Introduction

Kevin Qiu, a seasoned Information Security Professional, joins us on the latest episode of Risk Grustlers to share his journey from Big Four consulting to tech startups, offering invaluable insights on building effective security programs on a limited budget.

Don't miss Kevin's practical tips for adapting security infrastructure, managing compliance, and tackling challenges unique to small and medium-sized businesses. Tune in for a masterclass on must do’s when building a security strategy!

Description

In this episode, Kevin offers a unique perspective on the differences in security infrastructure between large enterprises and startups, highlighting the need for adaptability in smaller companies.

Kevin delves into the key areas mid-sized companies should focus on when building an effective security program, emphasizing practical steps and strategic planning. 

He also addresses the common perception that compliance is merely box-ticking, discussing its true value and importance in maintaining robust security.

Tune in to uncover practical tips for building a robust security program in small to medium-sized companies. 

Highlights from the episode

• Kevin’s career transition
• Challenges in startups vs. large enterprises
• Building a security program in mid-sized companies
• Compliance vs. real security

Quotes

• “Don’t just buy any tool off the shelf because you need one specific feature. That is how your budget becomes bloated. If you can develop it in-house, if it makes sense to do so, then do that before you go and spend money on it.”

• “One common mistake among startups is neglecting to maintain compliance post-certification. Many overlook the continuous monitoring required, leading to frantic efforts to catch up during surveillance audits.”

• “Startups often rely heavily on third-party tools. Knowing your vendors is crucial. If a vendor is breached and you didn't even know your team used them, you're in big trouble.”

About Scrut Automation

Scrut Automation is a risk observability and compliance automation platform built to simplify information security monitoring for cloud-native companies. We help early-stage and growth-stage companies worldwide establish enterprise-grade information security processes through an easy-to-use GRC platform.

To watch more of our episodes and learn more about us, visit us at https://www.scrut.io/podcasts

About Scrut Automation:
Scrut Automation empowers scaling companies to move Beyond Compliance, focusing on managing digital risk while reducing the friction of audit preparation, evidence collection, and risk monitoring.

Purpose-built for high-growth startups and mid-market businesses, Scrut simplifies the most tedious parts of compliance and risk management, keeping you audit-ready and risk-aware at all times. With seamless integration into your processes, Scrut delivers real-time insights and continuous monitoring, enabling proactive risk management to support sustainable growth. Focus on scaling your business confidently as Scrut automates compliance and strengthens your digital resilience—no more manual work or compliance chaos.

To watch more of our episodes and learn more about us, visit us at :
https://www.scrut.io/podcasts