Most security departments run on engineers and analysts who follow playbooks, process alerts, and escalate tickets. That approach handles routine operations well, but it falls short for unconventional defense, which needs a different kind of person entirely, an operator trained for creativity under stress rather than task execution.

"Operators", the type of security professional we need for this, think independently and act effectively once standard procedures run out of answers. They use security fundamentals as force multipliers rather than simply carrying out a predetermined response, and their success gets measured by adversary disruption, higher attacker cost, and reduced organizational risk instead of activity volume. They rotate across skill areas to keep a broad view while specializing deeply in one, and what defines an operator has little to do with a job title and everything to do with a consistent pattern of adaptive problem-solving under pressure.

It's mindset. It's being able to work ouside the lines and under stress. It's also enduring boredom... Yeah, most of the time this is boring.

Finding the right fit has to target specific attributes, because not everyone on a security team has what unconventional warfare requires. Curiosity pushes a team member to ask "what if" and dig past the surface of an alert instead of dismissing an anomaly as routine. Adaptability lets them change tactics when conditions shift without falling into analysis paralysis. Composure keeps them effective under pressure, fatigue, and incomplete information, and real incidents rarely hand anyone a complete picture to work with. Discipline means mastering the fundamentals before reaching for advanced techniques, and unconventional tactics depend entirely on that foundation. Persistence keeps them iterating on deception and disruption even after early attempts fail, treating failure as information rather than a reason to quit. Precision lets them apply limited resources where the impact is greatest instead of spreading effort thin across broad but shallow coverage.

Past job titles, courses, and years of tenure offer some signal, but they do not predict how someone performs under stress or uncertainty. Assessing the right security professionals for this role means running candidates through stress scenarios where they need to detect and respond to a simulated intrusion with limited tools and incomplete information, under real time pressure. Watching how someone handles a problem with no clear solution reveals whether they can stay creative and focused instead of freezing or falling back on procedures that do not fit. Peer evaluation adds insight that a technical test cannot, because operators on a SUW cell depend on mutual trust with teammates in high-pressure moments, and someone who cannot earn that trust will struggle regardless of technical skill. Deliberately designed failure scenarios test persistence, continuing until a candidate either adapts their way to success or gives up.

We are looking for just the people that want to stay until the attackers give up.

Operators work best in small, semi-autonomous cells that can adapt quickly without bureaucratic overhead. Large teams tend to suffer from coordination delays that blunt tactical effectiveness, so in the beginning four to six people tends to be the right size, able to cover the essential functions. Four roles make up a typical cell; hunters track adversary movement, investigate behavioral anomalies, and lead the active pursuit once something suspicious surfaces, combining technical investigation with tactical anticipation of what an adversary will try next. Deception specialists build convincing honeypots, plant false credentials that trigger monitoring when touched, and craft traps that waste an attacker's time, balancing authenticity against the risk of interfering with real operations. Engineers build the lightweight custom tools that support these operations, automate fundamental processes to free up operator time, and keep deceptive environments refreshed enough to stay convincing. Analysts study captured behavior to build intelligence profiles, refine doctrine based on what worked and what did not, and anticipate how adversaries are likely to adapt next. Each cell keeps at least one person per role, and operators rotate through different roles during training to build broad understanding even as they specialize in the area that fits them best.

The cell gets mission intent, not step-by-step instructions. Security unconventional warfare depends on constant adaptation that a static procedure cannot capture. That requires real trust running in both directions, with leaders trusting the teams to make sound calls and operators accepting accountability for the outcome regardless of the specific method used. Coordination across the cell then keeps individual actions reinforcing each other instead of colliding. For example, a deception specialist setting a trap needs to loop in the hunters who will pursue whoever triggers it. That coordination is what keeps operator actions precise and coherent instead of turning into scattered experiments with limited value.

It is important that leadership keep a clear line between routine security team duties and SUW cell responsibilities, since an operator pulled regularly into monitoring shifts or compliance paperwork cannot maintain the specialized mindset the role needs. Building that capability takes a long time and needs sustained commitment even when conventional security work is short-staffed. Leaders also need to let operators fail without punishment, given that many unconventional techniques take several iterations to work, and punishing early failure just discourages the experimentation the role depends on. Reward systems for operators should track strategic outcomes, reduced adversary effectiveness, faster detection, higher attacker cost, rather than the activity metrics that make sense for conventional staff.

Cell members are the decisive edge that makes unconventional defense real rather than theoretical. Without them, doctrine stays a framework on paper. With them properly selected and developed, adversaries face professionals trained specifically to frustrate their operations and deny their success through steady tactical innovation.

Go to Part 5.