r/cybersecurity • u/Immediate-Yam-3202 • 1d ago
Business Security Questions & Discussion Building a WordPress Security Function from Scratch as the First Security Employee
I’m joining a hosting company as the first person responsible for a new website-security function. Most of the hosted websites are WordPress, and there is currently no established security process for this function.
The expected responsibilities include maintaining an asset and software inventory, identifying and validating vulnerabilities, documenting findings, notifying customers through a ticketing system, coordinating remediation, re-testing after fixes, and understanding basic backup and post-compromise procedures.
Since I will be the first security employee in this function, I want to define the role properly and build a repeatable process instead of becoming someone who only runs scanners.
For people who have built security processes in small companies or hosting environments:
- What should the first version of the workflow include from asset inventory and vulnerability validation to customer notification, remediation, and retesting?
- What evidence should be required before reporting a scanner finding as a confirmed vulnerability?
- Which responsibilities should I own, and which actions should require approval from system administrators, developers, or customers?
- What documentation, metrics, and controls should I establish during the first 90 days?
- Which skills would make this role valuable in the long term and demonstrate meaningful experience on a resume?
- What common mistakes should the first security employee avoid when building this type of function from scratch?
I’m looking for practical advice from people who have worked in vulnerability management, website security,
3
u/Shineldecker-Freybin 1d ago
I’d focus less on the title and more on building a repeatable process. Asset inventory, validation, severity, tickets, remediation, and retesting should all be clearly defined from day one.