RiskUKSeptember2017

Training and Career Development
‘security manager’ might refer to a traditional
physical security role, an information security
systems role or perhaps even a job in software
development. With the concept of security
diversifying in response to an ever-broadening
threat landscape, this confusion can be a
further challenge for traditional security
practitioners when it comes to career planning.
The question is: ‘What can we do about this?’
Part of the wider problem might be that
security still exists within a number of different
silos. At the organisational level, whether
fuelled by pessimism or paranoia, we’ve built
walls around our departments to keep our
‘security stuff’ secret without realising that
what we really need to be doing is sharing it.
Whether we’re helping staff in other
departments to spot fraud, detect suspicious
behaviour, be more aware online or respond
more confidently to conflict, we’re empowering
the organisation to be more secure on a ‘one
person at a time’ basis. Such activity may help
to raise our profile organisationally and could
even trigger conversations that might reveal
hidden risks or opportunities for the business,
not to mention illuminate new career pathways
for ourselves as practitioners.
Weak at building bridges
Beyond the organisational silo, the sector
seems to exist in a professional one. The sector
is weak when it comes to building bridges with
other professions, both in terms of sharing
expertise and opening further career pathways.
Security people tend to network with other
security people, which may say somewhat more
about our ‘comfort zone’ than it does any
deliberate attempt to avoid other professions.
An alternative to this might be to seek
speaking slots at events for other sectors, or
writing security-related articles that are
relevant for trade journals outside of the
security domain. Security is a ‘people problem’
and, as such, we have insights that other
professions may duly appreciate.
The final silo is the one that we build
ourselves. If we only see ourselves as
‘traditional security people’ then this is all that
others will see us as, and their lack of
understanding of the importance and scale of
what it is we do will mean that they only call
upon us when they think there’s a problem (at
which point it’s often too late). Certainly,
security practitioners have been undertaking
Health and Safety accreditations for a number
of years to enhance their employability, but this
is perhaps an obvious step.
Another potential consideration is the
apparent shortfall of cyber security
“Whether a security practitioner is highly qualified, highly
experienced or both, suitable senior-level security
management opportunities are somewhat difficult to find”
professionals, with some reports suggesting
the number is going to be as high as 1.8 million
globally in the next five years. Considering the
shift in the asset base from physical to
information, this demand is foreseeable.
We as traditional security practitioners need
to overcome our fear of technology to take
advantage of this situation. If we accept three
principles – that security is a ‘people problem’,
that technology only allows people to commit
old crimes in new ways and that (using the
CISSP certification programme as an example)
nearly half of the knowledge required to work
in cyber security is within our existing
knowledge base – then there’s a chance to
forge a different career pathway.
There are also other avenues to consider. A
highly competent security practitioner might
add value in a range of corporate roles
including FM (for physical security), HR (for
people-based risks), logistics (supply chain
risks) and many others. Some of these
departments even have a direct career
trajectory into the C-Suite (including that
coveted CSO role). That being so, requalifying
to move departments might provide security
practitioners with longer term advantages.
If we accept that security is a business
enabler, we can begin to see which other areas
of the organisation we can enable through
sharing our knowledge and experience. Doing
so will require us to broaden our horizons and
open our minds. The best way to do that might
be to leave the Security Department behind us
forever and seek work in other teams.
Banish outdated thinking
Ultimately, it could be argued that we need to
break our ‘death grip’ on the concept of security
as a ‘department’. Such thinking is undeniably
outdated. For security to be truly effective it
must be part of the wider organisational culture
and is therefore not a department, but instead
a shared responsibility.
Perhaps security should be an element in a
wider management skills set instead of being a
discipline on its own, similar in nature to
project management accreditations?
While all of this is very much open to debate,
what is not is that, if we continue to do what
we’ve always done, we will always derive the
same end results (or perhaps worse, given the
ever-changing nature of today’s world).
Richard Diston MSc MSyI:
Director of Ark-Services
59
www.risk-uk.com