Security Engineer
1.1.1.3.8. Windows Security Engineer
1.1.1.4. Security Operations Director
1.1.1.4.1. Firewall Administrator/Analyst
1.1.1.4.2. Intrusion Detection Analyst
1.1.1.4.3. Penetration Tester
1.1.1.4.4. Security Administrator
1.1.1.4.5. Security Operations Analyst (Level 1)
1.1.1.4.6. Threat Intelligence Analyst
1.1.1.4.7. Virtual Patch Management Analyst
1.1.1.4.8. Vulnerability Analyst
1.1.2. Privacy Officer
1.2. Chief Information Officer (CIO)
1.3. Digital Risk Officer (DRO)
1.3.1. Director of Risk and Compliance
1.3.1.1. Manager of Risk and Compliance
1.3.1.1.1. Risk Analyst
1.3.1.1.2. Security Auditor
2. Security Program Stages
2.1. Stage 1
2.1.1. Initial
2.1.1.1. Policy Development
2.1.1.2. Standards Development
2.1.1.3. Employee Education
2.2. Stage 2
2.2.1. Architecting
2.2.1.1. Architectural Review
2.2.1.2. Audit
2.2.1.3. Compliance Assessment
2.3. Stage 3
2.3.1. Building
2.3.1.1. Risk Management
2.3.1.2. Security Operations
2.3.1.3. Best of Breed
2.3.1.4. Standalone Product Preference
2.4. Stage 4
2.4.1. Operating
2.4.1.1. Solution Preference
2.4.1.2. Security Product Rationalization
2.4.1.3. Solution Suite Product Preference
2.4.1.4. Threat Response Focus
2.5. Stage 5
2.5.1. Optimizing
2.5.1.1. Managing Security Risks
2.5.1.2. Managing Compliance Risks
2.5.1.3. Threat Hunting
2.5.1.4. Managing Threat Handling