Our initial hypothesis assumed security professionals would segment by company size, so I planned for 30 interviews distributed evenly across enterprise, mid-market, and small business (10 each). I completed 31 interviews recruited through UserTesting.

Because our target audience (security professionals) was niche, we iterated on our screener multiple times to ensure we were reaching the right participants: those with actual security decision-making responsibilities rather than just IT admin roles.

To move beyond our size-based hypothesis and discover what actually differentiated users, I applied segmentation analysis techniques from my NNG training. I created a matrix with each interviewee as a row and various attributes as columns (Feelings, Responsibilities, Industry, Technical Know-how, Tools Used, etc.). This allowed me to see patterns across dimensions we hadn't initially considered, revealing that factors like relationship to security responsibility mattered more than company size.

Once I identified promising attributes, I used dimension analysis to visualize clustering patterns. For each attribute, I created either categorical dimensions (discrete categories like "Satisfied," "Overwhelmed," "Confident" for Feelings) or continuum dimensions (sliding scales like "Operational ←→ Technical" for Responsibilities). Plotting all 31 interviewees across these dimensions revealed three distinct clusters that became our persona framework—groupings that cut across company sizes but showed consistent behavioral and attitudinal patterns.

Before jumping into polished persona cards, I created "skeleton" versions in FigJam to synthesize what made each cluster distinct. You can think of this almost like “wireframing” of the Persona Cards.

This intermediate step was crucial as it let me see each persona holistically and stress-test whether the differences between them were meaningful enough to warrant separate personas. It also helped me identify gaps where I needed to revisit the data or validate assumptions before committing to a final framework.

Understanding who our users were wasn't enough. We needed to understand what they were trying to accomplish. I collaborated with the product team to map specific Jobs-to-be-Done for each persona, identifying their functional, emotional, and social objectives when managing cybersecurity. This translation from persona characteristics to actual jobs gave product and design teams concrete, actionable direction for feature prioritization and development decisions.

To maximize adoption and minimize bias, I designed each persona as a two-card system: one with persona details and one addressing (and often debunking) assumptions from our original hypothesis and stakeholder interviews.

Critically, I created three different illustrations per persona to reinforce that these represent categories of users, not individual people. This approach enhanced empathy while preventing teams from over-indexing on superficial demographic details or treating personas as caricatures.