Organising a Security Function: Centralised, Embedded or Federated

About this course

A course for the security leader who is choosing, or more often changing, how a security function is organised, treated as an engineering decision with real trade-offs rather than a diagram exercise. It states plainly what each of the three shapes optimises and what each costs: centralised buys consistency and a defensible audit trail at the cost of a bottleneck and distance from the work, embedded buys context and speed at the cost of drift between teams and career isolation for the person embedded, and federated with a small core plus champions buys reach without headcount at the cost of depending on goodwill that can evaporate the moment a deadline tightens. It works through what actually decides the choice, company size and the ratio that matters more than headcount alone, engineering culture, regulatory load, geography and time zones, then treats the reporting line as an honest, separate decision: security into engineering versus security into risk, what each buys and what each costs, and where a matrixed or dotted-line structure is genuine and where it is decorative. Because most readers are changing a shape rather than choosing one from nothing, the course spends real time on the transition itself: diagnosing the shape actually running beneath the org chart, where trust is lost during a reorganisation, and how to sequence change so a quarter of silent sabotage does not follow the announcement. It closes on what reliably does not work, a centre of excellence nobody consults, champions with no protected time, a shape copied from a company ten times the size, and two anonymised, illustrative worked cases at different company scales applying the same method to very different circumstances.