Building a Security Team of One

At every company under 30 people I've ever seen, the security team is one person. Usually the CTO, sometimes the founder, occasionally a senior engineer who drew the short straw. The question isn't whether you have a security team of one — you do — but how to structure it so it's effective.

What one person actually needs to own

The non-delegable core of the role:

• Risk and priorities. Which threats matter most this quarter? This can't be outsourced — only you understand your product, customers, and threat surface.
• Incident response decisions. When something happens, who gets called, what gets disclosed, when do we tell customers. Must be rehearsed and owned by a single person.
• Vendor and customer relationships. The security conversations with sub-processors and enterprise buyers. Founders do this well because they understand the business stakes.
• Compliance program strategy. Which framework, which scope, which auditor. Don't outsource strategy; outsource execution.

What to delegate — to automation

Evidence collection, control monitoring, access reviews, vulnerability scanning, employee security training, policy templating. A modern compliance platform handles 70% of the operational work that used to require a full-time GRC hire. Use it.

What to delegate — to external experts

Annual penetration tests, HIPAA/PCI specialized audits, legal review of DPAs and contracts, complex incident response (if you have one). These need genuine expertise. Fractional CISO services exist for a reason at this stage.

Red flags: when you need a second hire

You've outgrown the team-of-one model when:

• Security questionnaires are eating 20%+ of your time.
• You've had an incident you didn't have the bandwidth to investigate properly.
• You're doing 3+ enterprise security reviews simultaneously.
• Your compliance program is driving roadmap decisions you don't have time to evaluate.
• Your first Head of Sales is getting hired — they'll double the security review load overnight.

The first dedicated security hire is usually around Series A or ~40 employees. Often it's a Head of Security / CISO role, occasionally a GRC-first hire if you're in a regulated industry. Either way, don't rush it — a bad hire here damages the security posture more than no hire does.

Protect the calendar

The most common failure mode of the security team of one isn't incompetence — it's time-slicing. When everything is urgent, nothing is consistent. Calendar block for compliance work. 2 hours a week minimum. Don't let other priorities eat it. The controls that pass audits are the ones that happen reliably, not the ones that are done brilliantly when there's time.