It seems that with each passing year, the expectations placed upon those in leadership roles within the security industry grow heavier and more complex. Gone are the days when a firm handshake, a shiny badge and a few war stories from a previous life in law enforcement were enough to secure the top job. In today’s risk-saturated world, the role of a security leader – particularly within large-scale corporate or international frameworks – demands more than technical skill or academic accolade. It demands nuance, vision, and perhaps most critically, the ability to lead without needing to be the loudest voice in the room.
There’s a prevailing myth that to ascend to the role of Chief Security Officer (CSO), one must come armed with a string of degrees, preferably capped with an MBA. But as Damian McMeekin, former Global Head of Security at ANZ and now principal at OGMA Advisory, rightly points out, credentials alone don’t make a leader.
This isn’t to downplay the value of formal education—far from it. A degree might teach you business theory, strategy, even some risk frameworks. But the real-world complexity of leading a security function in a global corporation can’t be learned in a lecture hall. It’s earned in the trenches of experience, in boardrooms where risk must be translated into commercial language, and in the grey spaces between policy and pragmatism.
The most effective security leaders, according to McMeekin, are those who understand business first. Security, after all, does not exist in a vacuum. Whether you’re protecting assets in a hostile geopolitical environment or rolling out a cyber resilience framework in a retail chain, the same truth holds: security must enable business, not hinder it. That means understanding operational goals, revenue pressures, and customer expectations as fluently as one understands threat matrices and penetration testing.
To lead in security is also to be relentlessly adaptable. The environment is dynamic, the threats are ever-evolving, and the expectations—both internal and external—are often contradictory. There is no one-size-fits-all model. What works in a multinational bank headquartered in Melbourne will not apply in a federal agency tasked with securing overseas embassies. As McMeekin astutely observes, context is everything.
The question then becomes, how does one prepare for such a role? The answer is layered. First and foremost, real-world risk management experience is paramount. Not just ticking boxes on a compliance checklist, but making calls when the stakes are high and the outcomes uncertain. And crucially, knowing how to justify those decisions in business terms. It’s one thing to say “we need more guards.” It’s another to say “A $300k investment in physical security will reduce our exposure to a $10 million operational risk.”
Equally essential is people skills – the undervalued currency of executive effectiveness. Leadership is less about directing and more about influencing. This is especially true in corporate settings where a security leader must build bridges to the C-suite, communicate across silos, and navigate the political topography of internal departments. Technical mastery may win you respect. Empathy and persuasion win you alignment.
Interestingly, many of the most accomplished security leaders McMeekin has worked with have backgrounds not in business, but in government—diplomacy, law enforcement, defence. These sectors cultivate skills that are often underappreciated: policy development, ambiguity tolerance, and the ability to execute under uncertain and often ambiguous circumstances. According to McMeekin, such traits are not merely useful; they’re essential.
But let’s not pretend the path is quick. Executive-level security leadership is, as McMeekin puts it, a long-tail event. There are no shortcuts. Those who reach the top typically do so after years, sometimes decades, of exposure to increasingly complex challenges. It is not a linear journey, and nor should it be. The winding path is where the learning happens.
Lastly, it’s important to separate the title from the function. Being a CSO is not the same as being a security leader. One is a position. The other is a practice. You can be a leader without being a CSO. And you can be a CSO without ever truly leading. The difference lies in how one chooses to engage – with their team, their organisation, and the broader security community.
In the end, the most effective security leaders are those who can hold both vision and detail, who understand when to speak and when to listen, and who know that their ultimate job is not to build empires, but to make themselves redundant by building capable, confident teams. Leadership, after all, is not about being indispensable. It’s about making others indispensable.
Click here to listen to the full interview.
