How to hire and build your cybersecurity team

The institutional approach to cybersecurity hiring has undergone a fundamental reset as early-stage founders confront the reality that data protection and InfoSec must operate as table-stakes from inception. Jason Chan, who spent significant tenures leading information security at Netflix and VMware before joining Bessemer Venture Partners as an operating advisor, underscores a critical shift in the threat landscape: twenty years ago, security breaches rarely reached the front pages of major financial and news publications. Today, the combination of high-profile data breaches and geopolitical instability has made cybersecurity a routine headline, forcing founders to recognize that a breach is not a question of "if" but "when."

Chan's framework addresses a specific governance gap in early-stage ventures. While founding teams often absorb early cybersecurity responsibilities on a part-time basis, sustainable security functions require dedicated, experienced leadership. The distinction matters: Chan advocates for identifying a first cybersecurity hire who brings both operational breadth and depth across the security field, rather than promoting internal IT personnel or relying on external consultants without vetting rigor. This hire becomes the cornerstone for building a cohesive security organization capable of scaling with the company.

The investment implications extend beyond risk mitigation. For institutional investors and fund managers evaluating early-stage portfolio companies, the presence of a dedicated, experienced cybersecurity officer signals operational maturity and risk-aware governance. Conversely, the absence of such a hire—or the delegation of security to generalist IT staff—represents a material governance weakness that affects valuation multiples, customer acquisition cost assumptions, and regulatory exposure. In environments where customer data has become a primary asset and regulatory frameworks (including those governing privacy, financial services, and healthcare) have tightened, cybersecurity capability now directly impacts a company's ability to scale revenue and maintain customer trust.

Chan's "green flags" framework provides institutional stakeholders with a diagnostic tool for evaluating management depth and risk preparedness across portfolio holdings. By establishing clear expectations for cybersecurity hiring and team composition from the earliest stages, founders reduce the probability of reactive crisis management and the financial damage associated with post-breach remediation.