Certified: The GIAC GSTRT Audio Course

In this episode, we treat coaching as an operational system, not a personality trait, because the fastest way to raise performance and accountability is to make expectations visible and progress measurable. Many security leaders want strong teams, but they rely on informal guidance, heroic effort, and last-minute correction when something goes wrong. That approach produces bursts of output, but it does not produce stable improvement, and it often burns out the people you most need to retain. Structured coaching is different because it makes standards explicit, turns goals into observable measures, and creates a weekly rhythm that removes blockers before they become crises. It also creates fairness, because feedback is grounded in shared expectations rather than in subjective impressions. The purpose is not to micromanage or to restrict autonomy; it is to reduce ambiguity so teams can focus their energy on high-value work instead of on guessing what success looks like. When coaching is structured, accountability increases because commitments are clear, and performance increases because improvement is designed rather than hoped for. That combination is how you raise capability fast without creating a culture of fear.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

The foundation of structured coaching is defining standards, behaviors, and outcomes explicitly, because you cannot improve what you cannot describe. Standards are the quality rules the team agrees to follow, such as how incidents are documented, how tickets are handed off, how evidence is captured, and what minimum validation is required before declaring work complete. Behaviors are the repeatable actions people take that produce results, such as how they communicate risk, how they ask for help, how they escalate blockers, and how they review work for completeness. Outcomes are the measurable results the business and the security program care about, such as reduced rework, faster response times, fewer missed deadlines, and higher reliability of deliverables. Explicit definitions matter because people often assume they share expectations when they do not, and that mismatch is a hidden source of frustration and underperformance. When you define these clearly, you also create a shared vocabulary that makes feedback easier, because you can reference the standard rather than criticizing the person. This approach is especially valuable in security work, where complexity is high and where different teams may have different norms. If standards are unclear, each person operates on their own definition of good, which creates inconsistency that the organization experiences as unpredictability. Making standards explicit is therefore a leadership move that improves both quality and team cohesion.

Once standards exist, set clear goals with observable measures, because vague goals like improve responsiveness do not guide daily choices. A good goal describes an outcome you can observe, such as reducing the average time to triage a priority incident, reducing the number of tickets that bounce between teams, or increasing the percentage of deliverables that meet the definition of done on first pass. Observable measures do not have to be perfect metrics, but they must be credible indicators that move when performance improves. They should also be within the team’s influence, because goals that depend entirely on external factors create helplessness rather than accountability. For example, a goal about reducing rework is more actionable than a goal about eliminating all incidents, because incidents are not fully controllable. Clear goals also help you prioritize coaching time, because you can focus on the behaviors that most strongly affect the measures. They make progress visible, which reinforces motivation and reduces the sense that coaching is subjective. In security teams, where work is often interrupt-driven, measurable goals provide stability because they remind the team what still matters even when the day is chaotic. When goals are explicit and measured, accountability becomes natural because commitments are visible and progress can be discussed without drama.

Weekly check-ins are the rhythm that makes structured coaching fast, because they turn improvement into a continuous process rather than a quarterly event. A weekly check-in is not a status meeting for its own sake; it is a short, consistent forum to review goals, surface blockers, and agree on next actions. The power of weekly cadence is that it catches issues early, when they are small and cheap to fix, rather than after a deadline is missed or a deliverable fails quality checks. It also creates predictability, which helps teams plan and reduces anxiety about surprise scrutiny. In security, blockers can include unclear decision rights, dependency delays, tool limitations, and competing priorities, and removing blockers often requires leadership intervention. Weekly check-ins create a reliable channel for that intervention, so teams do not have to wait for a crisis to get attention. They also reinforce accountability because commitments are revisited frequently, but in a supportive way that focuses on progress rather than on blame. When check-ins are consistent, teams learn to prepare and to communicate clearly, which improves overall execution quality. Over time, weekly check-ins become one of the most effective management tools because they create momentum, visibility, and early correction.

Feedback is where coaching becomes personal, and structure matters here as well, which is why a simple model like situation, behavior, impact works so well. The situation describes the context, such as a specific incident, meeting, handoff, or deliverable, stated neutrally so the person knows what moment you are discussing. The behavior describes what was done or not done, focusing on observable actions rather than on assumed intent or character. The impact describes what the behavior caused, such as rework, delay, confusion, risk exposure, or reduced trust with stakeholders. This model works because it is fair and specific, and it reduces defensiveness by avoiding vague accusations. It also makes feedback actionable because the person can see what to change, and you can agree on what good behavior looks like next time. In security teams, feedback can easily become emotional because stakes are high, but structure keeps it grounded in improvement rather than in judgment. The impact portion is especially important because it links behavior to outcomes, which is how professionals learn fastest. When people understand the effect of their actions on the team and the mission, they are more likely to change because the reason is clear. Structured feedback also builds trust because people see that coaching is consistent and based on evidence, not on mood.

A practical example is tightening ticket handoff to reduce rework, because handoffs are a common source of wasted time and hidden accountability gaps. In many teams, tickets bounce because context is missing, acceptance criteria are unclear, or ownership is ambiguous. If you define a standard handoff behavior, such as including required context, evidence, and a clear statement of what is needed, you reduce back-and-forth and shorten cycle time. The observable goal might be reducing the number of tickets returned due to missing information or reducing the average time from assignment to completion. Coaching here involves reviewing a few real handoffs, identifying the patterns that cause rework, and then practicing the improved handoff behavior until it becomes normal. You might also refine the definition of done for ticket completion, ensuring it includes validation steps and stakeholder communication when appropriate. The key is that the example links behavior to impact in a way that is easy to measure, which makes coaching feel practical rather than theoretical. When ticket handoffs improve, team capacity increases because less time is wasted, and that capacity can be reinvested into higher-value work. This is the kind of improvement that teams feel immediately, which builds momentum for further coaching. It also improves cross-team trust, because good handoffs signal professionalism.

Skill plans accelerate improvement when they include deliberate practice reps rather than vague intentions to get better. A skill plan identifies a specific skill, defines what good looks like, and then schedules repeated practice with feedback. In security leadership and operations, skills might include writing impact-centered risk statements, performing scenario-based triage, producing one-page decision narratives, or executing incident containment steps cleanly. Deliberate practice means you break the skill into components, practice the hardest component repeatedly, and use feedback to correct errors quickly. It also means you practice under conditions that resemble reality, such as time constraints, incomplete information, and the need to communicate clearly. Reps matter because performance improves through repetition with correction, not through occasional reading or one-off attempts. Skill plans also create accountability because the practice is scheduled and reviewed, making improvement a visible commitment. They reduce the risk of uneven capability across the team, which can create bottlenecks when only one person can handle high-stakes tasks. Over time, deliberate practice builds team resilience because more people can perform critical functions reliably. This is how you raise performance fast without relying on heroics.

One pitfall that undermines coaching is coaching only during crises, because crisis coaching is reactive and often perceived as punishment. When feedback appears only when something goes wrong, people associate coaching with failure and they become defensive or avoidant. Crisis moments also reduce learning quality because stress narrows attention, making it harder for people to absorb nuanced feedback. Proactive coaching, by contrast, normalizes improvement and creates a culture where feedback is expected and useful. Weekly check-ins and skill plans create this proactive rhythm by making coaching part of normal operations rather than an emergency intervention. Proactive coaching also allows you to address small issues early, before they become reputational failures or missed deadlines. It builds psychological safety because people learn that feedback is about growth, not about blame, which increases willingness to surface risks and uncertainties. In security work, where admitting uncertainty can prevent major errors, this safety has direct operational value. Coaching during crises will still happen, but it should be a small fraction of the total, not the dominant pattern. When the coaching culture is proactive, crises become less frequent because predictable failures are prevented earlier.

A quick win that raises accountability immediately is standardizing definitions of done, because many teams struggle not from lack of effort but from inconsistent ideas of completion. A definition of done clarifies what must be true for work to be considered complete, such as documentation updated, evidence captured, validation performed, stakeholders notified, and risks assessed. When the definition is inconsistent, one person closes work early while another person expects additional steps, and the gap becomes rework or operational risk. Standardizing done reduces debates, shortens handoffs, and improves quality because everyone works to the same finish line. It also makes measurement easier because you can track how often work meets the definition on first pass, which is a direct indicator of performance. In a security environment, definitions of done can also include required control checks, such as ensuring logging is enabled or ensuring access changes are reviewed, which improves baseline hygiene. The goal is not to make the definition long; it is to make it clear and usable. When done is standardized, teams feel less friction because expectations are predictable, and predictability improves execution speed. This is one of the simplest structure investments with one of the fastest returns.

Now consider a scenario where a deadline is missed, and you want to coach without blame, because blame destroys accountability by making people hide problems. In this situation, you focus first on facts, such as what the commitment was, what changed, and what blockers appeared, without implying moral failure. You then examine behaviors and process, such as whether scope was unclear, whether risks were surfaced early, whether handoffs were clean, and whether escalation occurred when it should have. The goal is to identify the small decisions that led to the miss and to convert them into improvements, such as clearer acceptance tests, earlier escalation, or more realistic sequencing based on capacity. You also confirm what will be done differently next time, and you define a measurable signal that the improvement is working, such as fewer late surprises or improved estimate accuracy. Coaching without blame still includes accountability, meaning commitments matter, but accountability is expressed as ownership of improvement rather than as shame. This approach preserves trust because the person sees you are trying to help them succeed, not trying to punish them. It also improves system resilience because the focus is on preventing recurrence, not on finding a culprit. In security teams, this posture is essential because complex work has many contributing factors, and blame often targets the wrong factor while the real cause remains. When you coach this way consistently, people are more willing to surface risks early, which prevents bigger failures.

A practical exercise that makes coaching real is writing one feedback script today, because scripting forces clarity and reduces the chance that feedback becomes vague or emotionally charged. The script includes the situation, the behavior, and the impact, expressed in plain language that focuses on observable facts. It then includes a clear request for the new behavior, such as what you want done differently next time and why it matters. It should also include an invitation for the other person to share context, because feedback is most effective when it becomes a two-way understanding rather than a one-way directive. Writing the script is helpful because it allows you to remove unnecessary sharpness and to ensure the message is fair before you deliver it. It also helps you keep the feedback focused on the most important improvement, because long feedback sessions with many points often overwhelm and reduce retention. In leadership, delivering feedback is a skill, and scripts are a training tool that reduces variability and increases confidence. Over time, scripting becomes less necessary, but the habit of structuring feedback remains, which keeps coaching consistent. This practice also builds a culture where feedback is normal and constructive because it is delivered with respect and precision. That culture is a performance multiplier.

A phrase that ties the episode together is structure frees energy for creativity, because structure reduces the cognitive load of uncertainty and rework. When standards are clear, people do not waste energy guessing what good looks like. When goals are measurable, people can focus on improving the behaviors that move the metrics rather than chasing random tasks. When check-ins remove blockers early, people spend less time stuck and more time producing results. When feedback is structured, people learn faster because the improvement target is clear and the conversation feels fair. When definitions of done are standardized, the team stops re-litigating completion and starts building forward. This is where creativity actually increases, because the team has more spare mental capacity to solve complex problems instead of fighting preventable process friction. In security work, creativity matters because attackers adapt and environments change, so teams need space to think. Structure provides that space by making routine execution reliable and by preventing repeated failures. The phrase is memorable because it reframes structure as an enabler, not a constraint. If you remember this, you will be less tempted to treat structure as bureaucracy and more likely to treat it as performance engineering.

As a mini review, keep goals, check-ins, feedback, skills, and standards connected, because they form the coaching system that raises performance quickly. Goals define what improvement looks like in measurable outcomes that matter to the program and the business. Check-ins provide the rhythm for reviewing progress, removing blockers, and keeping commitments visible without creating fear. Feedback provides the mechanism for correcting behavior precisely using situation, behavior, impact so learning is fast and fair. Skills are built through deliberate practice reps with correction, turning improvement into a designed process rather than a hope. Standards, including clear definitions of done, provide the baseline that prevents inconsistency and reduces rework. When these elements work together, coaching becomes scalable because it does not depend on one leader’s charisma or constant intervention. It becomes a system that teams can operate within and benefit from routinely. The review matters because teams often attempt one element, like feedback, without the supporting structure of goals and standards, and then they wonder why improvement is slow. The system is what accelerates progress.

We will conclude by turning this into a simple starting action, because coaching systems begin with rituals, not with perfect plans. Pick one ritual that fits your team’s reality, such as a short weekly check-in focused on blockers and measurable goals, or a standardized definition of done for a common work type. Start it this week, keep it consistent, and use it to surface one improvement opportunity at a time rather than trying to fix everything at once. The ritual will create momentum because consistency produces trust and because small wins reinforce the value of structure. As the ritual stabilizes, add the next element, such as structured feedback scripts or deliberate practice reps for a key skill. This is the last paragraph and the conclusion, and it is the last required bullet: pick one ritual and start this week, because coaching improves performance fastest when structure becomes a weekly habit rather than an occasional reaction to crisis.