Cyber Security Responsibilities by Job Role

Cyber security responsibilities by job role are not the same for everyone. A customer service agent protects a customer's account. A finance clerk protects a payment. A helpdesk worker protects a password reset. Each job has one or two moments where a careful person stops an attack and a rushed person lets it in. This guide names those moments for each role, so a team member knows what to do and a manager knows what to ask for.

The advice here is general. Your employer's policy, and the rules of the regulator in your country or sector, set the exact duties. When this page and your policy differ, follow your policy and ask questions about the difference.

Why roles matter

Attackers do not attack "the company". They contact a person, in a role, and ask for something that role can give. They phone the helpdesk for a reset. They email finance for a payment. They send HR a fake application. They write to a manager pretending to be the director.

So a good rule set for security is not one long list for everyone. It is a short list for each role, written around the real requests that role gets. Three questions work for any job:

What can I give or change that an attacker would want?
How would an attacker ask for it?
What check do I do before I say yes?

The sections below answer those three questions, one role at a time.

Customer service and customer data

What you hold: customer names, addresses, order history, account details, and the power to change them.

How attackers ask: a caller says they are the customer and have lost access. Someone says they are "from head office" and needs a record. A customer asks you to share your screen "to help".

Your responsibilities:

Confirm identity before you share or change anything, using the checks your company set. Do not accept "I'm in a hurry" as a check. Read more in how to verify a customer's identity before sharing account details.
Share only what is needed for the question. If the customer asked about a delivery, you do not read out the full payment details.
Before sharing your screen, close other windows and notifications.
If you sent something to the wrong person, report it at once. Do not hope nobody noticed.

Example: A caller says she is Ms Rao and wants her delivery address changed today. She knows her name and postcode, but both are easy to find. The agent asks the extra check the company requires, which the caller cannot answer, and offers to send a confirmation to the contact details already on file. The change waits one day. The real Ms Rao, later, says thank you.

Finance operations

What you hold: the power to move money and to change where money goes.

How attackers ask: an email from a "supplier" with new bank details. A message from the "director" asking for an urgent transfer. An invoice that looks right but has a changed account number.

Your responsibilities:

Verify any change of bank details by calling a number you already had on record, never the number in the message.
Apply the second-person approval for large or unusual payments. Do not skip it because the request is urgent. Urgency is the attacker's favourite tool.
Keep payment files and financial reports in the places your company set, with the access list kept short.
Reconcile payments regularly, so a wrong payment is seen in days and not months.

Example: An invoice arrives from a regular supplier. It is normal in every way except the bank account, which is new, and a line saying "please pay today". The clerk phones the supplier on the number in the contract. The supplier knows nothing about a change. The clerk reports the email to security. For the full method, read how to verify a supplier's changed bank details.

HR and recruitment

What you hold: personal details of applicants and staff, identity documents, and the power to change bank details for payroll.

How attackers ask: a "employee" emails to change their salary account. An applicant is not who they say they are, even on video. Someone asks for a leaver's records.

Your responsibilities:

Handle applicant and staff files as private. Share only with people who need them for the job.
Check identity documents with the process your employer and the law where you work require.
Treat payroll bank-detail changes like payments: verify through a second route before you change anything. See how to verify a payroll bank details change request.
Be aware that video interviews can be faked. If something feels off, such as a face that does not move naturally or answers that lag, ask for a second check. Our article on spotting a deepfake job interview lists what to look at.
Close accounts and collect devices when someone leaves, on the day they leave.

Managers and executives

What you hold: authority. People do what you say, and attackers know it.

How attackers ask: they pretend to be you, to push staff into a payment. Or they pretend to be someone above you, to push you. Executives are targeted with personal, well-researched messages because their approval opens doors.

Your responsibilities:

Make safe behaviour part of normal work. Ask about it in team meetings, as you ask about deadlines.
Make the rules short enough to follow. A twenty-page policy that nobody reads protects nobody.
Make it safe to report mistakes. If the first reaction to a report is anger, the second report will not come.
Know which systems and information matter most to the business, so the team knows what to protect first.
Prepare for targeted attacks. Agree with your assistant and your finance team that no payment request by message alone is ever enough, even if it appears to come from you.
Take part in practice for a serious incident. The first hour goes better for people who have rehearsed it. Our guide on what to do after a cyber attack gives the outline to rehearse.

Example: A director is travelling. A message arrives, signed in her name, asking the finance lead to pay an urgent invoice and "not to call, I'm in meetings". Because she told her team beforehand that she would never ask for that, the finance lead calls her anyway. The message was false.

Helpdesk and account support

What you hold: the keys. A helpdesk can reset a password or a two-step method, and an attacker who persuades you has the account.

How attackers ask: a caller who sounds stressed and says they are locked out before an important meeting. They know the name of the manager and the office. They ask you to skip the usual questions "just this once".

Your responsibilities:

Confirm who is asking, every time, with the method your company set. Never let urgency replace the check.
Reset passwords and two-step methods only through the approved process, and send the new details to the contact already on file, not to a new one given on the call.
Protect recovery links. Do not read them out or send them in chat.
Report unusual requests, such as three reset attempts for senior staff in a day. The pattern may be an attack in progress.

The full routine is in help desk caller verification before a password reset.

Example: A caller says he is a sales manager, locked out, and with a client waiting. The agent says, "I'm sorry, and I will fix it as soon as I confirm you." She follows the call-back process. The number on file answers, and the real manager says he is at his desk and has not called. The agent logs it and tells security.

IT administration

What you hold: broad access to systems, accounts and devices.

Your responsibilities:

Give each person the access their job needs and no more. Review who has what on a schedule your employer sets.
Use separate admin accounts for admin work, with strong two-step sign-in, and never for reading email or browsing.
Keep systems updated according to the plan, and know which systems cannot be updated and need extra care.
Remove access promptly when people change roles or leave.
Keep an accurate list of devices and systems. You cannot protect what you do not know exists.

Backups, logs and suppliers

Three quiet duties often fall between roles, so name an owner for each.

Backups. Someone must make them, keep a copy that an attacker cannot reach from the main network, and test a restore. A backup nobody has restored is a hope, not a plan.
Logs. Someone must keep records of sign-ins and changes, and someone must actually look at the alerts. Records that nobody reads help only after the damage.
Suppliers. Companies that handle your data or connect to your systems bring their risk with them. Someone should know who they are, what they can reach, and how they will tell you about a problem.

Developers

What you hold: the code that runs the product, and often the keys that connect it to other systems.

Your responsibilities:

Keep secrets, such as passwords and access keys, out of the code and out of shared chat.
Validate everything that comes into the application from outside.
Update the libraries you depend on, and know what you depend on.
Review every change before it is merged, including code that you did not write yourself. Code from a colleague, a copied example or an automatic assistant gets the same review. See reviewing code before merging.
Never put real customer data into a test environment or a public service unless your employer has approved it.

Testing and assurance

Rules only work if someone checks them. Testing is the role that asks "does this really happen?"

Run practice phishing messages and other exercises under the employer's rules, and use the results to teach, not to shame.
Test that backups restore and that the incident contact list is correct.
Review access, payment controls and helpdesk calls from time to time, and report the gaps to the people who can fix them.
Share findings plainly. A result nobody understands changes nothing.

Common mistakes

One policy for all roles. A rule written for the average person fits nobody.
Treating security as IT's job alone. Most attacks start with a request to a non-IT role.
Letting urgency win. Every role above has a version of "just this once". The check exists for exactly that moment.
Punishing the report. The person who admits a mistake early saves you money.
No named owner. Backups, logs and suppliers fail when "everyone" is responsible.
Rules without practice. People remember what they have rehearsed.

Questions people ask

Who is responsible for cyber security in a company?

Everyone, in different ways. Leaders set the rules and the priorities, IT builds and runs the controls, and each role protects the requests it receives. The security team supports them but cannot see every email, call or invoice.

Which job roles are targeted most?

Roles that can move money, change accounts or hold large amounts of personal data: finance, helpdesk, HR, customer service and executives. Attackers choose the role that can give them what they want.

What should a manager do about security?

Make safe habits part of daily work, keep the rules short and usable, make it safe to report mistakes, know the systems that matter most, and agree in advance how requests in your name will be checked.

Do small businesses need role-based rules?

Yes, but they can be simple. In a small team one person may hold several roles. Write down, for each task, the check that must happen before it is done, and who does the second check.

Where do I find the exact legal duties for my role?

Ask your employer for the written policy, and look at the regulator or authority that sets the rules for your country and industry. This page is a general guide and does not replace them.

Learn this in five minutes

The track "Managers and Executives" teaches leaders how to make cyber safety part of daily work, set rules people can follow, make reporting safe, identify the systems that matter most, and prepare for targeted attacks. Each lesson takes about five minutes and ends with something you can do the same day.