Description
TA-SIRT acts as a strategic and advisory layer above CSIRT and PSIRT. It focuses on guiding organizations in improving their security posture, readiness, and effectiveness.
TA-SIRT operates across all AMI3A states (Vulnerable, Under Attack, Compromised) and connects them into a continuous improvement model, aligning security operations with business risk.
Responsibilities
- Assess security control effectiveness (e.g., WAF, Bot, API, AI controls)
- Measure risk reduction (RMS, coverage, mitigation effectiveness)
- Advise on incident response readiness (IRR maturity)
- Provide strategic guidance during and after incidents
- Identify gaps in detection, coverage, and response capabilities
- Design and refine playbooks, processes, and architectures
- Conduct simulations, assessments, and benchmarking
- Translate technical posture into business risk and value (TOV)
- Support executive decision-making (CISO-level advisory)
Job Description
Deep expertise in security architecture, controls, and operations
- Strong understanding of both defensive and offensive security
- Experience with incident response, vulnerability management, and security assessments
- Ability to analyze security effectiveness beyond tools (coverage, gaps, behavior)
- Strong consulting and advisory skills
- Ability to communicate with executives and translate technical insights into risk and strategy
- Experience building frameworks, methodologies, or security programs
SIRT Positioning:
- CSIRT → Handles attacks (Execution layer)
- PSIRT → Handles vulnerabilities (Prevention layer)
- TA-SIRT → Measures & improves effectiveness (Strategy layer)
The complete defensive model:
- PSIRT reduces exposure
- CSIRT handles active threats
- TA-SIRT ensures it all actually works