1.2.1 Know the Culture

Success begins with knowing business culture in general and the culture of your business in particular. According to David Burrill, one of the most difficult challenges for security professionals coming out of the public sector is learning to understand how the private sector works. The gap between public- and private-sector processes is wide, but can be overcome by the attentive and open-minded professional.

Lorna Koppel, director of IT security with Kohler Company, says that learning the culture of the organization and where you fit into it is first priority for leading successfully in the context of the company. “Be highly observant and watch others around you at your level and higher. Pick up things they’re successful at and avoid things that they’re less successful at.” Your leadership style should depend upon the culture and needs of the company, says Koppel.

Jim Hutton, director of the global security department of Procter & Gamble (P&G), agrees, adding that you also need to recognize and remedy any disconnects between your style and the organization’s. “Understand that what you think you need to deliver may not in fact be what they need. What you’re good at or best prepared for may not be the best fit for the new mission. Being willing to address the gap between your background and the mission is really important; you have to be confident enough to go out and learn new things.”

1.2.2 Enable the Business

Leading security is your job, but you can’t succeed at it unless you put the needs of the business first and then tailor security to those needs. “I tell my people that we start from yes, we don’t start from no,” says Hutton. “We may have to heavily caveat our yes sometimes, but it’s a general rule. We make them mindful of the constraints, but we enable them. And then the 5 percent of the time I have to say no, absolutely no, they’ll listen.”

“You have to know the risk appetite of the company and how you can match your security program to that,” said Leslie Lambert, CISO and vice president of IT for Sun Microsystems. Security is traditionally viewed as a naysayer, always telling the company what it can’t do. “But we should be learning to talk to business folks about what is possible instead of listing out all the limitations,” Lambert says.

If your security stance doesn’t resonate with the business, adds Kohler’s Koppel, you can’t expect business to change. You have to change your message. Corporate security may have legitimate and even critical concerns, but if they deal with them in a way that’s counter to business goals, they’ll fail.

1.2.3 Know Security

While business knowledge is the number-one priority for successful security leadership, an in-depth knowledge of security—specifically corporate security—is obviously also important. But that doesn’t mean you have to be an experienced installer, says David Burrill. “You wouldn’t expect a leader to be able to site CCTV or directly run a guard force or know how to break into a combination safe. But you would expect him or her to know that there is a range of activities for which there must be technical competencies, and to know that the people he’s employing or outsourcing to have the adequate competencies,” he explains.

Security acumen is critical because, according to P&G’s Hutton, “your solutions are going to have to be well grounded and well crafted. Executives are getting more sophisticated in this space.” If you’re proposing a solution that’s outdated or has proven ineffective at a similar organization, decision-making executives will recognize that and shoot you down.

1.2.4 Communicate Effectively

Communication is key to successful security leadership, both with other executives and with the security team below you.

“As security professionals in the corporate or IT side, we have to be strong in business language. If we can’t present our issues in a business framework or in business lingo, (C-suite executives) are not going to...