What a startup needs from its first security engineer
Everything to build in year one, in order. Click any item for the steps and tools.
Only have a week? Start here. Ten jobs that close the most common ways startups get breached.
The roadmap
How the work moves
The roadmap is the order you first build things in. After month 12 the same loop keeps running.
Discover
Inventory, scans, data maps, vendor lists, pentest results, incidents.
Triage
Each gap becomes a ticket with a severity, an owner and a due date.
Fix, then guard
Fix it, then add a CI check, policy or process so it can't come back.
Verify
Retest, collect evidence for the audit, show customers.
Monitor
Alerts, access reviews, metrics. New signals go back to 01.
How mature is the program?
Tier names follow NIST CSF 2.0. A program is only as mature as its weakest domain. This is a guide, not an assessment.
Tools by job
You don't need most of these. Pick one per job, start with what's free or built in, and pay when the free option stops scaling. Listing is not an endorsement; check prices yourself.