A Brutalist Approach to Security Teams

A Brutalist approach to security teams emphasizes clarity, ownership, transparency, and results. Security teams exist to reduce risk and improve resilience, not to generate activity or manage bureaucracy.

Start by putting the right people in the right roles and then give them the authority to solve problems. Each person owns their area completely. Blame shifting is unacceptable. Problems belong to the team, but accountability belongs to individuals. When someone needs help, they ask for it early rather than struggling in isolation.

Team structures should remain simple. Roles should be broad, clearly defined, and tied to outcomes rather than narrow specialties. Management layers should be kept to a minimum so information flows directly and decisions stay close to the work. Every person should have a single manager and a clear understanding of what they are responsible for.

Communication must be direct, transparent, and frequent. Status reporting should focus on facts, risks, decisions, and outcomes. Meetings should be short, purposeful, and as infrequent as possible.

Performance should be measured by contribution to security outcomes. Managers are evaluated by how effectively they enable their teams to succeed. Individual contributors are evaluated by their judgment, adaptability, ownership, and ability to deliver under pressure. Expectations, rewards, and corrective actions should be clear and consistently applied.

Tooling and processes should remain simple as well. Use the minimum number of tools required to perform the mission effectively. Favor mature, well-understood technologies over novelty. Document essential processes, review them regularly, and automate repetitive work wherever possible so people can focus on analysis and decision making.

Last, but not least, culture. It's built on ownership, accountability, and teamwork. Individual excellence is important, but no one succeeds alone. Hero culture and "rockstar" mentalities create fragility. Reliable teams, disciplined processes, and consistent execution create resilient security programs.

A Brutalist Security team strips away unnecessary complexity and focuses on what produces results: clear responsibilities, transparent communication, disciplined execution, and measurable improvements in security outcomes.