Business Value

A good leader will manage a team that is respectful, knowledgeable and committed to service excellence. Leadership in anticipating and responding to risk, influencing policy, and communicating on the shared responsibility for asset protection are success factors for the shareholders of the company.

The Essentials

This chapter focuses on three interrelated, high-level views of security leadership: leadership competencies, keys to organizational influence and impact, and the “next generation security leader.” Each grouping focuses on security leadership through a different lens of personal impact, organizational impact, and next generation security skills.

The first view offers nine competencies the individual should bring to the job and further develop as part of a planned growth strategy. The second view of security leadership summarizes five measures of influence that are clearly reflective of organizational leadership, and the third displays 65 knowledge elements and skills that serve to enhance corporate leadership. This latter inventory enables rating yourself against a next generation model as well as allowing you to outline the knowledge and skills you seek to hire in order to complement the team.

1. Team leader—First and foremost, you are the leader of the security team. Inspire them to learn, excel, and be customer focused. Hire the best. Avoid those who seek to be the corporate cop. Only engage those contractors who are capable of understanding the corporate culture and your vision for the program.

2. Thought leader and subject matter expert—Our profession brings unique expertise to the organization. You need to consider how this knowledge can be blended into corporate strategy and tactics.

3. Business enabler and creative problem-solver—We need to support corporate efforts in succeeding in the competitive marketplace. We do this by enabling the business to engage in processes that might otherwise be too risky.

4. Business strategist and advisor—You must understand the businesses you support! Security’s goals reflect the goals and plans of the company, and your ability to lead will be tied to your ability to engage business management on their own terms.

5. Risk management guide—Risk is why you have a job. You have a unique perspective; you see gaps in controls from your risk assessments and incident post-mortems. Your programs provide an ability to connect the dots on risk-related issues that others do not have. Anticipate! Operate the security risk radar and use your pulpit to assure awareness.

6. Influencer of enterprise policy—As a leader, you will be in a position to influence the scope and content of a core set of risk management policies or guidelines. Communicate! Act as a positive change agent on behalf of organizational protection.

7. Relationship manager—An effective working relationship with business unit managers at all levels is a key element in your protection strategy. From this collaborative foundation, you may influence business strategy and better ensure issue resolution.

8. Risk group and security committee leadership—You are a member of the corporate governance team and see risk in unique ways. Work closely with legal, audit, human resources, risk management, and others to gain perspective on risk and to influence risk management strategy.

9. Management model—You model the behavior essential to a company that believes and acts with integrity. You lead your team to excel and practice quality in their craft.

“Leadership is the art of accomplishing more than the science of management says is possible.” —Former secretary of state Colin Powell

1. A framework of security policies explicitly endorsed by senior management—Sell a manageable set of high-level policy statements to senior management. For example, “We will provide safe and secure workplaces for our employees and visitors.” Engage the CEO and others. Who can argue against that statement, which is based in employment law? The follow-up question is, what programs at what cost will ensure that this policy will be met? You may find yourself in a culture that abhors the perceived strictures of “policy.” In that case, label these factors as business principles, jurisdictions, guidelines, or program objectives. The point is that you get buy-in for those few high-level statements that enable goal-setting and a foundation of expectations. See Chapter 6, “Organizational Models,” for a more complete discussion on this factor.

Why is this valid?

An accepted policy framework articulates management expectations. As such, it supports your definition of the work to be performed in order to deliver on each one. An understanding of the work supports defensible alternatives to staffing and budget development.

2. A core management philosophy that holds line managers accountable for protecting the firm—Security is everybody’s job, and you are there to provide leadership, expertise, a workable infrastructure, and the tools to enable line managers to share this important responsibility. Furthermore, management must understand that protecting the company and its shareholders is everyone’s job.

Why is this valid?

If they expect you to protect the company, update your resume. You are an enabler of their fiduciary responsibility to protect the shareholders of the company. You are the expert, the first responder, but the rest of management are the custodians of corporate assets.

3. A clearly established role in the corporate risk management program—Risk is why they hired you. You know about risks that the rest of the governance team likely hasn’t ever considered. Get on the team and lead in your area(s) of expertise. Use metrics to track trends and measure the results of security strategies. Collaborate on solutions with your colleagues.

Why is this valid?

Consider this: there is a high-level discussion of the risks confronting the company and nobody thought to invite you or ask for your input. “Security” is about the absence of risk! Without your perspective, they don’t have an actionable handle on risk.

4. A qualitative risk analysis and reporting program—Security generates lots of data on a variety of risks. Organize it. Analyze it. Learn what contributed to incidents and identify the vulnerabilities. Inform management and identify what...