Need the opposite costume, the overly eager sys admin.

• wants to force password changes once a month for security
• constantly changing security policies to reflect the flavor of the month
• constantly sends out phishing emails tests, wonders why no one replies to any of his emails

Password expiration is no longer considered a best practice. FYI.

• Installs antivirus on servers that wrecks application performance
• installs content filtering proxy that prevents developers from reading “hacking materials” like OWASP documentation
• won’t let developers install anything on their own machines without filing a ticket and waiting 6 weeks
• pushes unannounced antivirus updates that pop up OS security dialogs like “Netscan Antivirus would like to monitor all network traffic. Enter your password to approve”, and is surprised when users don’t enter their passwords.

Your corporate IT guy

Clicks on everything or is too scared to click on anything and never learns how to use the software