Risk and Threat modeling (yes, they are different) are two effective ways to start building out the requirements for your security program. Solutioning through scenarios is like that, with a little more table top exercise sprinkled in. Also, learn how an old model from my Telecom days, the FCAPS model, plays a vital role in how I approach problems and come up with solutions.