Lucy Bulley joined the Cyber Runway Scale programme to discuss the critical elements of team-building and organisational structure when preparing for Series A funding. She shared practical insights on hiring strategies, leadership development, and scaling operations to support high-growth cybersecurity startups.

Building and structuring a team for Series A growth is a significant challenge, particularly for cybersecurity startups navigating talent competition, regulatory complexities, and the need for both resilience and expertise. In a Cyber Runway: Scale session, Lucy Bulley, an experienced fractional COO, shared insights on how startups can attract and retain top talent while creating a scalable organisational structure.

Hosted by Plexal in collaboration with the Department for Science, Innovation & Technology, the session explored effective recruitment strategies, culture-building, decision-making frameworks, and organisational structures, all essential for transitioning from a scrappy startup to a high-growth scale-up. I attended on behalf of Cyber Tzar, the Enterprise Supply Chain Risk Management platform, gaining valuable insights into building resilient, high-performing teams in the cybersecurity sector.

This article summarises Lucy’s key points, including strategies for recruitment, culture-building, decision-making frameworks, and organisational structure, all crucial elements for transitioning from a scrappy startup to a fully-fledged scale-up.

Contents

Insights from Lucy Bulley – 26th November 2024

This video is publicly available on the Plexal YouTube playlist for the Cyber Runway programme.

Key Challenges for Series A Cybersecurity Startups

Lucy highlighted some of the unique challenges faced by cybersecurity startups when scaling:

1. High Competition for Talent – Startups struggle to compete with larger organisations offering lucrative salaries and established career paths.
2. Specialised Skill Shortages – Cybersecurity requires niche skills, but hiring experts is expensive.
3. Burnout and Retention Issues – Team members often juggle multiple roles, increasing stress and turnover risk.
4. Regulatory Complexity – Compliance requirements differ across territories, adding operational challenges.
5. Balancing Culture and High Stakes Work – Cybersecurity demands discipline, trust, and operational rigour, making it difficult to create an open, creative, and engaging workplace culture.

The Shift from Startup to Scale-Up: What Changes?

The early team in a startup is often built on trust, loyalty, and adaptability—founders hire people who can wear multiple hats and work with limited resources. However, as the company scales, the needs shift towards expertise, resilience, and alignment with long-term business goals.

At Series A, the team must evolve:

• From generalists to specialists.
• From reactive decision-making to structured processes.
• From informal roles to clearly defined responsibilities.

This transition requires organisational structure, leadership clarity, and a focus on scalable growth.

Decision-Making Frameworks for Series A Startups

As a business grows, decision-making must be distributed effectively to avoid bottlenecks while ensuring control over critical areas. Lucy recommended categorising decisions into three types:

1. Autonomous Decisions

• Routine tasks that team members can handle independently.
• Example: Routine client communication (e.g., sending phishing simulation reports).
• Criteria: Must follow company guidelines, use brand tone, and avoid sensitive information.

2. Consultative Decisions

• Decisions requiring input from senior leadership but not final approval.
• Example: Solution design for product features.
• Criteria: Cost implications, regulatory considerations, or strategic importance.

3. Approval-Based Decisions

• High-risk, high-impact decisions requiring direct sign-off.
• Example: Product pivots, major budget allocations, legal or compliance-sensitive actions.

Balancing Autonomy and Control

Startups need to empower teams while ensuring strategic oversight. A key takeaway was the importance of defining clear escalation pathways so that only the most critical decisions land on the founder’s desk.

Attracting Talent on a Limited Budget

For startups without the financial firepower of large cybersecurity firms, hiring strategically is essential. Lucy shared four cost-effective ways to attract and recruit top talent:

1. Employee Referral Programmes

• Incentivise existing team members to recommend candidates.
• Referral bonuses (£50–£1,000) can be cost-effective compared to recruitment fees.

2. Branding Through Content

• Promote the company’s mission, vision, and culture online.
• Build thought leadership through LinkedIn, blog posts, and speaking engagements.

3. Skill Development Opportunities

• Highlight mentorship, exposure to leadership, and hands-on experience as part of the job offer.
• Many candidates, especially juniors, value career progression over salary.

4. Flexible Working Models

• While remote work is common, flexibility is key—allow employees to shape their work environment while maintaining structure for collaboration.

Retaining Talent: Building Culture and Engagement

Hiring the right people is only half the battle—keeping them engaged and motivated is equally crucial. Lucy outlined several strategies to reduce turnover and foster long-term commitment.

1. Transparent Communication

• Balancing information access and confidentiality is key—employees should understand the business direction without being overwhelmed by every internal discussion.
• Monthly updates, town halls, and “open access” policies (rather than an open-door policy) help maintain trust.

2. Employee Recognition Programmes

• Regular peer-to-peer recognition for contributions outside of direct sales performance.
• Some companies use points-based reward systems redeemable for bonuses, time off, or training.

3. Clear Career Pathways

• Show employees how they can progress within the organisation (sideways and upwards).
• Even if roles don’t exist yet, an org chart with potential future positions helps employees visualise their growth opportunities.

4. Encouraging Innovation

• Creating internal think tanks or R&D challenges gives employees a voice in problem-solving.
• In some companies, employees are given a monthly business challenge to tackle, fostering engagement and creativity.

Avoiding the “Elk Steak” Effect

Lucy cautioned against ad-hoc pay rises without structure, as they create unrealistic future expectations. Instead, establish clear salary review cycles and communicate timelines transparently to avoid morale issues.

Organisational Structures for Scaling Cyber Startups

As the team grows beyond 10-15 employees, structuring the business properly becomes essential. Lucy outlined three common organisational models for startups:

1. Hierarchical Structure (Traditional Model)

• Best for: Startups transitioning into scale-ups.
• Pros: Clear reporting lines, structured decision-making.
• Cons: Can slow innovation if too rigid.

2. Matrix Structure (Project-Based Model)

• Best for: Startups working on multiple products or services.
• Pros: Cross-functional teams allow flexibility.
• Cons: Can create conflicts between product managers and functional leads.

3. Product-Based Structure (Growth-Focused Model)

• Best for: Startups with distinct product lines.
• Pros: Deep expertise within each product team.
• Cons: Can lead to duplicate roles and inefficiencies.

When to Change Organisational Structure

Companies should reassess their structure when:

• Expanding into new territories.
• Pivoting products or services.
• Experiencing a decline in performance or operational inefficiencies.

Final Takeaways: How to Manage Growth Effectively

Lucy concluded the session with practical tips for founders navigating Series A growth:

1. Establish Formal Check-Ins – Monthly feedback sessions ensure alignment and engagement.
2. Encourage Open Access to Information – Tools like Notion help centralise updates while reducing distractions.
3. Implement Leadership Q&As – Quarterly sessions allow employees to engage directly with founders.
4. Use Decision-Making Frameworks – Ensure founders only handle high-priority decisions.
5. Prioritise a Structured Hiring Plan – Assess whether a new role is needed now or in six months before hiring.

A Blueprint for Future Growth

Scaling a cybersecurity startup from Series A to maturity requires clarity, structure, and adaptability. By implementing clear decision-making frameworks, hiring strategically, and fostering an engaging workplace culture, founders can build a resilient team that drives long-term success.