How to Build a Security Team from Scratch Without Overspending

How to Build a Security Team from Scratch Without Overspending

Most growing businesses reach the point where they know they need to take security more seriously, but have no template for what "doing security properly" looks like at their scale. The enterprise security organisational model — a Chief Information Security Officer, a Security Operations Centre, a red team, a blue team — is not appropriate or affordable for a 100-person company. And a single "security person" doing everything produces a person who is spread too thin to do anything well.

This guide covers what security functions growing businesses actually need, in what order to build them, and when outsourcing is more appropriate than headcount.

Start with an Honest Assessment of Your Risk Profile

Before making any hiring decision, understand what you are actually trying to protect and what the real threat vectors are for your specific business.

What data do you hold? Customer personal data, payment card information, health data, legal records, and intellectual property all have different sensitivity levels and regulatory implications. The risk profile of a company that stores medical records is fundamentally different from one that stores marketing email preferences.

What regulations apply? GDPR, PCI DSS, HIPAA, SOC 2 requirements — the regulatory environment you operate in determines non-negotiable minimum requirements.

Who would attack you? Most small and mid-size businesses are not targeted by nation-states or sophisticated organised crime groups. They are targeted by opportunistic attackers looking for easy wins: unpatched systems, exposed credentials, phishing-susceptible employees. A security programme calibrated to your actual threat actors is more effective and more affordable than one designed for enterprise threats.

What is your current baseline? If you have no MFA, no vulnerability scanning, and no security monitoring in place, the highest-return investments are not in hiring people but in implementing basic controls. People cannot substitute for absent controls.

The Security Functions You Need to Cover

Security is not a single role. It is a collection of functions that can be distributed across people, tools, and outsourced providers in different proportions depending on your scale.

Security architecture and engineering: Designing your systems to be secure — infrastructure configuration, network security, application security requirements. This requires understanding both security principles and your specific technology stack.

Security operations: Monitoring for threats, reviewing alerts, investigating suspicious activity. This function never sleeps. A company running 9-to-5 security monitoring has unmonitored attack surface for 16 hours a day.

Incident response: Responding when something goes wrong. Detecting, containing, eradicating, and recovering from security incidents.

Vulnerability management: Scanning for vulnerabilities, tracking remediation, ensuring patches are applied.

Compliance: Maintaining the documentation, controls, and evidence required for regulatory compliance and customer audits.

Security awareness: Training employees, running phishing simulations, embedding security practices into how people work.

Application security: Reviewing code and architecture for security issues, integrating security testing into the development process.

Most businesses at the 50 to 150 employee stage cannot afford full-time headcount for each function. The sequence below prioritises by impact.

Phase 1: Foundational Controls Before Any Hire

Before spending money on headcount, implement the controls that are table stakes:

• MFA on all systems without exception
• A password manager deployed across the team
• Endpoint detection and response (EDR) on all devices (CrowdStrike, SentinelOne, or Microsoft Defender at the SMB tier)
• Automated vulnerability scanning on your infrastructure (Tenable, Qualys, or the native scanning in your cloud provider)
• Email security (DMARC, DKIM, SPF configured; an email security gateway if phishing is a significant risk)
• Patch management: a documented, enforced process for applying security updates

These controls do not require a security hire to implement. They require budget ($500 to $3,000 per month for a 50-person company) and the time of an existing technical team member.

Once these are in place, you have a baseline that makes a security person's time meaningful rather than spent implementing basics.

Phase 2: First Security Hire or Virtual CISO

Your first security person needs to be a generalist who can cover multiple functions. This is the "security engineer" or "information security manager" role — someone with enough breadth to establish a security programme, and enough depth in the areas your risk profile requires most.

At the 50 to 100 employee stage, the right first hire can set up and run your vulnerability management programme, write and maintain your security policies, manage your SOC 2 or ISO 27001 programme, conduct security awareness training, respond to customer security questionnaires, and escalate to external experts when incidents require depth they do not have.

What they should not be doing: monitoring security alerts 24/7 (this requires a tool or an MSSP), performing penetration testing (outsource this), writing all the application security requirements (development teams need security embedded in their process, not a gatekeeper reviewing everything after the fact).

Salary range (AU/UK/US/CA): $90,000 to $140,000 for an information security manager with 5 to 8 years of experience. In Pakistan, equivalent experience is available at $25,000 to $45,000.

Phase 3: Outsource What You Cannot Justify In-House

Several security functions are more economically delivered by specialised providers than by headcount.

Managed Security Service Provider (MSSP). 24/7 security monitoring, threat detection, and initial incident triage — outsourced to a team whose entire job is monitoring. For most businesses at the growth stage, an MSSP ($3,000 to $15,000 per month depending on scope) provides better coverage than a one-person in-house security team trying to cover all hours.

Penetration testing. Commissioned annually or after major releases. Outsourced to a specialist firm because the skills required are not needed full-time and are hard to develop in-house.

Security awareness training. Platforms like KnowBe4 or Proofpoint provide automated phishing simulations and training content for $15 to $30 per user per year — significantly cheaper than building this internally.

Compliance automation platforms. Vanta, Drata, or Secureframe automate the evidence collection and monitoring for SOC 2 and other compliance frameworks, reducing the human time required to maintain compliance.

Phase 4: Building a Security Team Beyond One Person

When do you add a second security person?

The trigger is almost always specialisation: when your first security hire is stretched across too many functions and the business risk requires depth in a specific area.

Common second hire scenarios:

• Application security engineer: If you are building complex software and the development team needs embedded security expertise, a dedicated application security engineer who reviews architecture, runs SAST/DAST tooling, and works within the development process
• Security operations analyst: If your monitoring volume has grown to the point where an MSSP is not the right model and you want in-house analysts
• Compliance specialist: If your regulatory burden (multiple frameworks, significant customer audit requirements) justifies dedicated headcount

The penetration testing guide covers what to look for when commissioning external security assessments — which remains the right model for most growing businesses even when they have internal security staff. The cybersecurity incident response plan guide covers the process your security team needs to have ready before they need it.

For businesses that need security expertise without the cost of permanent headcount, our cybersecurity services cover everything from initial assessments to ongoing security programme support. Contact us to discuss what your specific situation requires.