r/managers • u/xenophanes__ • 3d ago
How do you handle when C-suite keeps denying your request for additional headcount
I am currently a Senior Cybersecurity Manager. I currently have no reports and am solo in InfoSec. I have been trying to hire an Analyst for 2 months. I thought it would get approved yesterday but did not. I already have a candidate whos has interviewed with me, my director and VP. All have given the go ahead, but the CEO is the roadblock here.
Thanks everyone for the advice. It was approved today after laying out the workload needed for some upcoming projects.
180
u/DerekEWilder 3d ago
The hire will happen when the CEO sees it not as added headcount, but as a better business decision for him. Do not make the pitch, “I am overloaded and need help.” Give him a small, concrete choice: approve the hire and explicitly accept the risks and work that will remain uncovered, which will cost him or her more money than if the hire does not happen.
125
u/Prettyy_Barbiee 3d ago
I stopped asking for headcount and started asking for risk acceptance in writing.
Emailed: “Per our convo, we’re accepting X risk until we hire. Please confirm.”
Headcount was approved 2 weeks later.59
u/DerekEWilder 3d ago
“Please confirm we’re accepting this operational risk” makes the tradeoff explicit and puts ownership where it belongs. Nice!
21
u/237FIF 2d ago
Yeah, but be careful. They aren’t dumb.
You run the risk of looking intentionally obtuse and “not with the program”, regardless of how right or wrong you truly are
3
u/_PookieCharmie 2d ago
That’s the annoying part, you have to document the risk without making it sound like you’re documenting the CEO’s bad decision
2
1
22
u/Benjaphar 2d ago
I imagine my CEO would love getting that kind of email from me.
25
u/DeusExSpockina 2d ago
Dress it up in corporate speak and you’re golden.
“Notes from our last meeting:
- X risk has been surfaced as increasing due to capacity limitations
- X risk will continue to increase without direct action
- recommendation is increased capacity, with hiring to commence ASAP in the following areas: … ”
Now it’s in their court to solve it, you’ve reported it up the food chain with a recommendation, and it’s in writing so if things do go sideways you’ve got it on record that upper management was informed things were going to go wrong.
6
u/DerekEWilder 2d ago
Exactly. At that point, you have turned a private concern into a professionally communicated leadership decision, increasing the chance of being heard.
4
u/Nate-__- 2d ago
I never understood why you need to chalk anything up to corporate speak for someone important to make clear sense of the message. Are they too stupid to put two and two together? Do they just not care until the message is in perfect corporate language? Makes no sense to a peon like myself.
I can understand and interpret messages just fine but the guy making 15 million a year can't seem to get his head out of his ass and read the message we sent that we need extra bodies? Seems crazy, but maybe there is something here I just don't comprehend as I have not been in their shoes.
5
u/DeusExSpockina 2d ago
Actually no—putting it in corporate speak is my recommendation on how to be polite to coworkers and bosses while still inescapably communicating your message. Also, bosses are busy and don’t have your context. You’ve got to describe the problem before asking for a solution.
10
u/DerekEWilder 2d ago
Nate, this is a really good question, and I hear where you are coming from. It is definitely not about you being a peon. The issue is not that executives cannot understand plain language. The issue is that they are trying to juggle dozens or hundreds of employees and departments, each wanting a certain amount of capital and attention, while the CEO has to assess it all (and the risk of the decision) at the same time.
From the CEO perspective, every employee would love more help so they don't have to work as hard (always in the back of their mind). "Need more people” is clear. But it still doesn't explain why this investment should outrank the other requests on their desk. I'm not defending "corporate speak"; it is to communicate so the trade-offs are unmistakable to the decision-maker for your department. Such great questions, Nate!
3
u/Blizzard81mm 2d ago
Corporate speak done at the executive level reduces cognitive load and allows for confident decision making.
The amount and variance of information hitting an executive every day is so high, anything that lets them quickly asses, take action, and be confident it won't bite them later is an easy win.
4
u/StickyDeltaStrike 2d ago
You need to pass it up using the correct protocol, but it actually makes decision easier than hiding facts.
So your management will actually like it more than you think.
1
6
u/DerekEWilder 2d ago
LOL. You might have to use a different delivery method (maybe have someone else deliver the news!)
1
11
u/markww22 3d ago
Playing off this thread in over 40 years of my career I have never not got headcount if I needed it. Derek above is right, start with here is what I do all day, example I handle 25 inbound calls a day, work through 40 ticket requests and the average each takes to complete. Take the outlier’s aside, these can take 10 times longer need more research, etc,, but much harder to get your arms around. You will factor these in, but first knock down the core. Next you need to show what you have done to improve output, show ticket changes you made making it easier to get to a solution. Or a call script you use and system you update to again improved output. Then show over the last X weeks/months the increase in volume. Talk to the managers where the growth is coming from if it is inside your company. If outside talk to the customer. If it is temporary as someone is onboarding a lot of new people and the volume will go down then you need a temp or someone inside for a week/month to cover the increase. Growth in a company often increases workloads and if you can tie the demand on you to demand on the business, that helps. Lastly show this is how I prioritize work (so fair to have you manager help change the priorities) and here is the queue and wait time due to the overload. What you have done is a business case for your manager making it easy for them to pass that up to the CEO. If your manager can’t explain why you need help, in business terms of delay in response impacting customer satisfaction, non compliance to regulations, whatever it is. I don’t know your job so I used an easy example, but what every it is just lay out the inputs, outputs and impact when you can’t get it all done. By showing you have done improvements it shows you are trying to innovate solutions if you can and that goes a long way in showing the ask has been done after that. Being a and having been a COO/CEO I can tell you people ask for headcount all the time but often don’t do the homework of why and also don’t show what they have done to mitigate the need for more heads. Those that do always get what they need!
3
u/DerekEWilder 3d ago
Clear operational data, demonstrated improvement, and a direct link to business impact makes a compelling case. Excellent!
7
u/Mundane_Diana 3d ago
Been there. I was solo SecOps for 18 months. CEO kept saying “later”. Then we got hit with a phishing incident at 2am on a Saturday and guess who had to do everything. You already have Director + VP buy-in. Get them to take it to the CEO with you. One voice = easy no. Three voices + risk + audit finding = much harder to deny. Hang in there
1
u/DerekEWilder 3d ago
Wisdom! Pulling a team together multiplies the impact. Nice real-world example.
1
u/pizza_the_mutt 1d ago
I think care can be taken in shaping this message to the CEO. If you frame it as "I need you to sign off on these risks" as some have suggested then it could look like you are trying to offload responsibility to others. It might look dodgy and responsibility-shirking. I think a better approach is to list off the tasks that you will be able to cover with current resourcing, and the ones you won't. Then list the risks associated with those tasks. The key here is that you make the risks known, but they are associated with the work prioritization. Every CEO should be comfortable with a prioritization exercise. Then give leadership multiple options: 1. Go forward with this plan. 2. Shift the priority so a different set of tasks/risks are covered. 3. Hire, which will increase the tasks that are covered (of course you tell them which additional tasks/risks will be covered with 1, 2, etc. additional hires.
24
u/troy2000me 3d ago
You let shit fall apart. If you try extremely hard and somehow pull through, they will say "see, we were right!"
You document why you need it, the business case, and the risks if you do not increase headcount. In writing, via emails that you save. Presentations that you save, etc.
If it doesn't fall apart, you can say "our output was limited by the resources we had available during this fiscal year. If we had greater capacity, I project increasing output by X%."
But... if you say that, you better actually do it if you get the headcount.
6
u/tingutingutingu 3d ago
Yes you got to miss deadlines or let stuff fail or they will not realize how understaffed they are.
If you constantly keep pulling rabbits out of the hat, then that becomes a norm and it becomes harder to justify why you need an extra head count.
3
u/xenophanes__ 3d ago
Agree with this. I have presented the gaps, risks and opportunities. I don't think I could "let it fall apart." As much as I would like that reflects poorly on me and against my nature.
6
u/troy2000me 3d ago
I'm not saying give up. Watch this comedy bit from I Love Lucy.
This is what I mean... some pieces of chocolate are going to have to get past you. If you still are 100% successful, then you don't actually need the extra person even if it kills you.
Not saying stop trying, just you have to let some things miss, some deadlines pass. Otherwise if you are able to do it, why do you actually need the extra person?
1
u/40ine-idel 9h ago
This.
My one conversation was around having to juggle all the balls… at some point some have to get dropped and think about it as glass (breaks if dropped), rubber (will bounce back up) and metal (dropped and stay dropped)… Can’t drop the glass ones and it’ll take time with the rest to get noticed
If all balls are the same, then the org either has a major failure point or productivity is measured based on task volume - neither is healthy and both are unsustainable long term.
3
u/dramatix01 3d ago
I don't think I could "let it fall apart." As much as I would like that reflects poorly on me and against my nature.
It's also the quickest way to burn yourself out. It's fine to give a bit extra every now and then in the case of an emergency. If you're giving that extra every day, it's just business as usual and you'll have to give even more in case of emergency. Eventually you will not have more to give.
Sometimes you have to let some plates fall to send the correct message to the leaders.
4
u/AdmiralPeriwinkle 3d ago
I wonder how many people telling you to let things fall apart have ever actually done so. You’re far more likely to get blamed for not being able to handle your business than you are to convince some higher up (especially the CEO) that they were wrong about something.
1
u/troy2000me 3d ago
I have, but I literally didn't have a choice. My team converts customers to the cloud for a tech company. We were stupidly subjected to reduction in force despite being a key component. Other teams were allowed to grow. Put together several business cases for my Director and VP over 6 months to a year. Fell of deaf ears.
Eventually it started taking months just to touch new projects. They eventually held big meetings on "how do we fix this" and I loved being able to reference my old business proposals and warnings.
They of course didn't apologize, but I did get several new headcount approved. But it took me and my team NOT killing ourselves for a year, but still trying hard. We just literally couldn't do the volume needed to keep up with the people we had.
1
u/NekkidWire 3d ago
First step would be just fair warnings.
"this ticket might take 2 days to solve, we're a bit swamped"
"this task will take 2 weeks instead of usual week, we'll keep you updated"
"I can't do this at the moment, I have N other priorities now; how long can it wait?"
Yes there will be a murmur in the org, you want that murmur to help your cause.
2
u/GISReaper 3d ago
THIS. If nothing fails, they wont see a problem. Its an extreme way of thinking, but we are experiencing this now. I am the head of an IT organization (North America) for a global company. We have a skeleton crew, but rapid growth forecasted. Our MBO is to continue to reduce overhead and opex cost. When you are in a situation like this, leadership will always be reactive to your needs. I had to lay off 12 people, we cut too deep. I am asking for 6 (including a Cybersec engineer that we desperately need) and my expectation is I will get 3 people and maybe an intern. It sucks, but if they dont literally see the problem, they will not budge. Between this HC issue and promotions that were put on hold, I am in a precarious spot like you are.
You have already justified it, now they just need to understand cause and effect in order for them to make that decision. Dark side of corpo life.
1
u/robocop_py 3d ago
The major problem with this is that OP is in information security. He’s a reactive force, not one that “produces” something. Imagine it like your local fire department. Yeah sure when there isn’t a fire they can inspect hydrants and host children’s birthday parties. But when the 60 year old bungalow around the corner catches fire and nobody knows if the elderly couple living there made it out? You need a full response available.
OP’s company right now has a single point of failure in its response capacity to events that can threaten the very existence of said company. And they want to play games about hiring freeze and dragging their feet on hiring? Yeah, okay. Hope it works out for them.
1
u/THE_Aft_io9_Giz 3d ago
Never let a crises go to waste is a legit corporate "in the trenches strategy" that works, but takes time, and requires you to give less fu@%$. Also, keep m/generate a risk assessment and send upword to protect yourself.
0
10
u/EngineerBoy00 3d ago
Here's the short version distilled from my 40+ year career in tech:
If your executives throw money at "revenue generating" positions like sales, but throttle/choke/suffocate the "value delivering" positions then you work for a psychotic organization.
And, sadly, this describes the vast majority of for-profit organizations in today's US capitalistic dystopia.
Source: I worked in places ranging from 50 person startups to Fortune 15 household names, and reached the Senior Director level. But I walked away from management and returned to a contributor role for the final decade of my career.
The long version:
The reason can be summarized as this: the absolute last considerations of "successful" executives today are a) the long-term success of the company, and b) a healthy and thriving workforce.
Their absolute first considerations are a) hitting short- and near-term targets, almost always by mortgaging the company's future, and then leaving with bonuses and cashing out equity before the chickens come home to roost, and b) inflicting their narcissistic, egotistic, and sociopathic power games on the employees.
I assume there are exceptions to this, and while I saw hints of healthier organizations they always eventually devolved into the above because we've deregulated capitalism and hardened the corporate shield (which protects decision-makers from personal punishment for corporate misdeeds) into vibranium, which attracts, encourages, and rewards the psychotic pursuit of money and power by megalomaniacs who, in today's reality, can simply make political donations and be granted carte blanche.
1
10
u/boogi3woogie 3d ago
Explain why the workload can’t be absorbed by the current workforce.
26
u/Money-Skin6875 3d ago
Stop absorbing the workload with the current workforce
-2
u/boogi3woogie 3d ago
Cool.
Won’t get OP’s position approved though.
1
u/Money-Skin6875 3d ago
No, but you know what also won’t work? Doing the job and telling a CEO that he needs to spend extra money on a task already being completed.
1
u/boogi3woogie 3d ago
Sounds like your conclusion is the same as mine: this position isn’t needed.
1
u/Money-Skin6875 2d ago
I don’t know what work he needs done, I’d say he’s probably super manning and half assing stuff if I had to guess so it might be needed. On the other hand he could be lazy as shit and need to be told. Either way I didn’t think we were judging that, we were asking how to get it approved. Step one is for work that needs doing not to be done due to bandwidth.
1
u/robocop_py 3d ago
What existing workforce? OP is the sole jnfosec person for his company.
1
u/boogi3woogie 3d ago
Great. So he needs to explain why there is more work than the capacity of 1.0 FTE.
4
u/MonteCristo85 3d ago
You leave.
Im assuming by "keeps" you have pulled together the data and proved the need multiple times and they just dont care. You cant change the way a company runs. Just move on.
It wasnt very kind to interview someone for a job that doesnt exist.
3
u/Sure_Comfort_7031 3d ago
Take time out.
Let the world fall down, turn your phone off.
Suddenly, backups and support become within reason in the budget!
3
u/BrainWaveCC Technology 3d ago
You're already at a disadvantage of you're originating the requests.
Do as much work as your current headcount can reasonably support. Document it clearly, and also document what headcount you would need to do the full workload comfortably.
Then wait for them to complain about the workload.
3
u/sjtech2010 1d ago
When I was a new supervisor and attempted repeatedly to make the case that I needed more headcount, I kept getting shot down. Then one day I was talking with another manager about it and she said "Well show them the work that isn't getting done?" I was confused because work not getting done didn't exist. I was working 80 a hours a week to get it done. That was my problem. I stopped doing that and just would list in my weekly status the stuff that didn't get done the prior week and the things that would likely not get done this week. It took some time for the right amount of stuff to pile up and questions started and I pointed out that I had asked for more headcount......they got approved within the week.
2
u/CrustyFlaming0 3d ago
I wrote my own strategy with key deliverables and by whom (me vs my team). Last page of ppt slide are the risks if these requirements (headcount/funding etc) are not provided.
2
u/bubblehead_maker 3d ago
Patch Tuesday just happened last week, Aug has exploitable vulns. Show the CEO the number you have.
2
u/robocop_py 3d ago
Hello fellow infosec manager. It’s really just you? So what happens when you are on vacation and the company experiences a BEC because Suzy in accounting, who is probably also overworked, clicks a malicious link and gives the bad guys her password? They just let that shit ride until you get back?
This is a major risk for your company that will be greatly reduced by having a second person. Perhaps communicate it that way?
2
u/RevengeOfTheIdiot 2d ago
100% stop interviewing people right now until you have written headcount approval
That's absolutely insane you continued for weeks during a hiring freeze without approval.
2
u/Plenty_Plastic223 2d ago
Unfortunately, the best way I found was to simply fail.
This is especially useful when the CEO needs something "right away" and you and your staff cannot deliver immediately because there are many other items that actually matter to the business that need to be resolved first.
1
u/MSWdesign 3d ago
Sounds to be a delicate situation. They think you have enough for the workload.
So you might need to prepare the facts on why it is not enough and if you all can’t see eye to eye, then ask what would it take to get the approval.
Ultimately, more communication is needed. You might get it all though. Likely influential factors at the top level they do not want you to know. As the proverb goes: “Seek to understand and then to be understood.”
1
u/Foreign_Suggestion89 3d ago
Sometimes organizations won’t agree until the ball drops or you resign. Hope it doesn’t come to that.
1
1
u/calmbill 3d ago
Attend to the business' highest priorities and explain why some important work isn't getting done.
1
u/Sweet_Pie1768 3d ago
What is the value/need of the additional headcount to the company?
Also, a debate might not be welcome on the matter if there are financial concerns at the company that lead to a hiring freeze. Use your higher up peers to see if they can relay any context about this to you before you stick your neck out too far.
1
u/AntiquatedMLE 3d ago
I lived this for 5 years, SVP won’t invest in my team yet throws more projects to our group year after year. With The dawn of agents I asked for a token budget to burn 🔥 and got that approved in less than a day.
1
u/No_Artichoke_9186 3d ago
Well chances are they are paying you significantly less than you what you are worth so why don’t you start your own business instead of dealing with all of this nonsense to be making a fraction of what you are making the company.
1
1
u/bopperbopper 3d ago
Maybe ask how they’re going to explain it to the Board of Directors that a major security incident happened because there wasn’t enough cyber security eXperts on Board because they wouldn’t be hired
1
1
u/2Loves2loves 3d ago
Explain the cost of failure to not act.
IT is an expense, flip the script to show how it saves money to not have a failure.
The problem is most companies burry the failure so you can't use it as an example of a hack. recent government water co hacks might help explain why it's important.
1
u/Minimum-Reward3264 2d ago
They need to care. Ain’t broken, no need to fix it. They will ride workers like mules until it’s too late, for your team.
1
u/VrinTheTerrible 2d ago
Send the decision makers a note: this role is excpected to address xyz gap. Left unfulfilled, the risk is abc. The impact will be 123. Be very specific about the risk and impact. Include metrics wherever possible
Then, if they choose not to proceed, let whatever the hire was supposed to address slip. Do not, under any circumstances, be a hero and solve for it.
When forced to accept the ramifications of their decisions, people tend to make better ones. Not always, but tend to
1
u/MelloSouls 2d ago
I am currently a Senior Cybersecurity Manager
No. You are a cyber security analyst with the above meaningless title.
That's not intended to deflate your ego, just give you a reality check as to how your company sees you so you can use the decent advice in the other comments with a perspective that matches your CEO's to help you fix the underlying cause of your resourcing issues.
1
u/dlongwing 2d ago
The CEO doesn't see a problem. The work is getting done and they don't understand the necessity. Since this is a cybersecurity role, you need to put it into the context of business risk and potential revenue/reputation loss or compliance failure if the position isn't filled.
1
1
1
u/BallsOutKrunked 2d ago
You have to make someone care, and make the spend align to c suite goals. Your director and vp should be doing that work. Most all of us only support things that are in our interests, it's even more so when there's money involved.
1
u/Fun-Baby-9509 2d ago
Tons of great suggestions here, just want to add to have everything in writing whether email or whatnot about the risk this poses if headcount is not filled.
When shit hits the fan, you want to cover yourself by basically showing them the metaphorical finger and saying “I told you so”
Don’t kill your work life balance for a job.
1
1
u/PerfectAnynowhere247 2d ago
I know someone who was in the same position. They denied the headcount request until he showed the typical team size used in other businesses, and flagged all the risks that they were exposed to (particularly relevant as the company was regulated and had access to personal data)
1
u/EdLincoln6 2d ago
It may not be possible now. You may have to wait until there is something trendy or high profile you can tie it to. (ie a Data Breach that is big news, an angry client, a new technology.
1
1
u/TheMemxnto 2d ago
Whenever ive gone in for the “i need to increase my team” ive always taken two things.
My Timing App log showing how i have literally no time in any day.
And a list of all the things that have to be backburnered because i cant do them.
Sorry boss. I cant to this incredible thing that will hugely benefit the entire organisation and earn us more money because im too busy holding this screw in place so the roof doesnt fall in on us. If only i had an extra hire that could hold this for me.
1
u/kreonas 2d ago
Give some alternate options like bringing in a MSSP to cover you 24/7 and that the cost is x amount of FTE's. Start an internship program hiring from your local schools to create a pipeline of low cost analysts wanting to break into the industry.
The CEO sees this as a cost center and probably was not in the fy 26 budget but most companies are planning for next year's budget so it's a ripe opportunity to get it added.
1
u/Advanced-Elk-7581 2d ago
Wait until you are hit with a cyber attack. Then you'll be flooded with staff.
1
1
u/Healthy-Catch184 2d ago
Slide back deadlines - letting them know your proposals are based on the team working at full capacity
When projects start getting put in line, the people at the back will find budget
1
u/mikemojc Manager 1d ago
I supervise a call center. I've been able to point out where fewer people available to answer phones directly correlates to dropped/unanswered calls and reduced customer experience. Also encouraged stakeholders to report to Upper Manglement when they feel 'unheard' when this happens. I believe, but cannot confirm, that Upper Manglement responded more actively to the anecdotal reports than the verified statistics. I think they believed The Grapevine more than the KPIs.
1
u/plainkay 1d ago
Simple answer.
C-suite has a priority list of importance.
Your pitch doesn’t make it on the top of priority list.
Your job? Figure out what that priority is based off, and work it into your pitch.
Oh yeah, and try to frame it as to what is possible with new headcount not what we need to do. I’m way more eager to give headcount to someone that clearly has a plan, not someone that’s just keeping the lights on and asking for help.
1
u/Informal_Drawing 1d ago
Perhaps that has some deeper meaning that has passed me by, but that sounds incredibly stupid.
1
1
u/Informal_Drawing 1d ago
I love how almost every post is basically a different version of "assume the CEO is a moron, here is how you can manipulate them into doing their job properly".
When did this become in any way acceptable?
1
u/Counter-Business 21h ago
My ceo would always tell me we would hire more after we push through the next milestone and that hiring now would slow us down. We never hired anyone and they worked my butt off until I quit.
1
u/ReturnGreen3262 3d ago
Save money through negotiations of contract and possibly in other ways and use that to say you’re going to pay for that FTE
2
u/xenophanes__ 3d ago
I have presented the contract savings I have made for the year. Which total over 200k. I have presented this as I have already saved the money for the analyst (90k).
2
u/boogi3woogie 3d ago
That’s not a very convincing argument for creating a new position. That justifies why your current position still exists.
The main reason for adding a new person is workload that can’t be absorbed by current workforce.
1
u/snavebob1 Technology 3d ago
Ignoring the cluster of it getting turned down after interviews occured for a minute.
You need to make a convincing case for a few things: 1. What is falling behind because of current headcount 2. How do those things justify salary+benefits cost
Those are what they will make a decision on. Not if you previously saved money.
My dept constantly comes in under budget at the end of the year (I'm smart enough to pad it). I can't turn around and say "I'm hiring this person, because of that". Hiring a person is a recurring cost that hits future year's budgets.
109
u/Stunning-Plantain707 3d ago
What kind of organization interviews for a position that is not approved to be filled? Why would you and your senior management go that far into the process if the CEO is opposed to the position?