Senior Security Engineer: metrics definition for an IS program

Delta Airlines is a global leader in passenger and cargo air travel, operating over 5,000 flights daily across six continents and serving more than 200 million customers annually. With major hubs in Atlanta, Detroit, and Minneapolis, the company is recognized for its innovative strategies, including an industry-leading on-time performance rate of 87% in 2022. Delta invests over $1 billion annually in safety enhancements, such as advanced aircraft maintenance protocols and pilot training programs, and consistently ranks high in customer satisfaction surveys.

Delta Airlines employs cutting-edge technologies like predictive analytics for flight scheduling and a multi-layered cybersecurity framework to manage its vast operations. This includes processing over 10 million security events daily and deploying endpoint protection tools across 50,000 devices. However, in 2023, a significant data exposure incident compromised sensitive customer information, affecting 1.2 million individuals. This led to regulatory investigations, a $25 million fine, and mandatory compliance audits. The breach caused a 15% drop in customer trust scores and a 10% decline in bookings, prompting Delta Airlines to set ambitious goals to rebuild trust and enhance cybersecurity resilience.

As a Senior Security Engineer at Delta Airlines, you are tasked with defining actionable security Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for the company’s executive dashboard. Reporting directly to Susan Caldwell, the Chief Information Security Officer (CISO), you will engage in real-time conversations to propose metrics that align with regulatory requirements, operational goals, and risk transparency.

You must address resistance from Marcus Patel, the Senior Operations Manager, who has concerns about the operational feasibility of certain metrics. Your role involves navigating competing priorities, fostering collaboration, and proposing a sustainable process for regularly updating the metrics to ensure their ongoing relevance. Success requires balancing technical precision with strategic alignment while addressing stakeholder concerns diplomatically.

• Engage in real-time conversations with Susan Caldwell to propose measurable security KPIs and KRIs that align with regulatory requirements and organizational priorities.
• Address Marcus Patel’s concerns by presenting evidence-based solutions that mitigate his objections and ensure the metrics are fair and actionable.
• Propose a sustainable process for updating the metrics to maintain their relevance and effectiveness over time.
• Successfully deliver metrics that meet regulatory expectations and contribute to rebuilding trust among stakeholders.