Global Security Strategy Director

Role Purpose & Context

Role Summary

The Global Security Strategy Director is responsible for crafting and delivering a unified security vision that covers all our real estate assets worldwide. This means you'll be the architect behind how we protect our offices, data centres, and other facilities, making sure everything from physical access to incident response is top-notch and consistent. You'll work at the intersection of global threats and local operational realities, translating high-level risk assessments into practical, actionable security programmes that our regional teams can actually implement. When this role is done well, our employees feel safer, our assets are protected, and we avoid costly security breaches or reputational damage. When it's not, we're exposed to significant risks, from theft and vandalism to major incidents that could halt operations or harm our people. The challenge is balancing global standards with diverse local regulations and cultural norms, often with tight budgets. The reward? Knowing you've built a robust defence that keeps thousands of employees safe and our business running smoothly, no matter what the world throws at us.

Reporting Structure

• Reports to: VP, Global Facilities & Operations
• Direct reports: Roughly 5-8 regional security managers or specialist leads
• Matrix relationships: Head of Global Physical Security, Principal Security Strategist, Real Estate, Director of Corporate Security (Facilities), Global Security Programme Manager,

Key Stakeholders

Internal:

• CFO and Finance leadership (for budget approval and cost justification)
• Legal & Compliance (for regulatory adherence and incident response)
• HR and Employee Relations (for staff safety, training, and crisis communication)
• Regional Facilities Directors (for operational implementation and local context)
• IT Security (for convergence of physical and cyber security)
• Executive Leadership Team (for strategic updates and major incident briefings)

External:

• Law Enforcement Agencies (local and international)
• Security Technology Vendors (for product selection and innovation)
• Security Consultants and Integrators (for project delivery and expertise)
• Industry Peer Groups (for sharing best practices and threat intelligence)
• Insurance Providers (for risk mitigation and policy negotiation)

Organisational Impact

Scope: This role directly shapes our global risk posture. Your decisions influence how we allocate millions of pounds in security spend, how quickly we recover from major incidents, and ultimately, the safety and peace of mind of every employee in our facilities. Get it right, and we're resilient; get it wrong, and the consequences can be severe, impacting everything from our bottom line to our brand reputation.

Performance Metrics

Quantitative Metrics

1. Metric: Reduction in Security-Related Losses
2. Desc: This measures the decrease in financial impact from incidents like theft, vandalism, unauthorised access, or business interruption directly attributable to physical security failures across the global portfolio.
3. Target: Reduce by 15% year-on-year
4. Freq: Quarterly and Annually
5. Example: If last year's losses were £2M, we'd expect to see them closer to £1.7M this year. This includes things like insurance claims, repair costs, and estimated lost productivity from security incidents.
6. Metric: Global Security Budget Variance
7. Desc: How well you manage and forecast the global security budget, making sure we're spending effectively and within our allocated resources.
8. Target: Maintain budget within +/- 5% of forecast
9. Freq: Monthly and Quarterly
10. Example: If your annual budget is £5M, you're aiming to spend between £4.75M and £5.25M. This shows you can plan and execute financially, not just strategically.
11. Metric: Enterprise Physical Security Maturity Score
12. Desc: This tracks our overall physical security posture against a recognised industry framework (e.g., ASIS, ISO 27001 physical controls). It's about demonstrating continuous improvement in our capabilities.
13. Target: Improve from Level 2 to Level 3 within 24 months
14. Freq: Bi-annually (via independent audit)
15. Example: Moving from a 'Reactive' to a 'Proactive' or 'Managed' state across key domains like access control, CCTV, and incident response. This isn't just about ticking boxes; it's about real, demonstrable progress.
16. Metric: Global Incident Response Time (Critical Incidents)
17. Desc: The average time from a critical security incident being detected to the Global Security Operations Centre (GSOC) initiating the first appropriate response action.
18. Target: Maintain an average response time of under 3 minutes
19. Freq: Monthly
20. Example: If an alarm triggers at a remote site, the GSOC should have verified it, assessed the threat, and initiated contact with local response (e.g., police, site manager) within 3 minutes. This is about operational efficiency under pressure.

Qualitative Metrics

1. Metric: Executive & Board Confidence
2. Desc: The degree to which senior leadership and the Board trust your strategic advice and feel informed about global security risks and mitigation efforts.
3. Evidence: You'll be regularly invited to present to the Board Risk Committee. Executives will seek your counsel on new market entries or major facilities projects. They'll ask *you* for updates during crises, not just your direct reports. Your recommendations on significant security investments will typically be approved, showing confidence in your judgment.
4. Metric: Global Programme Adoption & Standardisation
5. Desc: How effectively you can get regional teams to adopt and consistently implement global security policies, standards, and technologies.
6. Evidence: Regional security managers will actively participate in global working groups and share best practices. You'll see consistent deployment of agreed-upon security tech across different geographies. Audit results will show high adherence to global policies, with fewer 'local exceptions' that undermine the overall strategy. People will actually *use* the playbooks you create.
7. Metric: Proactive Risk Identification & Mitigation
8. Desc: Your ability to anticipate emerging threats and put in place preventative measures before they become major incidents.
9. Evidence: You'll regularly brief leadership on geopolitical risks affecting our footprint, presenting clear mitigation strategies. We'll see fewer 'surprise' incidents because you've identified and addressed the vulnerabilities early. Your team will conduct regular 'red team' exercises, finding weaknesses before an adversary does. You're not just reacting; you're looking around corners.

Primary Traits

• Trait: Decisive Under Pressure
• Manifestation: When a major incident hits—say, civil unrest near a key facility or an active threat—you're the one who can cut through the noise, make clear, defensible decisions with incomplete information, and give unambiguous commands. You'll triage competing priorities in real-time, knowing when to prioritise life safety over asset protection. You don't freeze; you act.
• Benefit: In a real crisis, hesitation isn't just bad, it can be catastrophic. People need a leader who can take command, direct a global response, and instil confidence. Your team and our executives will look to you for calm, clear direction when everything else is chaos.
• Trait: Influential (Up and Across)
• Manifestation: You're brilliant at building compelling business cases for security investments that actually resonate with the CFO, not just security people. You can persuade skeptical business unit leaders in different regions to adopt standardised security protocols, even if they think their local way is 'special'. You navigate internal politics like a pro, building coalitions and getting buy-in without throwing your weight around.
• Benefit: Security is often seen as a cost centre, not a revenue generator. Without the ability to influence budget holders, operational partners, and even the Board, the most brilliant security strategy will just sit in a PowerPoint deck. You need to be able to 'sell' security internally, making it clear why it matters to *them*.
• Trait: Accountable (Unflinching)
• Manifestation: When a security failure happens—and let's be real, they do—you take ownership. Your post-incident reviews focus on 'what can we learn and fix?' not 'who can we blame?'. You're transparent when reporting breaches or near-misses to leadership, explaining the situation clearly and outlining the path forward. You don't shy away from uncomfortable truths.
• Benefit: A culture of blame drives security issues underground, meaning we never learn from our mistakes. Unflinching accountability from the top builds trust with leadership and encourages a learning-oriented security culture where problems are reported, analysed, and fixed early, making us stronger in the long run.

Supporting Traits

• Trait: Calm Under Pressure
• Desc: The ability to project stability and think clearly when everyone around you is panicking. You're the eye of the storm, making sure rational decisions are made.
• Trait: Forward-Thinking
• Desc: You anticipate threats based on geopolitical trends, technological shifts, and criminal behaviour, rather than just reacting to past incidents. You're always looking 'left of bang'.
• Trait: Politically Astute
• Desc: You understand the unwritten rules, power structures, and cultural nuances within a large, global organisation. You know who to talk to, how to frame a message, and when to push versus when to wait.
• Trait: Empathetic Leader
• Desc: You can effectively manage the human side of security, from supporting a distressed employee after an incident to understanding the motivations of a potential insider threat. You lead your team with understanding and clear expectations.

Primary Motivators

1. Motivator: Protecting People and Assets
2. Daily: You get a genuine kick out of knowing your work directly contributes to the safety of thousands of colleagues worldwide and the security of our valuable properties. This isn't abstract; it's tangible protection.
3. Motivator: Strategic Impact & Global Reach
4. Daily: You thrive on setting a vision and seeing it implemented across diverse geographies. The idea of shaping a global programme, influencing decisions at a senior level, and dealing with complex, international challenges excites you.
5. Motivator: Problem Solving & Continuous Improvement
6. Daily: You love dissecting complex security challenges, finding elegant solutions, and constantly optimising systems and processes. The 'perfect record paradox' (where success means nothing happened) doesn't demotivate you; it drives you to find new ways to be even more effective.

Potential Demotivators

Honestly, this role isn't for everyone. You'll constantly be fighting the 'eternal cost centre battle,' having to justify every penny of your budget to executives who only truly appreciate security when something goes wrong. You'll likely face 'security theatre' mandates – being asked to implement highly visible but low-impact measures just to make people *feel* safer, diverting resources from genuine risks. Expect the 2 AM global call; your phone is never truly off, as a major incident 12 time zones away is still your problem. You'll also inherit 'legacy tech hell' from past acquisitions, dealing with ancient, unsupported systems that are a nightmare to integrate. If you need constant external validation for your work, or if you struggle with the 'perfect record paradox' (where your biggest successes are the things that never happened), you'll probably find this frustrating. And let's not forget the constant fight against apathy from local facility managers who see global standards as a burden.

Common Frustrations

1. The 'Eternal Cost Centre Battle': Constantly justifying budget to those who see security as a necessary evil, not a value-add.
2. The 2 AM Global Call: Your phone is never truly off; a crisis anywhere in the world means you're on duty.
3. Legacy Tech Hell: Inheriting a patchwork of ancient, incompatible security systems from past acquisitions.
4. Fighting Apathy: Battling the 'it can't happen here' mindset and getting local teams to adopt global standards.
5. The Privacy vs. Security Tightrope: Navigating conflicting global privacy laws when implementing surveillance and monitoring technologies.
6. The 'Security Theatre' Mandate: Being asked to implement visible but low-impact measures just for optics, rather than addressing real risks.

What Role Doesn't Offer

1. A predictable 9-5 schedule – global incidents don't respect time zones.
2. A role where you're always the most popular person in the room – security often means saying 'no' or imposing restrictions.
3. A chance to be hands-on with every operational detail – your focus is strategic leadership.
4. A quiet, low-stress environment – you'll be dealing with high-stakes situations regularly.

ADHD Positives

1. The need for rapid, decisive action during crises can be a huge strength, as you're often good at hyper-focusing under pressure.
2. The varied, global nature of the role means less routine and more novel problems, which can be highly engaging.
3. Your ability to quickly connect disparate pieces of information can be invaluable in threat intelligence and strategic planning.

ADHD Challenges and Accommodations

1. The constant context-switching between different global regions and incident types might be challenging; we can help by providing clear prioritisation frameworks and dedicated blocks for deep work.
2. Managing a large, distributed team requires strong organisational skills; we can support with virtual assistants or project management tools to keep things on track.
3. The need for detailed, long-term strategic documentation might feel tedious; we encourage using AI tools for drafting and summarisation to ease this burden.

Dyslexia Positives

1. Your strong visual-spatial reasoning can be a major asset in understanding complex facility layouts, threat mapping (like with ArcGIS), and designing 'concentric circles of protection'.
2. Often, dyslexic thinkers excel at 'big picture' strategic thinking, which is exactly what this role demands – seeing patterns and connections others miss.
3. The emphasis on verbal communication and presentation to senior leaders plays to strengths in storytelling and persuasive argument.

Dyslexia Challenges and Accommodations

1. Reading and drafting extensive policy documents or detailed incident reports might be challenging; we encourage the use of text-to-speech tools, grammar checkers, and AI for summarisation and drafting.
2. Ensuring accuracy in written communications is crucial; we can offer proofreading support for critical documents and encourage using templates.
3. Note-taking during complex strategic discussions can be tricky; voice recording (with consent) or collaborative digital whiteboards can help capture key points.

Autism Positives

1. A strong logical and analytical approach is highly valued in developing robust security frameworks, risk assessments, and incident response protocols.
2. Your ability to spot patterns and inconsistencies can be critical in identifying vulnerabilities and anticipating threats that others might overlook.
3. The focus on clear, unambiguous policies and procedures is a natural fit, as you'll be defining these for a global organisation.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues can be difficult; we'll provide clear expectations for stakeholder engagement and support in understanding team dynamics.
2. Unexpected changes or urgent global incidents can be disruptive; we aim to provide as much advance notice as possible and clear communication channels during crises.
3. The sensory environment of a Global Security Operations Centre (GSOC) can be intense (multiple screens, constant alerts); we can discuss flexible working arrangements or dedicated quiet spaces if needed.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Principal/Manager (12-16 years)
2. Responsibilities: Set the global physical security vision and multi-year strategic roadmap for our entire real estate portfolio, making sure it aligns with overall business objectives and emerging threat landscapes.
3. Build and lead a high-performing global team of regional security managers and specialists, providing clear direction, mentorship, and development opportunities (you'll have roughly 5-8 direct reports).
4. Own the global security budget (typically £500K-£2M), making strategic allocation decisions, justifying investments to the CFO, and ensuring cost-effectiveness across all programmes.
5. Transform our existing security capabilities by identifying gaps, championing new technologies (like advanced video analytics or integrated PSIM platforms), and driving their adoption across all regions.
6. Design and implement enterprise-wide security policies, standards, and procedures, ensuring they're fit for purpose, globally consistent, and compliant with local regulations (this is a tricky balance).
7. Represent the organisation as the primary physical security expert to senior executives, the Board Risk Committee, and external partners, providing expert advice and presenting on our security posture and major incidents.
8. Supervision: You'll operate with a high degree of autonomy, setting your own strategic objectives in alignment with the VP, Global Facilities & Operations. We'll have quarterly objective reviews, but day-to-day, you're the expert and the decision-maker. You're expected to be self-directed and proactive.
9. Decision: You'll have full authority for your function. This means you can approve budget allocation up to £500K, make hiring and firing decisions for your direct reports, and select global security vendors up to £100K without further approval. For major strategic shifts or investments above these thresholds, you'll consult with the VP, Global Facilities & Operations, but your recommendations carry significant weight. Decisions impacting overall company policy or requiring Board-level communication will need C-suite alignment.
10. Success: Your success will be measured by a demonstrable improvement in our global security posture, a significant reduction in security-related incidents and losses, and your ability to build a truly cohesive and effective global security team. We'll also look at how well you manage your budget and how effectively you can influence senior leaders to support your strategic initiatives.

Decision-Making Authority

• Type: Global Security Policy Changes
• Entry: N/A
• Mid: N/A
• Senior: Propose changes to Director, gather feedback from regional leads.
• Type: Global Security Technology Selection
• Entry: N/A
• Mid: N/A
• Senior: Research and recommend specific technologies for project leads.
• Type: Regional Security Incident Response (Major)
• Entry: N/A
• Mid: N/A
• Senior: Execute specific response actions as directed by incident lead.
• Type: Team Hiring & Performance
• Entry: N/A
• Mid: N/A
• Senior: Participate in interviews, provide feedback on candidates.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical know-how, a Global Security Strategy Director needs a robust set of 'human' skills. You'll be leading teams, influencing executives, and navigating complex, often high-stakes situations. These aren't just 'nice-to-haves'; they're absolutely essential for success in this role.

• Category: Strategic Leadership & Vision
• Skills: Ability to define a clear, compelling security vision that aligns with business goals and inspires a global team.
• Capacity to translate complex global threats into understandable risks and actionable mitigation strategies.
• Skill in anticipating future security challenges and proactively developing solutions (forward-thinking).
• Category: Influence & Communication
• Skills: Exceptional ability to build consensus and persuade senior executives and diverse regional stakeholders on security investments and policy adherence.
• Clear, concise, and compelling communication skills, both written (for Board reports) and verbal (for crisis briefings and presentations).
• A knack for simplifying complex security concepts for non-technical audiences, making the 'why' clear.
• Category: Crisis Management & Decisiveness
• Skills: Proven ability to lead effectively under extreme pressure, making sound decisions with incomplete information during high-stakes incidents.
• Skill in developing and executing robust crisis management plans, coordinating multi-regional responses.
• The capacity to remain calm and project confidence when others are panicking, guiding the team through difficult situations.
• Category: Global Acumen & Cultural Sensitivity
• Skills: Deep understanding of geopolitical dynamics, international security threats, and diverse cultural norms.
• Ability to navigate complex international regulations (e.g., GDPR, local surveillance laws) and ensure global compliance.
• Experience leading and motivating geographically dispersed, multicultural teams.

Functional Skills (Role-Specific Technical)

This role demands a blend of deep security expertise, practical application of methodologies, and a strong grasp of the technologies that underpin modern physical security. You'll need to know the 'what' and the 'how', but more importantly, the 'why' behind every decision.

Technical Competencies

• Skill: Threat, Vulnerability, and Risk Assessment (TVRA)
• Desc: You'll be the master of systematically identifying threats to our global assets, analysing vulnerabilities across our diverse portfolio, and designing comprehensive security countermeasures. This isn't just about ticking boxes; it's about building a truly defensible security programme.
• Level: Expert
• Skill: CPTED (Crime Prevention Through Environmental Design)
• Desc: You'll apply this multi-disciplinary approach to deterring criminal behaviour through architectural and environmental design. This means influencing smart building design standards, ensuring natural surveillance, effective access control, and territorial reinforcement are baked into our facilities from the ground up.
• Level: Advanced
• Skill: ASIS International Standards
• Desc: You'll have deep familiarity with key ASIS standards (e.g., Physical Asset Protection, Investigations, Executive Protection). You'll use these to define professional best practices, benchmark our programme maturity, and ensure we're operating at a world-class level.
• Level: Expert
• Skill: Business Continuity & Crisis Management
• Desc: You'll be responsible for planning for and responding to all-hazard disruptive events—natural disasters, civil unrest, utility failures—to ensure our organisational resilience. This goes beyond traditional security to encompass all threats affecting our facilities and our ability to operate.
• Level: Advanced
• Skill: Physical Security Information Management (PSIM)
• Desc: You'll define the framework for integrating disparate security systems (access control, video, intrusion detection) into a single common operating picture for our GSOC. This is about dramatically improving situational awareness and response times across our global footprint.
• Level: Advanced
• Skill: Executive Protection (EP) Strategy
• Desc: You'll design and manage programmes to ensure the safety of our key executives at corporate headquarters, during travel, and at public events. This involves high-level intelligence gathering, advance planning, and coordination with law enforcement agencies globally.
• Level: Advanced

Digital Tools

• Tool: Genetec Security Center (or similar enterprise VMS/Access Control)
• Level: Strategic
• Usage: Leading platform selection, developing enterprise-wide standards, overseeing global system architecture and integration strategies. You're not just using it; you're defining how we use it.
• Tool: Everbridge Critical Event Management (CEM) (or similar incident management platform)
• Level: Strategic
• Usage: Defining the entire incident response framework, setting crisis management policy, and briefing executives during major global events. You're the architect of our crisis communication and response.
• Tool: Dataminr / Factal (or similar threat intelligence platforms)
• Level: Strategic
• Usage: Integrating threat intelligence into our enterprise risk management (ERM) framework, determining global travel security policies, and briefing the Board on emerging geopolitical threats. You're our eyes and ears on global risks.
• Tool: ServiceNow GRC / Archer GRC Suite (or similar GRC platform)
• Level: Strategic
• Usage: Owning the security GRC module, setting the risk appetite for physical security, and reporting on our compliance posture to the Board and regulators. You're ensuring we meet all our legal and ethical obligations.
• Tool: Power BI / Tableau Server (or similar executive reporting tools)
• Level: Strategic
• Usage: Designing and presenting the global security dashboard for the C-suite, using data to justify budget, demonstrate ROI, and articulate strategic shifts. You're telling the security story with data.
• Tool: Diligent Boards / Nasdaq Boardvantage (or similar board reporting platforms)
• Level: Advanced
• Usage: Presenting security strategy, high-stakes incident reports, and risk updates directly to the Board or Risk Committee. This is about communicating at the highest level of the organisation.

Industry Knowledge

• Area: Global Geopolitical & Threat Landscape
• Desc: A deep understanding of international relations, regional conflicts, terrorism trends, organised crime, and cyber-physical threats that could impact our global operations and facilities.
• Area: Real Estate & Facilities Management Operations
• Desc: Familiarity with the lifecycle of commercial real estate, from acquisition and design to daily operations and divestment, and how security integrates into each stage. Understanding the operational realities of facilities teams is key.
• Area: Security Technology Market & Trends
• Desc: Keeping abreast of the latest advancements in physical security technologies, including AI-powered analytics, biometrics, drone detection, and integrated security platforms, to ensure our strategy remains cutting-edge.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Ensuring all surveillance, access control, and personal data handling within our physical security systems comply with GDPR and other regional data privacy laws. This is a constant tightrope walk between security and privacy.
• Reg: Local/National Security & Surveillance Laws
• Usage: Understanding and ensuring compliance with the diverse and often conflicting security and surveillance regulations in every country where we operate. What's legal in one place might be illegal in another, and you'll need to navigate this complexity.
• Reg: Health & Safety Regulations (e.g., UK HSE, OSHA)
• Usage: Ensuring physical security measures don't inadvertently create health and safety risks, and that security protocols align with broader H&S requirements for our facilities and employees.

Essential Prerequisites

• A minimum of 12 years of progressive experience in corporate physical security, with at least 5 years in a leadership or strategic role overseeing multiple sites or regions.
• Demonstrable experience in developing and implementing enterprise-level security strategies and programmes for a large, complex organisation.
• Proven track record of managing significant security budgets (e.g., £500K+) and delivering projects on time and within financial constraints.
• Extensive experience with incident and crisis management at a regional or global scale, including executive-level communication during critical events.
• Strong understanding of physical security technologies and their integration (e.g., VMS, access control, intrusion detection, PSIM).
• Experience leading and developing a team of security professionals, including managers.
• A solid grasp of global geopolitical risks and their potential impact on corporate assets and personnel.

Career Pathway Context

Typically, people arrive in this role having spent time as a Regional Security Manager, a Principal Security Strategist for a specific domain (like Executive Protection or Threat Intelligence), or a Security Programme Manager for a major global initiative. You'll have already proven your ability to manage complex projects, lead teams, and influence stakeholders at a senior level.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI Ethics & Governance for Security
• Why: As we deploy more AI-powered surveillance, predictive analytics, and automated response systems, the ethical and legal implications become paramount. Getting this wrong can lead to massive reputational damage, legal battles, and erosion of employee trust.
• Concepts: [{'concept_name': 'Bias in AI algorithms', 'description': 'Understanding how AI models can inherit and amplify biases, particularly in facial recognition or predictive policing, and how to mitigate these.'}, {'concept_name': 'Data privacy in AI systems', 'description': 'Navigating the complex interplay between AI-driven data collection (e.g., video analytics) and global privacy regulations like GDPR.'}, {'concept_name': 'Accountability for AI decisions', 'description': 'Establishing clear lines of responsibility when an AI system makes a critical security decision or error.'}, {'concept_name': 'Transparency and explainability (XAI)', 'description': 'The ability to understand and explain how an AI system arrived at a particular security alert or risk assessment.'}, {'concept_name': 'Human oversight in automated systems', 'description': "Defining the 'human in the loop' protocols for AI-driven security systems to ensure ethical and effective control."}]
• Prepare: This month: Read up on recent controversies and legal cases involving AI in security and surveillance.
• Next quarter: Attend a webinar or course on AI ethics, specifically for corporate applications.
• Within 6 months: Develop an internal policy draft for the ethical deployment of AI in our physical security operations.
• Within 12 months: Engage Legal and HR to review and refine the AI ethics policy for global rollout.
• QuickWin: Start a discussion with your IT Security and Legal teams about their current AI governance frameworks; learn from their experiences and adapt for physical security.
• Skill: Cyber-Physical Convergence Strategy
• Why: The lines between cyber and physical security are blurring. A breach in one can easily impact the other (e.g., a cyber-attack on a BMS leading to physical disruption). You need to think holistically about protecting our assets from both digital and physical vectors.
• Concepts: [{'concept_name': 'IoT security in facilities', 'description': 'Securing smart building devices (sensors, HVAC controls) from cyber-attacks that could compromise physical safety or data.'}, {'concept_name': 'Integrated threat intelligence', 'description': 'Combining cyber threat intelligence with physical threat intelligence to get a complete picture of risks.'}, {'concept_name': 'Unified incident response', 'description': 'Developing joint incident response plans with IT Security for events that have both cyber and physical components.'}, {'concept_name': 'Supply chain security (digital components)', 'description': 'Assessing the cyber vulnerabilities of physical security hardware and software vendors.'}, {'concept_name': 'Identity and access management (IAM)', 'description': 'Extending digital IAM principles to physical access control systems for a more robust, unified approach.'}]
• Prepare: This month: Schedule regular syncs with the CISO and their leadership team to understand their top cyber risks.
• Next quarter: Identify one key area (e.g., IoT security in buildings) where physical and cyber teams can collaborate on a joint risk assessment.
• Within 6 months: Develop a joint cyber-physical incident response tabletop exercise with IT Security.
• Within 12 months: Propose a roadmap for integrating physical and cyber security platforms or data feeds.
• QuickWin: Identify the top 3 cyber vulnerabilities in your current physical security tech stack (e.g., unpatched VMS servers) and work with IT to address them immediately.

Advancing Technical Skills

• Skill: Advanced Data Analytics & Visualisation for Security
• Why: To move beyond reactive reporting, you'll need to harness data from all security systems (access control, video, alarms, incident logs) to identify trends, predict vulnerabilities, and prove ROI. This isn't just about dashboards; it's about actionable intelligence.
• Concepts: [{'concept_name': 'Predictive modelling for incident hotspots', 'description': 'Using historical data and external factors to forecast where and when security incidents are most likely to occur.'}, {'concept_name': 'Correlation of disparate security data', 'description': 'Connecting events from different systems (e.g., access denied, then alarm triggered, then video motion detected) to build a clearer picture.'}, {'concept_name': 'Geospatial analysis (GIS) for risk mapping', 'description': 'Overlaying security incidents, asset locations, and external threat data on maps to visualise risk concentrations.'}, {'concept_name': 'Performance benchmarking of security controls', 'description': 'Quantifying the effectiveness of different security measures (e.g., how much does an extra guard reduce theft?)'}, {'concept_name': 'Executive-level data storytelling', 'description': 'Presenting complex data insights in a clear, compelling narrative that drives strategic decisions.'}]
• Prepare: This month: Deep-dive into Power BI or Tableau; go beyond viewing dashboards to building custom reports.
• Next quarter: Identify a specific security problem (e.g., reducing false alarms) and build a data-driven model to address it.
• Within 6 months: Explore advanced GIS tools (like Esri ArcGIS) for threat mapping and asset vulnerability analysis.
• Within 12 months: Lead a project to integrate data from 2-3 disparate security systems into a unified analytics platform.
• QuickWin: Pick one security KPI (e.g., incident response time) and build a more detailed, interactive dashboard that shows trends and root causes.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree in Security Management, Criminal Justice, Business Administration, or a related field.
• Alts: Extensive (15+ years) relevant experience in a senior corporate security role, especially with a strong track record of strategic leadership, can be considered in lieu of a degree. We value proven capability over a piece of paper.
• Level: Preferred
• Req: A Master's degree (e.g., MBA, MSc in Security Management, International Relations, or Risk Management).
• Alts: This isn't strictly required, but it shows a commitment to advanced strategic thinking and a broader understanding of business or global affairs, which is definitely a plus.

Experience Requirements

You'll need roughly 12-16 years of progressive experience in corporate physical security, with a significant portion (at least 7-10 years) spent in leadership roles overseeing multi-site or global security operations. This isn't an entry-level management role; you'll need to have a proven track record of building and running complex security programmes, managing substantial budgets (think £500K+), and leading teams of security professionals. We're looking for someone who has genuinely shaped security strategy, not just executed it.

Preferred Certifications

• Cert: Physical Security Professional (PSP)
• Prod: ASIS International
• Usage: This shows a deeper specialisation in physical security assessments, design, and integration, which is highly relevant to our real estate portfolio.
• Cert: Certified Information Security Manager (CISM)
• Prod: ISACA
• Usage: Given the increasing convergence of physical and cyber security, a CISM demonstrates an understanding of information security governance and risk, which is a significant advantage.
• Cert: Certified Business Continuity Professional (CBCP)
• Prod: DRI International
• Usage: This certification highlights your expertise in business continuity and crisis management, essential for ensuring our operations remain resilient during disruptions.

Recommended Activities

• Regularly attend global security conferences (e.g., GSX, ISC West) to stay current on industry trends and network with peers.
• Participate in industry working groups or committees (e.g., ASIS, OSAC) to contribute to best practices and expand your professional network.
• Engage in executive leadership training programmes to further develop your strategic influence and organisational management skills.
• Subscribe to leading security intelligence publications and geopolitical risk analysis services to stay informed on emerging threats.
• Mentor junior security professionals, as teaching is often the best way to solidify your own understanding and build future leaders.

Career Progression Pathways

Entry Paths to This Role

• Path: Regional Security Manager (Large Region)
• Time: 5-8 years to reach this Director level
• Path: Principal Security Strategist (Specialised Domain)
• Time: 4-7 years to reach this Director level
• Path: Security Programme Manager (Global Initiatives)
• Time: 6-9 years to reach this Director level

Career Progression From This Role

• Pathway: Director, Global Security Strategy (L6)
• Time: 3-5 years in the current role

Long Term Vision Potential Roles

• Title: VP, Global Security (L6)
• Time: 5-8 years from current role
• Title: Chief Security Officer (CSO) (L7)
• Time: 8-12+ years from current role
• Title: Chief Operating Officer (COO) (L7)
• Time: 10-15+ years from current role

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.