# Team Profile Document

This document describes the team characteristics relevant to security playbook development.

## Team Overview

### Team Structure

- **Size**: 5 core technical team members (primary security stakeholders)
- **Location**: Remote-first (分散 across 3 time zones)
- **Experience Level**: Mid to senior (3-8 years experience)

### Team Members and Roles

#### Alex (DevOps Lead)

- **Role**: De facto security owner, primary decision-maker
- **Skills**: AWS, infrastructure, automation, some security
- **Time Available**: 10 hours/week for security
- **Strengths**: Technical implementation, system design
- **Weaknesses**: Limited security formal training, too many responsibilities

#### Jordan (Senior Engineer)

- **Role**: Application security, code review
- **Skills**: Full-stack development, secure coding practices
- **Time Available**: 5 hours/week
- **Strengths**: Code-level security, developer perspective
- **Weaknesses**: Prefers development over process work

#### Taylor (Junior Engineer)

- **Role**: Implementation support, testing
- **Skills**: Modern development, eager to learn
- **Time Available**: 8 hours/week
- **Strengths**: Quick learner, detail-oriented
- **Weaknesses**: Limited security experience

#### Morgan (Engineering Manager)

- **Role**: Process, policy, team coordination
- **Skills**: Team management, process improvement
- **Time Available**: 3 hours/week
- **Strengths**: Organization, communication
- **Weaknesses**: Non-technical background

#### Casey (Part-time Contractor)

- **Role**: Advisory, periodic review
- **Skills**: Security architecture, compliance
- **Time Available**: 4 hours/month (limited)
- **Strengths**: Deep security expertise
- **Weaknesses**: Limited availability

## Technical Proficiency

### Strengths

- Modern software development practices
- Cloud infrastructure (AWS)
- Version control and CI/CD
- Automation and scripting
- Collaborative tools (Slack, Notion, etc.)

### Weaknesses

- Limited security formal training
- No one with security certifications
- Limited incident response experience
- No dedicated security tooling expertise
- Policy development experience

## Work Patterns

### Communication

- Primary: Slack (async-first)
- Secondary: Zoom (weekly team meetings)
- Documentation: Notion

### Availability

- Core hours: 10am-2pm EST (all available)
- Outside core hours: Varied
- No on-call rotation currently

### Decision-Making

- Technical: Consensus with Alex having final say
- Process: Morgan facilitates, team validates
- Security: Alex makes most decisions with Casey consultation

## Training and Awareness

### Current Training

- No formal security training program
- Occasional security articles shared
- No designated training budget
- Some AWS security training completed by Alex

### Required Training Topics

- Phishing recognition (all team)
- Password hygiene (all team)
- Secure coding practices (engineering)
- Incident recognition (all team)
- Data handling (all team)

## Roles and Responsibilities

### Current State (Informal)

- Alex: Overall security ownership
- Jordan: Application security focus
- Taylor: Implementation support
- Morgan: Process support
- Casey: Advisory role

### Desired State (Formalized)

- Define clear ownership for each security domain
- Create escalation paths
- Establish reporting cadence
- Define decision rights

## Collaboration Needs

### Internal

- Weekly security check-ins (30 min)
- Monthly security reviews (1 hour)
- Quarterly security planning sessions

### External

- Casey's monthly advisory calls
- Customer security questionnaires (as needed)
- Insurance broker coordination

## Success Indicators for Team

1. Team feels confident in security responsibilities
2. Clear escalation paths established
3. Reasonable workload distribution
4. Regular communication cadence
5. Measurable security improvements
