Help Wanted: Security Staffing and Recruiting

MetLife CSO Robert Cordier answers readers' questions about security recruiting.

January 09, 2003 — CSO — MetLife CSO Robert Cordier answers readers' questions about security recruiting.

Q: How do you determine "appropriate" levels of security—levels that have a direct impact on the amount of budget you're given? Information security, as a profession, seems to be grappling with this question more than ever.A: Since 9/11, in my opinion, most corporations have appropriately augmented security-related budgets with generous enhancements to upgrade security measures. Determining the appropriate level of security is most effectively done by taking a holistic view of the enterprise. First, there should be a security template to identify policies, procedures and installations of equipment and technology for consistent application throughout all facilities. While not all budgets will provide for the immediate enhancement of all facilities to this threshold level of security, an analysis and prioritization of security upgrades across an enterprise will allow for a phased implementation of these security enhancements.

To identify components that require security upgrades, a comprehensive security questionnaire can provide a ranking of the most crucial and sensitive operations. From this ranking, immediate and more concerted security enhancements can be targeted with minimal impact on the security budget.

Onsite security reviews and inspections of facilities or lines of business is mandatory by the security component. Where possible, this function could be contracted to reputable security consultants for independent review.

To complement these processes, the implementation of an effective crisis management initiative, involving representatives from all business functions and operations, is effective in establishing policies that enhance the security program throughout the corporation. The crisis management process can justify budget enhancements to those who might otherwise be ignorant as to the need or value of certain security expenditures.Q: I am a recruiter working with executives looking for senior opportunities in physical security. Most of our clients are searching for security executives who are skilled in information security. What is your opinion of the CSO role? Is the ideal candidate a physical security guru, an information security executive or a combination of both?A: The CSO is an executive-level position with responsibility for the maximum coordination and integration of security protocols, procedures and policies within a corporate structure. All security departments have a mission with three goals: 1. provide for the safety and security of all employees, 2. protect and maintain all corporate facilities and the physical assets and property, and 3. ensure the security and continued preservation of all corporate information, research, and proprietary data and the technology that supports it.

• Print