Toxic Exec Culture, Clueless CISO—Avoid Security Roles Here - werkgeversreview Product Security Engineer bij Bose

- Lack of leadership clarity: Management, especially in Security, often expected ICs to “own” strategic direction without providing one. - Managers micromanage without actually delegating authority: You’re expected to lead, but never trusted with decisions—just blamed when something’s not perfect. Tasks had to be reported, re-reported, and spoon-fed back to leadership despite consistent work output. - OKRs and roadmaps are heavily emphasized, but priorities shift often—sometimes without clear communication or rationale. You’ll likely spend more time updating documentation, revising goals, sitting through redundant sprint planning sessions, and attending a constant stream of status meetings (monthly, bi-monthly, and beyond) than actually doing meaningful work. - Severely understaffed and siloed: The team operates more like a collection of individuals than a true unit. With limited headcount and no cross-functional support, everyone is buried in their own workload. There’s little collaboration, no knowledge sharing, and not nearly enough manpower to execute on the ambitious goals leadership sets—resulting in burnout, missed opportunities, and a fragile security posture. - Shifting expectations: Performance feedback was vague or exaggerated, then documented for HR after conflicts arose.