SOT

SOT

SOAR
Security Orchestration, Automation and Response

Automation of response to information security incidents using dynamic playbooks and information security tools, building an attack chain and with an object-oriented approach

NG SOAR
Next Generation SOAR

Automation of response to information security incidents with built-in basic correlation (SIEM), vulnerability Scanner (VS), collection of raw events directly from information security tools, dynamic playbooks, building an attack chain and an object-oriented approach. AM and VM are included

AM
Asset Management

Description of the IT landscape, detection of new objects on the network, categorization of assets, inventory, life cycle management of equipment and software on automated workstations and servers of organizations

VS
Vulnerability Scanner

Scanning information assets with enrichment from any external services (additional scanners, The Data Security Threats Database and other analytical databases) to analyze the security of the infrastructure.

VM
Vulnerability Management

Building a process for detecting and eliminating technical vulnerabilities, collecting information from existing security scanners, update management platforms, expert external services and other solutions

FinCERT
Financial Computer Emergency Response Team

Bilateral interaction with the Central Bank, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

GovCERT
Government Computer Emergency Response Team

Bilateral interaction with the state coordination center for computer incidents, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

Mail us to sales@securityvision.ru or get demo presentation

Between biscuits and carrots: keeping the team in limbo

Between biscuits and carrots: keeping the team in limbo
11.06.2025

Eva Belyaeva, Head of Development Department, Security Vision Production Department 

Alexander Matveyev, Director of the Center for Monitoring and Countering Cyberattacks, IZ:SOC

 

About us


Before moving on to the topic, we will briefly tell you who we are and why we decided to share this experience.


Alexander Matveev - 14 years in information security and more than 9 years in management at different levels - from timlid to director. The main places of work are integrators. The current place of work is a company with more than 500 employees.


Eva Belyaeva - 12 years in information security and 2 years in management. Work - mainly integrators and vendors. The current place of work is 100 + employees.


We worked for a long time in one team, and later continued to cooperate, being already in other roles and companies. This experience allowed us to take a fresh look at familiar management challenges and maintain a professional dialogue regardless of context. We have different experience in managing different levels in different types of company - both in terms of goals and volume. I had a chance to both look at managerial work in different conditions and take a direct part in this.


We take into account both the specifics of information security in general and the specifics of small and large companies - sometimes the problems overlap, sometimes they are different. We tried to make this article universal.


For whom our article is suitable: for those who have recently grown from a specialist into a leader - this is exactly where we started. Secondly, it will be useful for those who have moved from company to company and acquired a new team; or those who were promoted from the position of line manager - and now you are mastering the position, for example, the director of the department.


We have collected both common mistakes and really working tips that will definitely help you find a common language with the team and management.


For whom our article is suitable: for those who have recently grown from a specialist into a leader - this is exactly where we started. Secondly, it will be useful for those who have moved from company to company and acquired a new team; or those who were promoted from the position of line manager - and now you are mastering the position, for example, the director of the department.


We have collected both common mistakes and really working tips that will definitely help you find a common language with the team and management.


You have received a team


Let's immediately agree that our article will focus on the process from hiring to applying from an employee; here we will not consider the issue of finding employees and their direct care, we are aimed directly at retaining the employee and the work itself.


рис 1.png


Imagine that you received a team. What is the situation in front of you? Well, first of all, you could be a former colleague who got promoted. Or, the second example - you are a leader and you were given a completely new team, with which you are not yet familiar. And finally, the third: your powers were expanded, and, for example, instead of a couple of departments, you became four. It would seem that the situations are different, but pitfalls and mistakes most often coincide.


Despite the fact that the personnel shortage in the market is still relevant, over time it is transformed: now, in our opinion, it is most difficult to find specialists of the middle and senior level. Someone has already come to terms and hires juns with subsequent long training, someone does not, but in this article we will tell you how to keep such specialists at home.


Which employee is most likely to be on your team? This is, as a rule, a demanded and qualified specialist who receives decent compensation and has high expectations for his employer. Moreover, we are talking not only about salaries or cookies in the kitchen - more and more often a request is formed for management, atmosphere, meaning of tasks and a sense of participation. It is important for such people not only to do the work, but to be part of the team, to understand the contribution to the overall result and to feel the opportunity to influence the processes.


For each section, we will try to give a brief extract about common mistakes that can be made, as well as add tips on how to avoid these mistakes.


Errors:

   -   They took and introduced a lot of changes in a short time. Excessive zeal to immediately change everything for yourself, without delving into the causes of current processes, often leads to resistance and chaos. For example, from the position of a subordinate, it seemed to you that you needed to act in a certain way, and immediately, without understanding the issue, you began to redo everything for your old vision.

   -   Neglected the experience of colleagues or their feedback in the process of change. Perhaps only you had such a vision and colleagues do not support it; and perhaps the manager who manages the department adjacent to yours has already gone this way and these same mistakes and is trying to warn you - and you are not listening.

   -   Sharply moved away from their subordinates. It is especially important for those managers who have grown out of the current team and subsequently decided to interrupt communication with former colleagues in the department.


The team is working. And you?


Let's say you didn't make the mistakes of the previous step or caught on and quickly fixed everything. Your team works and brings results. What's next? What affects the vector of further development of the team?


Whether you have recently become a leader or have been in this position for some time, everything can go both good and bad for you, for a different set of reasons.


When you become a leader, you go to the level of hierarchy when you find yourself between two lights: on the one hand, the team with its expectations, on the other - the leader and business tasks. This "management gap" is the most vulnerable and at the same time the most important zone of your new role. It is very important at the same time not to lose touch with the team, and to convey thoughts to the business up efficiently and effectively.


For many, this may not be obvious, but when changing your role, your priorities should also change. Now you first think not only about yourself and your success - now in the first place you have a team, the climate inside and the success of each of your subordinates separately. Your result of work, or, if you want, even KPI, is your ability to understand the abilities and needs of the person with whom you work, and learn to set tasks and give feedback so that the person grows and develops, benefiting the entire company. Now you are not just a specialist, but a leader. Your task is to provide the team with clear goals, conditions for growth and a sustainable environment. And in the first months, at least keep what was good before you and not harm working connections.


Why things can (and will) go wrong


Of course, the team's perception of you will have a big impact on your work. What they think of you, whether they trust you enough to talk about problems or listen to your decisions - these are all key aspects of your work.


It cannot be discounted that your manager may have a different management style and outlook on corporate culture from yours. It's not scary if you are different - the main thing is that you have the support of your manager on those issues where the decisive word is yours. It is also important if you transparently understand your boundaries - responsibilities to the team and management and your rights as a leader - at first, a lack of understanding of this issue can greatly harm you, if you start doing your own thing.


Have you wondered what exactly you need to do to keep subordinates loyal to you? What have you done so that subordinates can trust you? Depending on your management style, you may, on the one hand, be so distrustful and so afraid of you that you will find out about a critical error in the project the day after the deadline. Or it may be that you adjust too much to the team, trying to gain authority that no one, including you, will work effectively.


You do everything you can. Why doesn't it work?


Of course, because of the processes.


It is important how these processes are built within the company, whether you support them or not and whether you are trying to create something of your own. In general, two levels of difficulty can be distinguished. The first is a company at an early stage of development, where processes are either absent or extremely fragmented. The plus is that you can build a system for your management style and team needs; minus - lack of reliance on proven practices, which, with a lack of experience, can lead to ineffective solutions.


The second is a company that has been on the market for a long time, working on processes that could have been built long before you were born; they may be irrelevant, inconvenient, ineffective, but the worst thing is that they cannot be changed due to habit. As a plus, if you like the rules and like to follow them, this option can be immediately taken to work and reduce the load.


I must admit that one in the field is not a warrior, even if you yourself are a great fellow. If you try to pull everything out yourself, without consulting anyone, do not discuss your decisions, this immediately means your failure. On the one hand, this indicates your inability to delegate, and on the other, that no one's opinion matters to you, your coma.


You always need like-minded people, both inside and from above, try to find them in the team and enlist their support.


External factors that may interfere with your work cannot be ruled out: a sudden change of the CEO or your immediate supervisor, relocation, a change in the vector of activity of the entire company, etc. No one is safe from such black swans. Of course, in this case it will be somewhat harder to follow the goals set, so you should not demand much from yourself at once.


How much to endure?


It also happens that you sincerely tried, but this did not bear any fruit for any of the above reasons. When should you continue to fight, and when should you just step aside and wait it out?


It seems to us that the fact that someone in the company shares your goals and views is especially indicative. It does not matter who exactly such a person is - he can be both your leader, the head of the department next to you, and one of your subordinates. As long as there is at least one person supporting you, you can safely fight.


Errors:

   -   You only think about yourself and don't think about the team. You perceive yourself individually, and not as part of a team.

   -   You demand results and efficiency from the team, and you yourself work through the sleeves. A bad example is contagious, it is difficult to motivate people without doing anything.

   -   In addition to good relations with subordinates, do not forget that first of all we work for the result, and the team should be useful. However, you should not put pressure on subordinates, pushing your idea and not seeing objections, even if the idea is very good. The balance between supervisor and friend is important.


What interferes with the work of the team?


The most common problems are:


   1. Instability. It doesn't matter if you're a new executive to your team - the team may still not know how to treat you. You have to somehow establish yourself and take back control of the situation, maybe reacquaint yourself with everyone and start showing the team that you are as good as what the team had before you.


   2. The problem of playing coaches is when you become a leader, but you also do not remove your duties as a developer or engineer and do tasks on an equal basis with the rest, plus at the same time you must be a manager, take into account the interests of the team and speak with your leader from another role. There is no panacea here, and in order to come to at least the appearance of balance, you just need to accept and focus not on what does not suit you, but on what can be corrected and done better.


   3. Chaos. How to restore order and not cause resistance? Set rules and build processes. One example is that during your adaptation, you can identify common problems for your team and introduce a bonus system for how teams will behave in such situations. Thus, you will not only eliminate these problems, but also motivate the team as a whole to work effectively.


   4. Routine. Not all problems need to be solved with money, sometimes you can get by with some kind of ingenuity. For example, you have a stream of the same type of routine tasks in your department, and this cannot be avoided. In this case, to motivate the team, you can connect gamification - we introduced awards, possibly somewhat stupid and funny, and also business role-playing games - when we were a customer or integrator, for example, when we developed CJM. Thus, the routine from 9 to 18 turns, if not into an exciting adventure, then at least it ceases to be a monotonous boring business, the degree of negativity decreases.


   5. Neglect. It is imperative not to ignore employees and consider their opinions, feedback on your actions and encourage initiative. It is important not to neglect the established rules in the team, albeit unspoken. Listening to the team is necessary at all stages of work - even if there is nothing you can do about the problem, you will at least start thinking about solving it in advance.


   6. Rationale for changes. In addition, it is very important to competently convey to subordinates the motivation of your innovations, so as not to be understood in a negative way. As an example, we introduced a task tracking system. Without proper communication, the employees were a little panicked - that's it, surveillance has begun, their watch is counting, soon someone will be fired for poor work. But this was not at all the case and the motivation was the opposite - the employees, on the contrary, recycled too much, and the deadlines for the tasks were unrealistic. In this case, task tracking was supposed to be an argument for management and a confirmation of how much time is actually spent. On the other hand, routine prevailed in tasks, and this is when at the end of the day, week, month, you cannot understand - did you do something at all? The same problem arises on long-playing projects that take more than a year. Task tracking helps you retrospectively look at your work, including to see the results.


Errors:

You have ceased to understand what people are doing.

   -   You were promoted, but you remained at the same level of your competencies.

   -   You do not listen to the team, neglect their trust and do not organize chaos.


Why are they leaving?


Since our article is still about retention, it is important to understand exactly what reasons push our employees to leave; what could have gone wrong and whether, as executives, we can do something about it. Usually, the reasons for leaving are associated with discomfort in the team.


We put burnout in the first place: quite often people get tired of routine, monotony and the fact that they have not seen meaning and useful results in their actions for a long time. This is usually addressed by the fact that you, as an executive, reveal a little to the employee the strategy and goals of the company, including in retrospect - sometimes this helps to look at your work from a different angle.


Disappointment in the profession. IBshnikov also has its own crisis of three years - only it happens plus or minus every three years of work in the field. You definitely have at least one colleague who dreamed of leaving as a gamekeeper in the forest or opening his own farm and never working in information security again in his life. Perhaps you yourself caught yourself on such thoughts. Do not be afraid of this condition, it goes away. Usually switching to something else helps, such as a vacation or a brief change of activity within the team.


Toxicity. Even one toxic person broadcasts his negative vision of work to the entire team, this affects the work of the entire team and its motivation. Here it is important to quickly identify such a person and say goodbye to him in time.


Hunting. Yes, often your employees will think about changing their place of work only because the resume they left three or five years ago somewhere fell into the hands of another recruiter. But usually, if everything suits subordinates in the current place, they don't even go "just to talk." So if the interview did happen, the problem is complex and the employee is worried about something else.


Stagnation is one of the not most obvious, but understandable reasons for leaving. It's a situation where people feel like they've stopped developing. This is especially common among people who work in vendor companies - often engineers think that, working with one product or a line of products from one vendor, they do not develop in any way as specialists in the market. That's not exactly true. From the perspective of the vendor, including, project activities are tied both to interaction with customers and integrators, and to interaction with other vendors. Hence the opportunity to pump your skill. Moreover, it is in the vendor that it becomes possible to make their competencies more narrowly focused and pumped due to the fact that there is time for research activities.


Biases. If you did not adhere to the tactics of transparency in motivating your decisions, then the employees will definitely think of everything for you. And now, at first glance, a harmless decision turns into the fact that the subordinate begins to consider the entire company as enemies, and himself - obliged to find a new place.


In order for the team not to feel uncomfortable, it is imperative to regularly communicate and identify current problems. If something pointwise does not work out with a specific employee, change the format of work, show the benefits of innovations and actions of the employee himself.


рис 2.png


It is very important not to be a waterfall leader, but to be an umbrella leader. Even if your supervisor is dissatisfied with the work of your department, the worst thing you can do is come and drain all this negativity on your subordinates. Your main task as a leader is not to continue this stream of negativity below, but to competently filter it, conveying only constructive criticism to employees, if any.


If you did nothing out of good advice, but were guided only by bad advice, sooner or later an employee will come to you with a statement and an offer, or maybe more than one.


Errors:

   -   You keep extra people in the team.

   -   Do not let subordinates develop.

   -   Make hasty conclusions about the subordinates.

   -   Do not track the status of subordinates.


Making it to the offerer


An employee brings you an offer and you have this reaction:


рис 3.png


But wait, this is not entirely bad, excluding, of course, those situations when they try to manipulate you with the help of an offer. An offer from an employee may be his last attempt to somehow communicate with you, enter into a dialogue and discuss the accumulated problems and expectations from work. Most likely, before that, some mistakes were made in communication on your part or on the part of the employee. What is good in this situation is that it is you who can influence this.


Preventive measures are very important in order to have time before this offer:

   -   Your honesty and openness with the team, it is necessary to motivate the team and form goals, not only individual, but also team. And even if it is too late to apply this, then the conversation is still not useless - understanding mistakes will help to avoid them in the future, even if with other people.

   -   Search for causes that can become demotivating factors. And you, as a leader, need to try to eliminate these reasons in a timely manner.

   -   Feedback on work for employees and regular meetings, conducting a review of the employee's work, during which you will both highlight the strengths of the person, and share and listen to constructive criticism.

   -   Do not arrange public vice. Remember the main thing: we praise everyone, but we report only in person. Not only does this affect the specific subordinate in question, but also all other subordinates see and remember it perfectly.


At the very beginning of the article, we emphasized that we are considering retaining the team until the moment when a person already brings us an offer. In fact, it is not too late to communicate with a person here. Even if a person eventually leaves, even if he does not immediately tell you the truth about the reason for his departure, this is still the right moment to look back, understand what you did wrong and somehow fix it in the future, even with new people.


However, if you continue to ignore this and immediately say goodbye to people without communication, then your employees will only have more offers, and sooner or later you will have to do something about it.


Errors:

   -   You did not communicate regularly with subordinates and did not exchange feedback.

   -   Ceased to understand the problems of subordinates.

   -   Immediately fired a person without talking (even if he really needed to be fired) - this sets a precedent for your other subordinates who will follow a bad example and will not communicate with you until the final decision to leave is made.


Do well and don't do badly


Team retention is not about universal recipes. This is about observation, regular communication and willingness to change. Being around - even when everything is not going according to plan. And most importantly - to do consciously: less harm, more benefit. And then the team will stay with you not because of fear, but by conviction.


рис 4.png


Recommended

Scenarios of untyped UEBA attacks
Scenarios of untyped UEBA attacks
No - code development and ML assistants are the next generation of SOC analyst tools
No - code development and ML assistants are the next generation of SOC analyst tools
What is a cyber incident - in simple words about a complex threat
What is a cyber incident - in simple words about a complex threat
Bug Bounty How to turn curiosity into earnings
Bug Bounty How to turn curiosity into earnings
Business games of the Knights of the Round Table
Business games of the Knights of the Round Table
Deep Packet Inspection (DPI) - what is it?
Deep Packet Inspection (DPI) - what is it?
How regreSSHion opened a new chapter in old OpenSSH attacks
How regreSSHion opened a new chapter in old OpenSSH attacks
Features of the new version of the Vulnerability Management (VM) product on the Security Vision 5 platform
Features of the new version of the Vulnerability Management (VM) product on the Security Vision 5 platform
How Zeek and Malcolm help you not only passively analyse network traffic, but also respond to threats in a timely manner
How Zeek and Malcolm help you not only passively analyse network traffic, but also respond to threats in a timely manner
Technical knowledge of a first-class SOC specialist
Technical knowledge of a first-class SOC specialist
Security Vision SOAR and NG SOAR Upgrade Capabilities
Security Vision SOAR and NG SOAR Upgrade Capabilities
Certification and safe development: in simple language
Certification and safe development: in simple language

Recommended

Scenarios of untyped UEBA attacks
Scenarios of untyped UEBA attacks
No - code development and ML assistants are the next generation of SOC analyst tools
No - code development and ML assistants are the next generation of SOC analyst tools
What is a cyber incident - in simple words about a complex threat
What is a cyber incident - in simple words about a complex threat
Bug Bounty How to turn curiosity into earnings
Bug Bounty How to turn curiosity into earnings
Business games of the Knights of the Round Table
Business games of the Knights of the Round Table
Deep Packet Inspection (DPI) - what is it?
Deep Packet Inspection (DPI) - what is it?
How regreSSHion opened a new chapter in old OpenSSH attacks
How regreSSHion opened a new chapter in old OpenSSH attacks
Features of the new version of the Vulnerability Management (VM) product on the Security Vision 5 platform
Features of the new version of the Vulnerability Management (VM) product on the Security Vision 5 platform
How Zeek and Malcolm help you not only passively analyse network traffic, but also respond to threats in a timely manner
How Zeek and Malcolm help you not only passively analyse network traffic, but also respond to threats in a timely manner
Technical knowledge of a first-class SOC specialist
Technical knowledge of a first-class SOC specialist
Security Vision SOAR and NG SOAR Upgrade Capabilities
Security Vision SOAR and NG SOAR Upgrade Capabilities
Certification and safe development: in simple language
Certification and safe development: in simple language