---
title: "Information technology and security"
description: "IT and security reporting structures, admin access policies, and organizational placement"
url: "https://www.rubick.com/wiki/people/it-and-security/"
---

[Edit this page on github](https://github.com/jadeforrest/blog/edit/master/src/content/wiki/people/it-and-security.md)

[Wiki](https://www.rubick.com/wiki/) / [People Management](https://www.rubick.com/wiki/people/) / Information technology and security

# 🔒Information technology and security

IT and security reporting structures, admin access policies, and organizational placement

## Where IT and security report in to

-   “As an IT manager myself, I have reported to CTOs (10 employee startup many years ago), and COO and then later CFO (300 employee non-software company)”
-   “Our IT currently reports in through our centralized strategy & ops function, before that it was through the CISO who reports to head of Eng, before that I think it was somewhere in G&A”
-   ”(~150 employees, ~20m ARR): IT & Security -> VP of Engineering worked fine, put both functions along side cloud engineering. I liked a lot of the outcomes that drove.”
-   ”(~1000 employees, Buttloads of ARR): IT & Security -> Legal / COO (TERRIBLE IDEA, slowest, most bureaucratic teams I ever encountered. Also, successfully navigated the business through highly regulated customers and FEDRAMP)”
-   ”(~150 employees, ~40m ARR): IT -> COO - Works fine. It’s a tiny team supplemented with Upwork.”
-   “Security -> CTO. Security handles SOC, Pentests, design review, and supports GTM, including pre-sales and marketing material. At some point I may move IT under Security.”
-   “(120 people) IT & Security -> VP of Engineering. Worked well.”

## Admin access for engineers

How do folks approach admin access to laptops for devs?

-   General concensus has been that it is normal to give admin access.
-   If you want them to manage risk have them take security training. Acceptable use policy.
-   Can be a sticking point on SOC2-ish audits.
-   “We use a tool called Admin By Request on the Mac now, which primarily exists to make the user exist unprivileged and then grants admin to that user temporarily when you self-serve activate it. Like using sudo instead of always being logged in as root. Unfortunately, it sounds simple, but something about it offends the gods, and so it causes a lot of strange performance issues. On balance, I don’t think it is a win. (But it could be if it worked better.) To prevent installing unapproved software, the endpoint security software builds a list of everything installed and IT puts things on a block list. This used to be rare, but after some spicy incidents, we now immediately ban most things that are not clearly dev related.”

## Security review

-   A couple of my connections detail a process looking like Trust Page -> Solution consultants using automated tooling to fill out most of questionnaire -> Security engineers fill out the escalations and gaps.
-   [Vanta](https://www.vanta.com) for NDA signing, SOC2, etc. Self-serve.
-   [Conveyer](https://www.conveyor.com/) does security questionnaire automation.
-   [Sifthub](https://www.sifthub.io) does some automation of filling out questionnaires. Probably there are other tools as well.
-   [Drata](https://drata.com) similar concept to Conveyer?
-   [Trustmind](https://trustmind.com) one contact I know was evaluating it to hopefully improve automation over others.