SEC Faculty Advisor

Preparing for Security Career Opportunities in the Private Sector

Q. I am ex-military. I would really like to get into private security, specifically in the area of protection more than anything else. I need to be pointed in the right direction so that I can actually apply the skills I have gained and know something about.

A. At the present time there are a number of opportunities for individuals in the area of employee or executive protection. You need to think about the following questions to help guide your path as you make plans for your future career in private security:

1. When you were in the military, what was your specialty and what branch of the service were you in?
2. How old are you now? 
3. Are you willing to work anywhere in the world?
4. How much travel are you willing to do...25%, 50%, 75%?
5. Since leaving the military what defensive/offensive martial arts skills, weapons qualifications, and evasive driving or other skills have you acquired?
6. Have you passed any evasive driving or protective detail training programs similar to those found at the following web sites: < www.safehouse.com > or <  www.rloatman.com  >  and if so what was the most recent course you attended?

The above questions may seem like a lot, but in the field of executive or employee protection they are the criteria organizations look at as part of their screening process.  One of the most difficult challenges is dealing not only with the travel, but also the amount of time away from family.

As you do your research, make sure you do due diligence when checking web sites, schools, and other opportunities in this exciting field.  I would caution you NOT to send any money or subscribe to any "service" until you have checked them out and are satisfied they are legit!  In this area of employment there are lots of scams just like everywhere else. 

If you have broader interests in transitioning into the security area you may want to take a look at my new book, From One Winning Career to the Next, which deals specifically with issues moving from the public sector (law enforcement, military, or intelligence fields) to the private sector of business and service organizations.  

I hope the above helps to point you in some new and positive directions.

Answer provided by J. David Quilter, Security Executive Council Faculty Emeritus.  David’s new book, "From One Winning Career to the Next," is available for purchase at https://www.securityexecutivecouncil.com/secstore/index.php?main_page=product_info&cPath=77_65&products_id=320

Higher Education for the Next Generation Security Leader

Q. I have read the Council’s series of articles in the Knowledge Corner on the Next Generation Security Leader. The article about acquiring security training and knowledge, including academic degrees, prompted a question in my mind. I understand that experience in core programs is essential; however, I was wondering if you could give some insight into how higher education is addressing the needs of next generation security leaders.

A. There are a number of institutions of higher learning that offer undergraduate, graduate, and certificate programs in “Security Management.” Unfortunately, the current curricula in these programs tend to focus on traditional issues including: personnel management, loss prevention methodology, investigations, legal aspects and liability, IT security, emergency management and terrorism. While all of these topics are important, they don’t adequately address the breadth of business competence that will be the hallmark of the next generation security leader. As recent surveys have shown, those selected for high profile security positions are increasingly coming from business backgrounds. This is in large part because CEOs, CFOs, and Boards of Directors want individuals in those positions who understand the company’s business objectives and can make risk management decisions within that context.

One of the most effective ways to protect and preserve a company’s business and reputation is to prevent bad business decisions. A security professional can add value to that process by understanding and being able to provide risk related input on issues such as product development, marketing, business development, advertising, regulation and compliance, and emerging markets. However, to be regarded as credible, the security leader must be viewed as a business professional whose risk management recommendations and actions are based on sound business judgment.

What is the role of institutions of higher learning in helping to educate future security professionals? The challenge is to evolve programs to support the changing requirements of security leadership. This means developing degree and certificate programs that include multidisciplinary content drawn from business, IT and criminal justice programs. For working professionals, this also means programs that are offered mostly or completely online. I am aware of one university that is considering such a multidisciplinary program, but it is still at least a year from being launched. Hopefully, other institutions are looking at similar programs. For now, students will have to choose elective courses within existing programs that give them the knowledge foundation they will need to be successful.

Editor’s note: See the Council’s guide: Security Training Resources, for some education and training options

Answer provided by Dan Rattner, Security Executive Council Emeritus Faculty.

Security Leadership Career Transition from Public to Private Sector

Q. As a retired law enforcement officer who would like to continue working for 15 more years, I am considering whether a career in corporate security would be a good option.  What steps do I need take to determine if there are enough opportunities in security to make this a good decision? Can you offer some advice on a career path for me?

A. This is "THE" question posed from law enforcement, military, intelligence and other public sector leaders to senior security leaders in the private sector and business. The opportunities for hard-working and dedicated law enforcement professionals to excel in corporate security are everywhere around the globe.  As a start here are four key questions you can ask yourself:
 1.    Are you flexible enough for such a career?
 2.    Do you want to manage or do you want to lead?
 3.    Do you have the stamina to meet the needs of a large or global corporation?
 4.    Are you a life-long learner?  What is your personal work ethic and are you smart enough to know what you don't know?

Before addressing these four questions there are a few other things you need to consider and take time to ponder.  First, the most important action to take is to start your quest well before any possible or expected date of departure from your current position.  I consistently recommend everyone start 24 to 36 months (or earlier if you can) to learn everything you can about business.  A significant shortfall when moving from the public to private sector is not having a clear understanding of the cultural and organizational dynamics of the environment in which they hope to succeed.  A good way to start is to join security organizations, such as:
• ASIS International (formerly American Society for Industrial Security)
• ACFE (Association of Certified Fraud Examiners)
• CSI (Computer Security Institute)
• SEC (Security Executive Council)

You will enhance your business acumen by becoming professionally certified with credentials like a CPP (Certified Protection Professional), CFE (Certified Fraud Examiner) or CISSP (Certified Information Systems Security Professional). This is what I refer to as the academic side of a security career and is similar to going though a good law enforcement academy.  When any of us came out of our basic training or academy we knew it was simply a starting platform; our real learning was going to be on the street.  Real success in corporate or private security goes well beyond finding leading organizations and having the right credentials. 

The key component to becoming a really successful corporate security leader comes by finding industry security mentors with proven security management, operational know-how and skills that have been honed in the business world.  Finding this person, or persons, is the equivalent of having a great FTO (field training officer), supervisor and experienced "rabbi" all rolled into one.  Having worked with and helped several "rookies" to enter corporate security and go on to grow into global security leaders themselves is really something special.  Some of them have themselves built great security teams that deliver real results to the business bottom line.  That said here are a few comments on our four questions.

1.    Are you flexible enough for such a career?  Just like other aspects of business the security function may contract or expand.  Everyone looks forward to the expansion, but what about the contractions?  In the past five to ten years there has been a switch from hiring those with "backgrounds" in law enforcement and the military to hiring those with proven security skills and business know-how.  There are exceptions, but today most businesses are not likely to hire someone right out of a law enforcement agency to be their senior security leader.  In most cases you need to be willing to start off as a supervisor or manager on a corporate security team.  
2.    Do you want to manage or do you want to lead?  Although strong management skills are necessary to be an effective public sector leader, this does not necessarily translate to success in corporate security.  It is essential to determine if a business is looking for a security manager to maintain the status quo -- if that is the case be sure to ask the question: What does managing the security function look like and what are the business’ expectations?  Security leadership takes a lot of creativity and thinking outside of its traditional roles for today’s business environment; that is, are you going to help deliver positive bottom line business results?  Most organizations will say they want leadership – don't be foolish and take that at face value.  Have the business leaders give you examples of what they visualize as security leadership.  Dig behind both their questions and, more importantly, their answers to get a better sense of the direction they foresee security being operationally productive across their enterprise. 
3.    Do you have the stamina to meet the needs of a large or global corporation?  If you are coming from a big department or agency where you have lots of manpower and resources to attack a problem you are likely in for a surprise, if not a shock.   You have to be prepared to work 10-14 hour days and sometimes seven days a week.  Starting over you will likely be dealing with lots of tactical issues (at times its like herding cats) and almost always without the manpower and resources you have come to expect.  This is very wearing if you did not anticipate and prepare for this in advance.
4.    Are you a life-long learner?  What is your personal work ethic and are you smart enough to know what you don't know?  Highly successful leaders in today's businesses are constantly learning.  To stay current in today’s fast moving business environments security leaders have to be learning new material at about 20 to 25% each year or they will find themselves literally obsolete in four to five years.  As a senior security manager or leader are you willing to meet that learning expectation or hopefully exceed it?  Every aspect of what a security professional delivers to the business needs to be right on target.  In building my teams I have always hired people smarter than me, with different skill sets than mine and all had to have a primary focus on being a business partner (not a security geek or security “expert.”)  They all knew they had to be self-starters, pushing themselves intellectually and creatively to foresee and anticipate the legitimate security needs of the business.  As I often say:  in business it's not about security, it's about business! 

The great thing is you are in control of where you spend your resources and time as you ponder the above.  You have to decide what kind of position you are seeking.  It is essential you find a level of support that is meaningful well before you begin to think about interviewing for opportunities you are seriously considering.  To cross the business world threshold without significant preparation is akin to beginning a journey to places unknown. 

The business world offers wonderful opportunities for those seeking a second career from the public sector.  This will require a lot of flexibility on your part as you transform your knowledge, skills and abilities into the marketplace of the entrepreneur. 

Answer provided by J. David, Quilter, Security Executive Council Faculty Emeritus.  David’s new book, "From One Winning Career to the Next," is available for purchase at https://www.securityexecutivecouncil.com/secstore/index.php?main_page=product_info&cPath=77_65&products_id=320

Who Should Security Executives Report to?

Over the past several years, I’ve had the opportunity to observe various companies approach the considerations in hiring a Chief Security Officer. If you were a fly on the wall when top management is considering upgrading their security program, it’s possible the conversation might go something like this. At the end, we would appreciate your
feedback -- who should the CSO report to?

The company and the names in this debate are purely fictitious but based on real experiences.  Assume the company is a large-cap publicly traded Fortune 250, in a business where sensitive customer data is processed; they are extensively outsourcing non-core business processes and their Board of Directors is concerned about the unaddressed risks in the security program.
_______________________________________________________________
 
The COO walks into the CEO’s office for their weekly lunch meeting and the first thing out of his mouth is “so, I’ve considered it and I’m convinced that we need to significantly upgrade our security program.  How would you propose we proceed to fill its leadership?”

COO: “I anticipated your buy-in and I think we should let Marilyn (SVP Human Resources) and Bill (Chief Information Officer) provide us with their rationale for having this responsibility in their portfolio. They both have some real skin in this game.”

CEO: “Why not you?”

COO: “I’ve already got too much on my plate with our international initiatives.  Marilyn and Bill are both on the Executive Committee and I think either of these elevate security closer to you and the Board.” 

CEO:  “The Board and the Audit Committee have made their concerns very clear on our current shortcomings with regard to a variety of security issues.  What we have to resolve between these two is whether this job is going to have real access and be more fundamental to our global risk management strategy or is it more of a day-to-day tactical job?”

COO: “I agree.  Based on our audit reports over the last several quarters coupled with our global initiatives, there’s just too much going on in the security-related area of risk that we don’t know and that makes me nervous.  Let’s get somebody in that job that can really scope out our security risks and get the business unit managers on board with solutions.”

CEO:  “Set up a meeting for you and me with these two and lets see who has the best vision for this function?”

The COO calls Marilyn, the SVP of HR, and Bill, the CIO, and lays out the challenge:  “We are moving ahead with a more senior hire for Corporate Security.  We think this involves moving the current function out of Facilities and into either of your portfolios to give it greater visibility and reach.  Prepare your position descriptions and we will meet with the CEO late next week.”

At the appointed hour, Marilyn and Bill enter the boardroom.  The CEO welcomes them and says “I’ve taken the liberty of asking our Chief Counsel to join us as I think there may be a number of issues of concern to him in this position. Marilyn, why don’t you start?”

HR: “I see security as a support function to the business, perhaps even decentralized across our business functions. Anyone who approaches this job as the be all and end all of security misses the point that every manager in this company has an obligation to protect our shareholders and our assets.  While it’s clear that this position requires a leader who understands risk, I think a critical success factor will be in their ability as a relationship manager, somebody who can build trust so that our business unit managers will come to him or her with their issues before they boil over. At the end of the day, that approach is at the core of HR’s service focus”

CIO:  “I think Marilyn is right about this position focusing in the business units. Our whole IT strategy is built around the notion of us providing security policy that holds every employee accountable for protecting our infrastructure and our private data. At the corporate level, we provide the tools and the intellectual leadership to a cadre of trained information security specialists in every business function.  The same philosophy is applied in our business continuity program that resides in my office.  Facilities already provides an in depth physical security program around our data centers and other critical spaces that IT has mandated and much of our emphasis there has been in technology rather than guards.  It seems to me it would be relatively simple to add a few complimentary programs to what we already have and limit our costs.”

HR: I’d be interested in hearing what our Chief Counsel has to say about the services and competencies this position has to bring to the table.”

Chief Counsel: “Look at the expanded job description for a Chief Security Officer that has emerged since 911: internal and external investigations, threat analysis, intelligence, physical security, personnel security, information protection, emergency preparedness and response management. I’d add to that a global network of contacts, a far more comprehensive background vetting program and significantly greater risk assessment around our expanding domestic and global business partners.”

CEO: “That sounds significantly broader than what each of you are talking about.  How would you approach these capabilities?”

HR: “Our HR Employee Relations team is highly competent in fact finding around allegations of misconduct and we’ve contracted for a confidential hotline to comply with new regulations.  Moreover, we have very few reported instances of internal misconduct. I would assume we would continue to use outside contractors for fraud investigations. We seem to be in line with our peers on just vetting a select few in management and risk prone positions.”

COO: “Marilyn, you are the employee’s advocate.  And Bill, your people are highly limited in non-technical or operational security issues.  It doesn’t seem to me that either of your teams is trained to comprehensively probe suspected instances of employee fraud or trade secret theft.  These have potentially serious consequences for the company.”

CIO: “With all respect, having HR responsible for background and internal investigations presents a potential conflict of interest in my view. We are increasingly empowering a broader and deeper base of employees and contractors with sensitive logical and physical access.  I think expanding both our background vetting and security-related due diligence makes a lot of sense.  I’d look for a highly qualified security generalist to manage much of the work Counsel has outlined.  A properly staffed security team, backed by a clear set of policy expectations and a mandate to work collaboratively with their HR and business colleagues and business managers is the course I’d take in this initiative.”

HR: “Bill has mentioned ‘policy’ twice.  The culture we have here does not respond well to policies and an appearance of a control-centered enforcement philosophy. IT is wholly focused on technical risk and many of the issues Counsel refers to are human threats which require a totally different mind set on internal controls.  He speaks of a concern for having certain security programs in HR while at the same time his CISO lives within the IT department!  I do agree with Bill on hiring a highly qualified security generalist but I’d focus the search on someone with several years of corporate experience rather than the law enforcement backgrounds that seem to be prevalent in the field.  Finally, I think it’s important to note HR’s record on the application of best practices. I’d bring that sort of leadership to the development of best practices in security risk management.”

CEO: “You both seem to feel that this is a take it or leave it choice, that somehow your leadership and unique environments will result in a better security program.  Fair enough. Both HR and IT bring assets and liabilities to the table. But I’m concerned that neither of you have spoken about the range of threats confronting the company as we adapt to our markets and competition. What sort of security leadership competencies and experience will add value in those critical areas?”

COO: “I share our CEO’s concerns.  I think it underscores the need for this individual’s ability to connect the dots, to see across the interdependencies and seek out the weaknesses in our internal controls.  Many of those controls are either owned or heavily influenced by your organizations.”

CIO: “As we have gone around the table, I have to admit that I’m coming to the conclusion that this function should be independent.  What about you Marilyn?”

HR: “I’d share that with the assurance that this job be filled by a proven professional who can develop respect for the function and influence our managers on stewardship and commitment to doing the right thing.”

CIO: “I’d echo that with the suggestion that we form some sort of multi-disciplinary security committee chaired by security.  It seems to me that this would provide some assurance that we are all working on the same agenda with regard to risk management.”

CEO: “How would Counsel summarize this debate?”

Chief Counsel: “I agree. I would also add that we need to bring Facilities into the solution inasmuch as the physical security elements are key to an integrated corporate security program.  I think we all accept the need for a Chief Security Officer position.  The question on the table now is to whom should this CSO position report?”

COO:  “Right, and what functions should report to the CSO?”

_______________________________________________________________

What do you think? We encourage readers of Faculty Advisor to send their feedback.

Food for thought:

What important points on their behalf did either HR or IT fail to make?
Are there any important competencies for this position that were not mentioned?
Would you recommend that the information security program remain under the CIO or should it be converged within the new security department?
If you were the CEO, what was the most compelling point to influence your decision?

To whom do you think the security executive position should report and why?
• Admin
• Executive
• Facilities / Real Estate
• Finance
• HR
• Info / IT / Technology
• Legal
• Shared Services
• Other

Scenario compiled and written by George Campbell, Security Executive Council Emeritus Faculty

Looking for Next Security Career Move

Q:  I'm looking for my next career move. I've brushed up my resume and sending to job postings that seem like good possibilities for me. But I'm getting very few responses or even acknowledgments that they received by resume.  Can you suggest what I might be doing wrong?

A:  You have hit upon one of the top frustrations experienced by security job seekers from entry to executive level opportunities.  This couple with the difficulty in getting a return phone call is why we have counseled candidates to not take anything you experience personally and to expect your job search to be about as enjoyable as self-acupuncture.  Many corporations have downsized their HR staffing departments while at the same time automating, and in many cases, outsourcing their collection process.  With email, internet collection and the ability for candidates to mass mail resumes to organizations, the process is becoming very impersonalized. Candidates are lucky to get a confirmation email or an acknowledgment card. We are also aware of a number of instances where the hiring manager is waiting for resumes from HR that where submitted through their online system only to be told there are no applicants, then a month later mysteriously the HR recruiter "finds" them and forwards them.   As an executive search firm, we also experience difficulty with communication within HR departments, and this is after they have contracted with us and paid us a retainer.   

On the recruiting side of this issue, frequently organizations are inundated with responses from candidates that are just responding to any job posting they see because it is fast and easy.  For some reason they believe that this will get them noticed.  It does, but in a negative sense. Professional security positions are not prevalent in organizations so if you send your resume to a posting that doesn't fit your background, the recruiter is not likely to have more security openings from the same department or organization to match you against. READ the position specification before applying!  If the spec calls for international experience in China with bilingual English/Mandarin and you are the security manager for the town of Twin Arrows, Arizona where you lived your whole life and once visited Tijuana, it is not likely you will be taken seriously.  Also, if you have the experience and qualifications asked for, and it is not apparent in your "standard version resume,” customize it and try to send along a short note in the email or cover letter so the recruiter can see that you are serious about that particular opportunity. 

And last, an example of what not to do.  Recently we did an ASIS job board posting listing just the job titles and locations on 16 open searches from India to Dubai at various levels.  We directed the candidates to our website with specific instructions to read the position specifications before applying.  We receive 144 resumes sent through ASIS in response to
this list of job titles.  We ended up having to contact each person and ask them to please go to our site and read the position spec and apply accordingly. Multiple this by 10,000 and you begin to understand the volume that corporations receive just for security related positions in any given month.

Answer provided by Jerry J. Brennan, Security Executive Council Content Expert Faculty

Security Job Search Woes

Our Faculty advisor Jerry Brennan wants to know -- when looking for or applying to security positions, e.g., security manager, director of security, CSO, CISO, etc., what are the most frustrating things during the process?

Email your list to me at: contact@secleader.com

- Kathleen

How to Make Changes to Security Program

Q. I am in a large, highly matrixed business. How do I go about designing and then implementing changes to security?  What are the changes that enhance security and drive business success?   One thing is for sure, change is slow here. 

A. Whatever your original estimate is – you should at least double it.  It takes patience, persistence and a broad base of both business and security skills. 

First, it will take leadership that is very flexible and your values have to be solid to the core.  It also requires long days filled with a lot of listening, likely travel and a willingness to take risks.  For many it will take every skill you have ever learned. 

Being a life long learner is absolutely essential for today’s security leader – irrespective of your past credentials.  Your learning has to include equal doses of personal confidence and humility.  These two essentials traits combined with sound security expertise are the ingredients that can transform security in any business or organization.  If it is pulled off successfully, you have the opportunity to move beyond skills to the realm of know-how.  It is know-how that catapults any businesses from good to great.  The same is true for the security leader with know-how.  This is both part of the fun and the challenge.

Answer supplied by J. David Quilter, Security Executive Council Emeritus Faculty

Public-Private Relationship

Q. I work in the public sector (government) and believe I can learn more by reaching out to the private sector and creating relationships. Any thoughts on how to approach such partnerships?

A. You are correct that you can gain additional knowledge by reaching out to the private sector. However, it is unclear what specifically you hope to gain by this activity. There is a lot to learn in the government field if we take off our filters and focus.  Seek out a mentor; this can advance your skills no matter what sector. Additionally, whether you work in government or the private sector you should join organizations that attempt to provide additional insights in a number of areas that you would find interesting. The American Society of Industrial Security International (ASIS) would be a good start.

It's possible that you are also seeking a resource that can facilitate a career transition to the private sector. Of course, there is nothing wrong with such a course of action. But just like taking an exam, it helps if you bone up on what makes the private sector tick before jump starting any career change. For example, look up books by Peter Drucker; probably one of the most revered business management thinkers. Can you learn from the private sector? Absolutely, accelerating change and even decision making can be more rapid in the private sector. The differences (and similarities) might be more transparent through mentoring and research.

Answer provided by Charles Connolly, Security Executive Council Emeritus Faculty.