The key to developing a good cyber security culture is to build security capital with those that you deal with on a regular basis. One of the easiest ways to destroy your security capital (even though you may be 100% right) is to come in and start pointing out all of the things that are wrong with the current cyber situation. Start making a list of what you see needs to be fixed or what I call (areas for improvement) and then prioritize the list. If you see an area that is lacking, gather the information on why it is that way. There may have been a valid reason for it being that way (even if the valid reason was only valid 20 years ago!). Then look to see how to approach the problem.
One of the worst things you can do is not to understand the organization's culture and just go about trying to fix things. You will find yourself battling against internal giants you didn't know existed. For example:
At one placed I worked the organization's culture was run by fear. They feared making any changes because they might screw something up. They also feared for their jobs. Any of my ideas that increased their fear would be met with immediate resistance and they would look to form internal collaborations against me. Luckily I knew about the magical trick of understanding the organization's culture before I started making suggestions, or else I would have failed like the previous CISO.
At another placed I worked the organization's culture was run by ignorance. They pretended like they were just a small government agency so no one would want to attack them. They also promoted some incompetent people into management who had no business running the IT shop. I did not understand the organizational culture dynamic and I threw one great security idea after another at them (which basically exposed their incompetence without me realizing it!). They fought me tooth and nail and I ended up leaving before any of my great (and 100% correct) ideas could take root. This was also early in my cyber career so if placed back there now I could function much better.
Build good security capital with the CIO, legal and HR teams. They will be crucial to your long term success. If something comes up that will expose those departments, meet first with them and ask them how they would like for this to come about so that they feel they have some input and control over the process versus feeling like you are throwing them under the bus.
