No one likes the sappy I’m such a good manager look at me manage with my great insights post. But every now and then I learn something and I think other people who are moving from a technical resource to a leader may gain insight or value from it. So I share here.
Civilian corporate leadership has been a whole different bag than military leadership. In the Army, most of my unit was planned out months or even years in advance. The yearly or every other years National Defense Authorization Act would determine number of US Military personnel and to a point, the number of planes, trains, tanks, etc.. that we’d have access to. This would trickle down to define your TOE or Tables of Organization and Equipment. This list defines what assets you’ll have access to as a leader.
So what’s left to manage at that point? Like any leader, you’re responsible for your people. The morale and development of your troops and their basic resources, beans and bullets. But the number of people you need, and the services you offer? That’s predefined.
In IT and Security, we get to develop those resources. We may have direction from directors or vps as to what our programs should look like. But generally, we get to help decide the momentum and services of the organization. Will you offer vulnerability services? How many people will that take? What does success look like?
And not only do we get to develop the services, we also have to decide how many and what kind of people make this success likely.
In this thinking, we might say, we need one person to do vulnerability management, detection and response (vmdr), one person to do patching, and one to do cloud security. And for resilience, maybe we’ll just cross train all these people. Then we can split their time like so.
| Time Spent on… | VMDR | Patching | Cloud | Total Time |
|---|---|---|---|---|
| Alice | 80% | 10% | 10% | 100% |
| Bob | 10% | 80% | 10% | 100% |
| Charlie | 10% | 10% | 80% | 100% |
Fig 1, Capcacity Planning Table
Managing employees time is an interesting part of the work. Most people are self-organizing, but you still have to assess whether employees are putting enough time into the right areas to drive the right outcomes.
In our above figure, we might think, great all our employees are being utilized at 100% and we even manage to have a little coverage built in. If the volume of work gets too high for Bob or Alice, Charlie can step in and pick up a little of the work! But lets see what happen if Bob takes vacation, or win’s the lotto, or God forbid, gets hit by a bus.
| Time Spent on… | VMDR | Patching | Cloud | Total Time |
|---|---|---|---|---|
| Alice | 80% | 50% | 10% | 120% |
| Bob | 0% | 0% | 0% | 0% |
| Charlie | 10% | 50% | 80% | 120% |
Well that doesn’t look right. Given our previous expectations, we had people availalbe to cover for each other. No one was at 100%. And we’d cross-trained all our people.
People like systems can’t run at 100% for long periods of time, or they’ll break down. And systems and people definitely can’t run at 120% for any succesful amount of time.
Being part of a management team means you have to recognize this utilization issue, plan for it, and mitigate it, or get the senior leadership team to “Accept the risk”.
The manager and the executive are at cross purposes here though. The executive, driven by profit and shareholders, wants the leanest crew possilbe. The manager wants the happiest and most effective crew possible.
Lets see what it looks like if we add another employee who can help split the load.
| Time Spent on… | VMDR | Patching | Cloud | Total Time |
|---|---|---|---|---|
| Alice | 50% | 15% | 15% | 80% |
| Bob | 15% | 50% | 10% | 80% |
| Charlie | 15% | 15% | 50% | 80% |
| Deborah | 30% | 20% | 30% | 80% |
And now we have breathing room! This gives employees time for training, documentation, morale building, all those things that can’t be accomplished if we’re running our team at max output all the time.
And lets put Bob back on vacation.
| Time Spent on… | VMDR | Patching | Cloud | Total Time |
|---|---|---|---|---|
| Alice | 50% | 30% | 20% | 100% |
| Bob | 0% | 0% | 0% | 0% |
| Charlie | 20% | 30% | 50% | 100% |
| Deborah | 30% | 50% | 20% | 100% |
Look at that! It’s not an ideal situation, but all of a sudden, our team is able to handle a teammate going on vacation, or a lotto win, or maternity/paternity leave.
This isn’t a huge insight, but I hope you can see how building teams with excess capacity is relevant and necessary for your teams long term success. Any part, person, or process can “run to failure” but its not a sustainable long term business model.