Project snapshot
This proposal frames security awareness as an operational control, not just annual training. It connects employee behavior, monitoring gaps, access governance, and executive sponsorship into a structured program that reduces avoidable security risk.
Problem addressed
The proposal responds to an organization with weak security training, limited visibility, inconsistent governance, and risk exposure tied to phishing, data handling, insider risk, and poor escalation readiness.
Recommended program structure
| Area | Recommendation | Operational value |
|---|---|---|
| People | Annual security awareness training with quarterly phishing simulations | Builds practical user habits and gives leadership measurable behavior data |
| Process | Stronger policy review, access accountability, and escalation expectations | Clarifies who owns risk decisions and when issues need formal response |
| Technology | Centralized logging, SIEM planning, and stronger access-control review | Improves detection, investigation quality, and response consistency |
Implementation roadmap
- 0–3 months: Launch required training, define phishing simulation cadence, and identify logging priorities.
- 3–12 months: Formalize metrics, strengthen role-based access review, and prepare SIEM or centralized logging improvements.
- 12+ months: Review outcomes, refresh content, and continue leadership reporting so the program remains active instead of becoming a one-time policy exercise.
What this proves
I think this project shows that I can translate security risk into a practical program that leadership can approve and technical teams can support. It also demonstrates how I connect human factors, governance, monitoring, and implementation planning into one operational security approach.