Context
After PPF acquired Telenor's CEE operations in 2018, I joined as Security Director at the group's regional shared-services entity, reporting direct to the CEO. The security organization was in the state most post-acquisition handovers leave behind. The seller's management was on the way out, the buyer's wasn't yet in. The function had been ground down in the interim.
It was also fragmented by design. Security operations sat inside the operations org. Architecture sat inside planning. GRC was the only piece that had been centralized, and it was not working well. The team sat in two countries, Hungary and Serbia, and covered four markets: the two home countries plus Montenegro and Bulgaria, served remotely. The two sites barely spoke to each other. A few meetings on the calendar, but not much real coordination. People were frustrated. As far as I could tell, all of them were actively looking for other jobs.
Mandate
Rebuild the regional security function. Get the team back on its feet first, and the structure standing second.
Nobody set me a deadline. The context did. With the new owners' arrival and the programmes already forming behind the scenes, security needed to be functioning, and quickly.
Role
Security Director at the regional shared-services entity, reporting to the CEO. Remit across four markets and the regional layer above them. End to end: security operations, architecture, GRC.
I designed the rebuild and I ran it. What this role needed first was presence, not process, so there was not a lot to hand off.
Approach
What I walked into was closer to the absence of a team than a team with problems. Phase one was salvage.
I started with cohesion. A few people on the team were blocking the rest from moving forward. I had to let them go. The call was sensitive and I took my time reading it, but when it happened the rest of the team received it well. Some of them told me so out loud, which was the signal the read had been right.
I moved fast on one appointment. The team was split between two sites and I needed a local lead in the one I wasn't based in. Not necessarily a functional lead, but someone the team could walk up to when I wasn't there. The person I picked was early in their career and already good at the work: sharp on practical problems, interpersonally mature, and trusted by the team in small moments. Those were the criteria. Not seniority. The offer was accepted only after the rest of the team had been consulted first. That detail said more about the fit than any interview could have.
I stayed visible. Weekly travel, bi-weekly at minimum. I set up a communication channel and used it multiple times a day, a running stream rather than scheduled updates, so the team never had to wonder what I knew that they didn't. And it ran the other way too: every piece of positive feedback or recognition I picked up about the team got shared straight back through. Team meetings changed shape in parallel. They became discussions rather than broadcasts, with room for people to bring their own stories when they wanted to. No push, just an opportunity. The room was also for venting, as long as the frustration landed on a cause and a way forward rather than burning the team down from within.
I created functional roles inside the team with real responsibilities: ownership of topics, not just task lists. And I set near-term working-group goals: implementation work, standards, innovation work. Useful outputs on their own, but the point was simpler than the outputs: a scattered team needed reasons to be in the same room.
I used technical credibility deliberately. I had enough background to answer questions the team had, and sometimes I knew things they didn't. But the role was not to be the expert. The point was to narrow the power distance, not to dominate it. That one choice is what let the team come to me immediately when they had conflict with other parts of the organization, and when they did, I could step in before the conflict ossified.
The enterprise rails were running alongside all of this. OKRs, personal goals, quarterly reviews were the formal part. Formality matters for structural discipline, but in the rebuild year it wasn't the driver. The direction was cohesion. Career paths, promotions, training, conferences were something else. Not formality, but real incentives. The team felt them.
Two less-visible choices shaped the first year as much as any of that. I restructured the budget so that raising salaries came before hiring more people, stronger first and larger second. And I fought for more budget on three fronts: internal management, renegotiation with the operating companies we served as customers, and proposals for service extensions. The function was funded through contracts, and the headroom had to come from there. The service extensions and budget wins did double duty. They showed the team that the function was growing, that the rebuild was turning into real expansion. The tempo was ambitious and sometimes ran ahead of what the team felt ready to absorb, but the visible growth meant more to them than the absorption pressure did. Alongside all of that, I worked down operational bottlenecks where I could, especially on the operations side. A team coming back to life needs friction taken out of its days.
By the end of the first year there was a team again. The CVs stopped circulating. None of this had been strategy. There hadn't been time for strategy yet.
My own habits shifted with the turn. Through the salvage phase I had been running 1:1s with everyone on the team, direct access, no layer in between. Once the team was standing, I stopped doing the ones with people who now reported through a lead. Continuing would have cut across the authority I'd handed to those leads. The formal relationship moved up a layer. The personal one stayed where it was.
The second phase was the machine that works without me. A real strategy, with goals, tactical steps, organization design, technology direction. Less salvage, more build. That work bridged into what became the separation programme, and the team that had been rebuilt was the team that carried it through.
Deliverables
- A cohesive regional security team with low attrition, working with the rest of the business instead of at arm's length from it.
- A functional role structure inside the team, with clear topic ownership and accountability.
- A present local lead at the second site, appointed fast and chosen on fit.
- A communication rhythm the team could rely on when I wasn't in the room.
- Working-group outputs: implementation contributions, standards, innovation work.
- A foundation the regional security function could build its first real strategy on, and the team that then carried it through the separation.
What made it hard
The state I walked into was worse than I had been told. I arrived with management experience and still, the first few weeks of reading the room shifted my plan fast. Fragmented functions are one thing. A team already halfway out the door is another. Starting with strategy would have been building on sand.
The layoff call was delicate. It had to be right, and it had to be seen to be right. Getting both to line up without being cruel about it is the hardest kind of management call, and I did not shortcut it.
Leading a team split across two sites, and serving customers in four markets from those two sites, meant presence had to be manufactured. Trust that builds naturally when you're in the same office had to be engineered: through travel, through a communication channel used daily, and through a local lead who could carry the presence I couldn't. The structure had to compensate for the geography, every day.
The pressure from above did not ease up. PPF had arrived under its own pressure from the acquisition, and the urgency flowed down. Every week the expectation was more output, more coverage, more reporting. The team needed oxygen to come back to life. The stakeholders needed deliverables. Both were legitimate, and they pulled against each other.
And the pivot from salvage to build had its own tension. The moment the team was breathing again, the expectation was that strategy would appear, fully formed. Strategy on top of a team still learning to be a team is fragile. Getting that pacing right, building while the team was still catching its breath, was the hardest stretch of the two years.
What I took from it
Three things stuck.
One: cohesion is a precondition, not an outcome. You cannot strategize a broken team into coherence. I tried, for about three days, to start with a plan. Then I stopped and started with people. Every strategy track I have run since starts the same way.
Two: the highest-leverage decision in a rebuild is not the strategy. It is the one appointment that signals what the organization now values. Picking someone early in their career, on substance rather than on seniority, told the rest of the team that this was not the same regime. That one call said more than any all-hands speech would have.
Three: technical credibility used to narrow power distance is one of the most underrated management levers I know. It is not expertise for its own sake. It is the ability to meet a specialist on their ground, so that when you are not the expert in the room, nobody wonders whether you could have been.
And the residue. I came out of those two years knowing what a team in real trouble looks like, and knowing that reading the room beats having a plan, at least at the start. A lot of how I build and lead teams now traces back to that.
Sources (public record on the transaction and the resulting group):