Developing a security related program in a SME is difficult - even more so when you are located in Ottawa where having a dedicated security function in a sub-100 person organization is almost unheard of. This talk focuses on the journey I took from Security Administrator at a <100 person company to leader of a security, risk and compliance group as the company grew to 400+ people. I will share what I believe to be the cornerstones of success in gaining the support of my peers and executive team and some of the challenges that have come along (and persist!).