PRISET AV ATT VARA TRYGG : En studie kring säkerhetsarbetets effekt på anställdas arbetsupplevelser

Sammanfattning

The increasing cybersecurity threats and the introduction of new regulations such as NIS2 place higher demands on organizations´ information security work. At the same time, previous research shows that security in practice cannot be understood solely through technical solutions, but also through how employees act and take responsibility in their everyday work. Against this background, the purpose of the study is to create a better understanding of how information security work affects employees´ experience of their work in terms of their responsibility, autonomy and trust. The study was conducted as a qualitative case study in which six semi-structured interviews were held with employees at an organization operating in the cybersecurity sector. The empirical data was analyzed using thematic analysis. The results show that information security is largely shaped by the interplay between technology, the individual, and the organization, where employees´ own judgment plays a central role. A strong information security culture and psychological safety within the team empower employees to dare to report mistakes and take responsibility in situations where technical systems do not provide clear guidance. At the same time, it emerges that the balance between technical control and autonomy is crucial, as overly extensive security controls risk diminishing intrinsic motivation and leading to security fatigue. The study contributes to a deeper understanding of how information security work is applied in organizations and shows that the implementation of new security controls must consider human and organizational factors, not just technical solutions.